Agile and compliant firewall ACL configuration management for DevOps

Agile and compliant firewall ACL
configuration management for DevOps
Ildefonso Montero <imontero@intellimentsec.com>

Who am I:
Ildefonso Montero
Backend Software Developer (+10 years)
Last 3 years working on DevOps and Network Automation
at Intelliment Security

Let’s talk about
DevOps, Security, and Network Automation

Application Delivery
I’m involved on the development of an application and I need ...
to push this changes on production env (~minutes)

to deploy several services on infrastructure (~minutes)

to perform live migrations on hybrid multi cloud
environments (~minutes)

to have network visibility across services inside and
outside the infrastructure (~hours, ~days)

to build a lab environment to test high availability of my
services on networking issues (~days, ~weeks)

to being able to work while infrastructure team perform
changes on our network infrastructure
(~weeks, ~months)

Network Delivery O.P.E.R.A.T.I.O.N.A.L Issues
● Too long time to delivery (~25 days avg)
● Too many changes (+30.000 per year)
● Network could be evolving continuously
● Network Policies shall be periodically reviewed, and unused rules
removed to prevent rules degradation and tech debt
(~thousands of lines/conf)
● Complicated and highly manual approval process
● Security Compliance is usually managed separately from change
management process

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p 6 -i B_frontend -o B_backend -m tcp -m iprange --src-range 10.31.50.60-10.31.50.99 -m iprange --dst-range
10.31.40.10-10.31.40.39 -m multiport --destination-ports 3306,5432,1521 -m comment --comment "SQL databases access" -j ACCEPT
COMMIT
to have network visibility across services inside and outside
the infrastructure

config firewall address
edit "B_PHPs"
set comment "Backend PHP servers"
set color 7
set type iprange
set start-ip 10.31.50.60
set end-ip 10.31.50.99
next
edit "B_DBs_SQL"
set comment "Database servers"
set color 7
set type iprange
set start-ip 10.31.40.10
set end-ip 10.31.40.39
next
end
config firewall policy
edit 1
set srcintf "B_frontend"
set dstintf "B_backend"
set srcaddr "B_PHPs"
set dstaddr "B_DBs_SQL"
set action accept
set service "mysql" "postgres" "oracle"
set schedule "always"
set logtraffic disable
set comments "SQL databases access"
next
end
config firewall service custom
edit "mysql"
set color 7
set protocol TCP/UDP/SCTP
set tcp-portrange 3306
next
edit "postgres"
set color 7
next
edit "oracle"
set color 7
next
end
the infrastructure

create tcp_service mysql
modify services mysql color orange
modify services mysql port 3306
modify services mysql comments ''
modify services mysql include_in_any false
update services mysql
create tcp_service postgres
modify services postgres color orange
modify services postgres port 5432
modify services postgres comments ''
modify services postgres include_in_any false
update services postgres
create tcp_service oracle
modify services oracle color orange
modify services oracle port 1521
modify services oracle comments ''
modify services oracle include_in_any false
update services oracle
create address_range B_PHPs
modify network_objects B_PHPs color orange
modify network_objects B_PHPs ipaddr_first 10.31.50.60
modify network_objects B_PHPs ipaddr_last 10.31.50.99
modify network_objects B_PHPs comments ''
modify network_objects B_PHPs add_adtr_rule false
update network_objects B_PHPs
create address_range B_DBs_SQL
modify network_objects B_DBs_SQL color orange
modify network_objects B_DBs_SQL ipaddr_first 10.31.40.10
modify network_objects B_DBs_SQL ipaddr_last 10.31.40.39
modify network_objects B_DBs_SQL comments ''
modify network_objects B_DBs_SQL add_adtr_rule false
update network_objects B_DBs_SQL
create policies_collection IS_rb_SiteB_FG
update policies_collections IS_rb_SiteB_FG
create firewall_policy ##IS_rb_SiteB_FG
modify fw_policies ##IS_rb_SiteB_FG collection policies_collections:IS_rb_SiteB_FG
update fw_policies ##IS_rb_SiteB_FG
addelement fw_policies ##IS_rb_SiteB_FG rule security_rule
modify fw_policies ##IS_rb_SiteB_FG rule:0:name 'IS_rule'
modify fw_policies ##IS_rb_SiteB_FG rule:0:comments 'SQL databases access'
modify fw_policies ##IS_rb_SiteB_FG rule:0:disabled false
addelement fw_policies ##IS_rb_SiteB_FG rule:0:action accept_action:accept
addelement fw_policies ##IS_rb_SiteB_FG rule:0:src:'' network_objects:B_PHPs
addelement fw_policies ##IS_rb_SiteB_FG rule:0:dst:'' network_objects:B_DBs_SQL
addelement fw_policies ##IS_rb_SiteB_FG rule:0:services:'' services:mysql
addelement fw_policies ##IS_rb_SiteB_FG rule:0:services:'' services:postgres
addelement fw_policies ##IS_rb_SiteB_FG rule:0:services:'' services:oracle
update fw_policies ##IS_rb_SiteB_FG
update_all
the infrastructure

<entry name="localhost.localdomain">
<vsys>
<entry name="vsys1">
<service>
<entry name="mysql">
<protocol>
<tcp>
<port>3306</port>
</tcp>
</protocol>
</entry>
<entry name="postgres">
<protocol>
<tcp>
<port>5432</port>
</tcp>
</protocol>
</entry>
<entry name="oracle">
<protocol>
<tcp>
<port>1521</port>
</tcp>
</protocol>
</entry>
</service>
<service-group/>
<address>
<entry name="B_PHPs">
<ip-range>10.31.50.60-10.31.50.99</ip-range>
</entry>
<entry name="B_DBs_SQL">
<ip-range>10.31.40.10-10.31.40.39</ip-range>
</entry>
</address>
<address-group/>
<application/>
<zone/>
<rulebase>
<security>
<rules>
<entry name="IS_rule">
<action>allow</action>
<from>
<member>any</member>
</from>
<to>
</to>
<source>
<member>B_PHPs</member>
</source>
<destination>
<member>B_DBs_SQL</member>
</destination>
<service>
<member>mysql</member>
<member>postgres</member>
<member>oracle</member>
</service>
<application>
</application>
<description>SQL databases access</description>
<log-start>no</log-start>
<log-end>no</log-end>
</entry>
</rules>
</security>
</rulebase>
</entry>
</vsys>
</entry>
the infrastructure

object network B_PHPs
range 10.31.50.60 10.31.50.99
object network B_DBs_SQL
range 10.31.40.10 10.31.40.39
object service mysql
service tcp destination eq 3306
object service postgres
object service oracle
object-group service G_586576025
service-object object mysql
service-object object postgres
service-object object oracle
access-list Intelliment_Rule_B_frontend remark SQL databases access
access-list Intelliment_Rule_B_frontend extended permit object-group G_586576025 object B_PHPs object B_DBs_SQL log disable
!
access-group Intelliment_Rule_B_frontend in interface B_frontend
!
the infrastructure

the infrastructure

Automation
to push this changes on production env (~minutes)
to deploy several services on infrastructure (~minutes)
to perform live migrations on hybrid multi cloud
environments (~minutes)

Network Automation
Why Network Automation Matters, and What You Can Do
About It – Rick Sherman at PuppetConf 2016
(https://www.youtube.com/watch?v=GZs2rXSEXoY)

Network Automation
Juniper PyEZ, PanOS, Cisco NX-API - pycsco, IOS-XR - pyIOSXR …
NetConf, YANG, Openconfig, IETF Operational Model Structure …
Netmiko, Paramiko, Napalm …
Software Defined Networks, Opendaylight, NFV, flunnel, kb-proxy …
Project Calico, Romana, Fugue …
ansible, puppet-modules, chef inspec …

Network Automation
to have network visibility across services inside and outside the infrastructure
to build a lab environment to test high availability on networking issues
to being able to work while infrastructure team perform changes on our network

Network Automation
(~days, ~weeks, ~months)

still having the same O.P.E.R.A.T.I.O.N.A.L issues
management process

Agility by abstraction
to have network visibility across services inside and outside the
infrastructure
Just say what you want instead of thinking how to
perform it

App Owners - Dev/Ops / Network needs
I need to consume SNMP servers
I will provide a service by tcp 443 and tcp 80
SecOps / Security Rules
User network must have visibility to App server
Risk teams / Compliance
DMZ traffic must be limited to Internet by tcp 443

Network Abstraction Layer
App Owner /
DevOps
specifies app
connectivity Network
Engineer
specifies quality
Security
Consultant
specifies
compliance Security
Engineer
specifies threat
response
Network
Infrastructure
Data
Ingestion
…

Network Abstraction Layer
App Owner /
DevOps
specifies app
connectivity Network
Engineer
specifies quality
Security
Consultant
specifies
compliance Security
Engineer
specifies threat
response
Network
Infrastructure
Data
Ingestion
…
API / UI
Query and Operate the Network In Code
Network Security Policies Orchestration Controller

Security Policies Inventory
Visualization
Line of Sight
Automatic Migration
Orchestrated deployment
Multivendor
Change Simulation
Validations
Change Traceability
Pre-approved Flows / Policies
Automatic Change Implementation
Network Security Policies Orchestration Controller Features

What is Intelliment?
A Network Security Policies Orchestration Controller Implementation

● Abstracts network topology and network security policies
● Security policies are expressed as user intents
● Maintains a network security policies knowledge base
● Orchestrates, Diagnoses and Deploy change requests
● No vendor lock-in
● Agentless
● Hybrid Network Infrastructure (physical, virtual, cloud, SDN)
● Third-party integrations ready
● RESTful API

● Java, Akka, OSGi, Eclipse MDA Tools
● Hazelcast, CQEngine, MongoDB, MySQL
● Intelliment Security Policy Automation: HTML5, CSS3, ExtJs
● Integrations: puppet, Cisco ISE, Opendaylight SDN, etc.

Let’s see Intelliment working

Demo Use Cases
Visualise which network visibilities are defined for an AWS-based instance

Demo Use Cases
Setup predefined network visibilities configurations (ssh, ping) for GCE instances

Demo Use Cases
Deliver network visibilities for an application inside an infrastructure which
configuration is managed via Puppet evaluating compliance settings

Demo Use Cases
Deliver network visibilities for an application inside an infrastructure which
configuration is managed via Puppet evaluating compliance settings
Perform a migration from on-premise environment managed by Cisco, Palo Alto
and Fortigate, to AWS and GCE

Let’s recap
(~days, ~weeks, ~months)

Let’s recap
(~minutes)

management process
from this O.P.E.R.A.T.I.O.N.A.L issues ...
Let’s recap

● Consolidated Operations: Visualize, query and operate the network policy
as a single and consolidated entity
● Policy Portability: Specify policies as vendor and neutral intents. No
experts needed.
● Firewall Policy as Code: Write app connectivity as code to avoid translation
mistakes and clean-ups
● Continuous Preemptive Compliance: Pre-approve well known requests and
pre-deny risky ones
● Automated Application Migration: Identify and move network policies
associated with applications
● Policy Synchronization: Sync policies across QA/Dev/Prod/Failover
environments
Let’s recap

Questions?
Thanks you!
@imonteroperez
imontero@intellimentsec.com

Agile and compliant firewall ACL configuration management for DevOps

More Related Content

What's hot (20)

Similar to Agile and compliant firewall ACL configuration management for DevOps (20)

More from J On The Beach (20)

Recently uploaded (20)

Agile and compliant firewall ACL configuration management for DevOps