Re: Firewalls the libdnet way

2004-04-14T21:32:06 Bennett Todd:
> [...] define the collection of abstractions --- ideally as
> high-level as possible --- you wish for your firewall config
> to support, write the simplest possible high-level language
> description of them, then write translators to map those
> descriptions to various output targets --- ip-filter, iptables,
> whatever. And of couse proxies and clever NATting tricks to make
> them transparent....

I should have added, that the scope of this solution is very broad;
the places I've seen it implemented Cisco PIX, Cisco firewall
featureset, and Checkpoint FW1 were included in the families of
target configs. Heck, even simple Cisco router ACLs can be targeted.

One nice thing about this strategy, in a shop with existing
closed-source vendor-lockin proprietary firewalls, it provides a
gracious transition path out. Once open source firewalls can compete
on an even footing with closed ones, without the artificial barrier
of incompatible config languages, they can more easily displace the
proprietary gizmos.

-Bennett

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAf/CAHZWg9mCTffwRAgk2AJ992rBVol+5ZaLr0rhpRx0Gp9uddgCfSt7c
EdfBP52JT8LymboWHly5TxQ=
=gvGq
-----END PGP SIGNATURE-----