Firewall policy convergence and intelligent distribution method and system

Abstract

The present application relates to the field of firewall policy processing, and provides a convergence and intelligent issuing method of firewall policy, comprising: obtaining a firewall policy work order; analyzing the work order and storing it in a policy database; performing policy convergence on the policy database; performing convergence grouping on source IP, destination IP and port; screening out policies with any two or more of the same source IP, destination IP and port, and outputting the corresponding policy name; configuring a deletion policy for the policy with repeated policy name, including performing an undo operation to delete the corresponding firewall configuration information; deleting the corresponding record in the database; replying to the work order: for the firewall policy with any two or more of the same source IP, destination IP and port existing in the database, obtaining the policy name existing in the database and replying, otherwise opening the policy and replying, thereby converging the policy, reducing the firewall load and guaranteeing system operation.

Description

Technical Field

[0001] This invention relates to the field of firewall policy processing, and more specifically, to a method and system for the convergence and intelligent distribution of firewall policies. Background Technology

[0002] In the cloud business system, cloud nodes are built in various cities, with each node using the same brand of equipment, a unified work order management platform, and a distributed architecture to create a system with a unified standard and specification. Since each cloud node's data center deploys both internet zone and external network zone services, resource security isolation between the two zones is required. Network engineers use work order data from the work order management platform to enable policies. The work order management platform's database stores, but is not limited to, address information, policy information, and user information. However, due to non-standardized work orders, there is a large amount of redundant data, resulting in a massive firewall policy database and poor performance. Therefore, it is necessary to converge firewall policies and implement intelligent delivery of policy work orders. Summary of the Invention

[0003] This invention aims to overcome at least one of the shortcomings of the prior art, solve the problems of firewall policy convergence and intelligent policy work order delivery, and provide a method for firewall policy convergence and intelligent delivery, thereby converging firewall policies, reducing firewall load, and ensuring the stable operation of business systems. The specific solutions of this invention include:

[0004] S1. Obtain firewall policy work order, the work order including source information, unit information, operation and maintenance information, firewall policy, policy name, source IP, destination IP, protocol and port;

[0005] S2. Parse the work order and store it in the strategy database;

[0006] S3. Perform policy convergence on the policy database, specifically including:

[0007] Aggregate and group the source IP, destination IP, and port;

[0008] Filter out policies that have the same source IP, destination IP, and port, and output the corresponding policy name;

[0009] Configure a deletion policy for policies with duplicate policy names, specifically including:

[0010] Perform an undo operation to delete the corresponding firewall configuration information;

[0011] Delete the corresponding record from the database;

[0012] S4. Reply to the work order, specifically including:

[0013] For firewall policies in the database that share any two or more of the same source IP, destination IP, and port, retrieve the corresponding policy name from the database and reply; otherwise, enable the policy and reply. The database stores, but is not limited to, address information, policy information, and user information.

[0014] 1. When a firewall policy ticket receives two or more identical source IPs, destination IPs, and ports, a correspondence exists between private network IP addresses and virtual IPs. The source IP, destination IP, and port information sent to the firewall are completely identical, leading to resource waste and policy bloat. Over time, this will cause excessive firewall load and poor performance. Therefore, it is necessary to converge this type of firewall policy and intelligently judge and send new policies. First, based on the network policy's five-tuple information and the necessary elements of the ticket, the policy name, source IP, destination IP, protocol, and port information need to be parsed and stored in the database. The policy database can store information including policy name, address, and port. The policy name is unique, and the address information includes a single IP and a range of IPs. The single IP is configured in the policy as source-address 172.16.12.107mask255.255.255.255 (the source IP field in the database is resolved to 172.16.12.107) or destination-address 19.32.5.67mask 255.255.255.255 (the destination IP field in the database is resolved to 19.32.5.67). IP addresses are categorized by number of bits ( / ) or range (-), such as `destination-address range 19.15.28.1619.15.28.28` (resolving the database source IP field to 19.15.28.16-19.15.28.28) or `source-address 19.16.232.0 mask 255.255.255.0` (resolving the database source IP field to 19.16.232.0 / 24). Port information is categorized as a single port or a range of ports. A single port policy configuration is like `service protocol tcp source-port 0to65535 destination-port 8088` (resolving the database inbound port field to 8088). An IP address can be divided into multiple ports or a range, such as the multi-port service protocol tcp source-port 0 to 65535 destination-port 80 4438 (which resolves the database ingress port field to 80 4438), or the multi-port service protocol tcp source-port 0 to 65535 destination-port 8081 to 8082 (which resolves the database ingress port field to 8081 to 8082).

[0015] Based on the information entered into the database, policy convergence and intelligent judgment and distribution for subsequent new policies are required. For existing policies with the same source IP, destination IP, and port, and for duplicate policies, an undo rule name operation is performed, and the database connection record is deleted. Based on the database information, source IP, destination IP, and port are aggregated and grouped, policies with the same source IP, destination IP, and port are filtered out, duplicate policy names are output, configuration information is generated, and for the configuration policies with duplicate policy names, an undo deletion operation is performed to delete the firewall configuration information and the corresponding database record with the same source IP, destination IP, and port.

[0016] For policies that are determined to have the same source IP, destination IP, and port, obtain the existing policy name and directly reply to the work order; according to the work order management platform, for new work orders, extract the source IP, destination IP, and port of the work order, and then make a judgment. If a policy with the same source IP, destination IP, and port exists in the database, it does not need to be activated.

[0017] Furthermore, S3, policy convergence of the policy database, also includes:

[0018] A strategy to filter out several sources with the same source IP and destination IP but different ports;

[0019] The selected strategies are aggregated and deduplicated based on the port number.

[0020] Generate port configuration information and apply it to the first selected policy;

[0021] Configure deletion policies for the selected duplicate policies, specifically including:

[0022] Perform an undo operation to delete the corresponding firewall configuration information;

[0023] Delete the corresponding record from the database;

[0024] S4, replying to the work order, also includes:

[0025] For firewall policies in the database that have the same source IP and destination IP but different ports, retrieve the corresponding policy name from the database and reply, then issue a command to add the port policy.

[0026] For existing policies where the source IP and destination IP are the same but the ports are different, all ports are aggregated, all ports are opened on one policy, and the undo rule name operation is performed on other policies, and the database connection records are deleted.

[0027] Based on the database information, policies with the same source IP and destination IP are aggregated and grouped. Policies with the same source IP and destination IP but different ports are filtered out, and the ports of these policies are aggregated and deduplicated. Port configuration information is generated and applied to the first policy. Then, for policies with duplicate policy names, an undo operation is performed to delete the firewall configuration information and the corresponding database records with the same source IP and destination IP but different ports are deleted.

[0028] Furthermore, S3, policy convergence of the policy database, also includes:

[0029] A strategy to filter out several sources with the same source IP and port but different destination IPs;

[0030] The selected strategies are aggregated and deduplicated based on the target IP;

[0031] Generate the configuration information for the destination IP and apply it to the first filtering policy;

[0032] Configure a deletion policy for the duplicate filtering strategy, specifically including:

[0033] Perform an undo operation to delete the corresponding firewall configuration information;

[0034] Delete the corresponding record from the database;

[0035] S4, replying to the work order, also includes:

[0036] For firewall policies in the database that have the same source IP and port but different destination IPs, retrieve the corresponding policy name from the database and reply, then issue a command to add the destination IP to the policy.

[0037] For existing policies with the same source IP and port but different destination IPs, aggregate all destination IPs, enable all destination IPs on one policy, and perform an undo rule name operation on other policies, and delete the database connection records.

[0038] Based on the database information, policies with the same source IP and port but different destination IPs are aggregated and grouped. Policies with the same source IP and port but different destination IPs are filtered out, and the destination IPs of these policies are aggregated and deduplicated to generate destination IP configuration information, which is then applied to the first policy. Then, for policies with duplicate policy names, an undo operation is performed to delete the firewall configuration information and the corresponding database records with the same source IP and port but different destination IPs are deleted.

[0039] For policies that are determined to have the same source IP and port but different destination IP, obtain the existing policy name and issue a command to add a policy with a different destination IP.

[0040] Furthermore, S3, policy convergence of the policy database, also includes:

[0041] A strategy to filter out several ports and destination IPs that are the same but have different source IPs;

[0042] The selected strategies are aggregated and deduplicated based on the source IP;

[0043] Generate port configuration information and apply it to the first selected policy;

[0044] Configure deletion policies for the selected duplicate policies, specifically including:

[0045] Perform an undo operation to delete the corresponding firewall configuration information;

[0046] Delete the corresponding record from the database;

[0047] S4, replying to the work order, also includes:

[0048] For firewall policies in the database that have the same port and destination IP but different source IP, retrieve the corresponding policy name from the database and reply, then issue a command to add a policy with the source IP.

[0049] For existing policies with the same destination IP and port but different source IPs, aggregate all source IPs, enable all source IPs on one policy, and perform an undo rule name operation on other policies, and delete the database connection records.

[0050] Based on the database information, policies with the same destination IP and port but different source IPs are aggregated and grouped. Policies with the same destination IP and port but different source IPs are filtered out, and their source IPs are aggregated and deduplicated to generate source IP configuration information, which is then applied to the first policy. For policies with duplicate policy names, an undo operation is performed to delete the firewall configuration information and the corresponding database records with the same destination IP and port but different source IPs.

[0051] For policies that are determined to have the same destination IP and port but different source IP, obtain the existing policy name and issue a command to add a policy with a different source IP.

[0052] Furthermore, the aggregation and deduplication specifically includes:

[0053] Compile the destination IPs or source IPs into a list;

[0054] Filter the list to find IP ranges in bit format and range format, and then delete them from the list;

[0055] Determine whether an IP in the list belongs to the IP segment in the bit format; if so, remove it from the list.

[0056] Determine whether an IP in the list belongs to the IP range specified in the range format; if so, remove it from the list.

[0057] Add the bit-form IP segment and the range-form IP segment to the list;

[0058] The range-form IP segment consists of two IP addresses connected by a "-" symbol.

[0059] Furthermore, determining whether an IP address in the list belongs to the IP range specified in the definition, and removing it from the list if so, specifically includes:

[0060] Convert the IP addresses on both sides of the "-" sign to integer values ​​to get the number of IP addresses in that range;

[0061] Collect all IP addresses in that range into an address pool list;

[0062] Based on the stated quantity, iterate through the list to determine if all IP ranges in the list are the same as the IP addresses in the address pool list. If so, remove them from the list.

[0063] Based on the same inventive concept, the present invention also provides a firewall policy convergence and intelligent distribution system, comprising:

[0064] The work order acquisition module is used to acquire firewall policy work orders. The work order includes source information, organization information, operation and maintenance information, firewall policy, policy name, source IP, destination IP, protocol and port.

[0065] The parsing module is used to parse the work order and store it in the strategy database;

[0066] The policy convergence module is used to converge policies in the policy database, including:

[0067] Aggregate and group the source IP, destination IP, and port;

[0068] Filter out policies that have the same source IP, destination IP, and port, and output the corresponding policy name;

[0069] Configure a deletion policy for policies with duplicate policy names, specifically including:

[0070] Perform an undo operation to delete the corresponding firewall configuration information;

[0071] Delete the corresponding record from the database;

[0072] The work order processing module is used to respond to work orders, including:

[0073] For firewall policies that have the same source IP, destination IP, or port in the database, retrieve the corresponding policy name from the database and reply; otherwise, enable the policy and reply.

[0074] Furthermore, the strategy convergence module also includes:

[0075] A strategy to filter out several sources with the same source IP and destination IP but different ports;

[0076] The selected strategies are aggregated and deduplicated based on the port number.

[0077] Generate port configuration information and apply it to the first selected policy;

[0078] Configure deletion policies for the selected duplicate policies, specifically including:

[0079] Perform an undo operation to delete the corresponding firewall configuration information;

[0080] Delete the corresponding record from the database;

[0081] The work order processing module also includes:

[0082] For firewall policies in the database that have the same source IP and destination IP but different ports, retrieve the corresponding policy name from the database and reply, then issue a command to add the port policy.

[0083] Furthermore, the strategy convergence module also includes:

[0084] A strategy to filter out several sources with the same source IP and port but different destination IPs;

[0085] The selected strategies are aggregated and deduplicated based on the target IP;

[0086] Generate the configuration information for the destination IP and apply it to the first filtering policy;

[0087] Configure a deletion policy for the duplicate filtering strategy, specifically including:

[0088] Perform an undo operation to delete the corresponding firewall configuration information;

[0089] Delete the corresponding record from the database;

[0090] The work order processing module also includes:

[0091] For firewall policies in the database that have the same source IP and port but different destination IPs, retrieve the corresponding policy name from the database and reply, then issue a command to add the destination IP to the policy.

[0092] Furthermore, the strategy convergence module also includes:

[0093] A strategy to filter out several ports and destination IPs that are the same but have different source IPs;

[0094] The selected strategies are aggregated and deduplicated based on the source IP;

[0095] Generate port configuration information and apply it to the first selected policy;

[0096] Configure deletion policies for the selected duplicate policies, specifically including:

[0097] Perform an undo operation to delete the corresponding firewall configuration information;

[0098] Delete the corresponding record from the database;

[0099] The work order processing module also includes:

[0100] For firewall policies in the database that have the same port and destination IP but different source IP, retrieve the corresponding policy name from the database and reply, then issue a command to add a policy with the source IP.

[0101] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0102] Converge firewall policies to reduce firewall load and ensure stable operation of business systems. Attached Figure Description

[0103] Figure 1 This is a flowchart illustrating the method for implementing the present invention. Detailed Implementation

[0104] The accompanying drawings are for illustrative purposes only and should not be construed as limiting the invention. To better illustrate the following embodiments, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions; it is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0105] Example 1

[0106] like Figure 1 As shown, this embodiment provides a method for converging and intelligently distributing firewall policies, which converges firewall policies, reduces firewall load, and ensures stable operation of the business system, including:

[0107] S1. Obtain firewall policy work order, the work order including source information, unit information, operation and maintenance information, firewall policy, policy name, source IP, destination IP, protocol and port;

[0108] S2. Parse the work order and store it in the strategy database;

[0109] S3. Perform policy convergence on the policy database, specifically including:

[0110] Aggregate and group the source IP, destination IP, and port;

[0111] Filter out policies that have the same source IP, destination IP, and port, and output the corresponding policy name;

[0112] Configure a deletion policy for policies with duplicate policy names, specifically including:

[0113] Perform an undo operation to delete the corresponding firewall configuration information;

[0114] Delete the corresponding record from the database;

[0115] S4. Reply to the work order, specifically including:

[0116] For firewall policies in the database that share any two or more of the same source IP, destination IP, and port, retrieve the corresponding policy name from the database and reply; otherwise, enable the policy and reply. The database stores, but is not limited to, address information, policy information, and user information.

[0117] When a firewall policy ticket is obtained that has two or more identical source IPs, destination IPs, and ports, the private network pri_ip and virtual IP (vip) have the following correspondence according to the firewall configuration resolution:

[0118] 19.15.0.77>172.16.12.107

[0119] 19.15.63.80>172.16.13.23

[0120] 19.15.63.75>172.16.122.122

[0121] rule name CRQ202208030000811000081

[0122] description CRQ202208030000811

[0123] source-zone trust

[0124] destination-zone untrust

[0125] source-address 172.16.12.107mask 255.255.255.255

[0126] source-address 172.16.13.23mask 255.255.255.255

[0127] source-address 172.16.122.122mask 255.255.255.255

[0128] destination-address 19.32.5.67mask 255.255.255.255

[0129] service icmp

[0130] service protocol tcp source-port 0to 65535destination-port 8088

[0131] action permit

[0132] rule name CRQ202207260000903000090

[0133] description CRQ202207260000903

[0134] source-zone trust

[0135] destination-zone untrust

[0136] source-address 172.16.12.107mask 255.255.255.255

[0137] source-address 172.16.13.23mask 255.255.255.255

[0138] source-address 172.16.122.122mask 255.255.255.255

[0139] destination-address 19.32.5.67mask 255.255.255.255

[0140] service icmp

[0141] service protocol tcp source-port 0to 65535destination-port 8088

[0142] action permit

[0143] If the source IP, destination IP, and port information of the configuration sent to the firewall are the same for any two or more of them, it will cause resource waste and lead to policy bloat. In the long run, this will result in excessive firewall load and poor performance. Therefore, it is necessary to converge this type of firewall policy and intelligently judge and send new policies in the future. First, based on the network policy five-tuple information and the necessary elements of the work order, the policy name, source IP, destination IP, protocol, port, and other information need to be parsed and stored in the database. The policy database can store information including policy name, address, and port, among which the policy name information is unique, such as rulename CRQ202207260000903000090 (the policy name field parsed into the database is CRQ202207260000903000090).

[0144] Address information includes single IP addresses and IP ranges. Single IP addresses are configured in policies such as source-address 172.16.12.107mask255.255.255.255 (the source IP field in the database is 172.16.12.107) or destination-address 19.32.5.67mask255.255.255.255 (the destination IP field in the database is 19.32.5.67). An IP address can be formatted in different ways, either by number of bits ( / ) or by range (-), such as destination-address range 19.15.28.16 19.15.28.28 (resolving the source IP field in the database to be 19.15.28.16-19.15.28.28) or source-address 19.16.232.0 mask 255.255.255.0 (resolving the source IP field in the database to be 19.16.232.0 / 24).

[0145] Port information can be categorized as a single port or a range of ports. A single-port policy configuration is like `service protocol tcp source-port 0 to 65535 destination-port 8088` (which resolves the database ingress port field to 8088). A range of IP addresses can be divided into multiple ports or a range of ports, such as the multi-port `service protocol tcp source-port 0 to 65535 destination-port 80 4438` (which resolves the database ingress port field to 80 4438), or the multi-port `service protocol tcp source-port 0 to 65535 destination-port 8081 to 8082` (which resolves the database ingress port field to 8081 to 8082).

[0146] Based on the information entered into the database, policy convergence and intelligent judgment and distribution for subsequent new policies are required. For existing policies with the same source IP, destination IP, and port, and for duplicate policies, an undo rule name operation is performed, and the database connection record is deleted. Based on the database information, source IP, destination IP, and port are aggregated and grouped to filter out policies with the same source IP, destination IP, and port, output duplicate policy names, generate configuration information, and for the configuration policies with duplicate policy names, an undo deletion operation is performed to delete the firewall configuration information and delete the corresponding database records with the same source IP, destination IP, and port. The specific operations are as follows:

[0147] rule name CRQ202208030000811000081

[0148] description CRQ202208030000811

[0149] source-zone trust

[0150] destination-zone untrust

[0151] source-address 172.16.12.107mask 255.255.255.255

[0152] source-address 172.16.13.23mask 255.255.255.255

[0153] source-address 172.16.122.122mask 255.255.255.255

[0154] destination-address 19.32.5.67mask 255.255.255.255

[0155] service icmp

[0156] service protocol tcp source-port 0to 65535destination-port 8088

[0157] action permit

[0158] undo rule name CRQ202207260000903000090

[0159] For policies identified as having the same source IP, destination IP, and port, retrieve the existing policy name and directly reply to the work order. For new work orders from the work order management platform, extract the source IP, destination IP, and port, then perform a check. If a policy with the same source IP, destination IP, and port already exists in the database, activation is unnecessary. The specific operation is as follows: rule name CRQ202111020000601000060

[0160] description CRQ202111020000601

[0161] source-zone untrust

[0162] destination-zone trust

[0163] source-address 19.88.231.95mask 255.255.255.255

[0164] destination-address 172.16.12.235mask 255.255.255.255

[0165] service icmp

[0166] service protocol tcp source-port 0to 65535destination-port 8081

[0167] service protocol tcp source-port 0to 65535destination-port 8088

[0168] action permit

[0169] undo rule name CRQ202201060001064000106

[0170] Preferably, S3, policy convergence of the policy database further includes:

[0171] The strategy for filtering out several sources and destination IPs with the same source IP but different ports is as follows: rule name CRQ202110180001291000129

[0172] description CRQ202110180001291

[0173] source-zone untrust

[0174] destination-zone trust

[0175] source-address 19.15.69.85mask 255.255.255.255

[0176] destination-address 172.16.13.104mask 255.255.255.255

[0177] destination-address 172.16.13.123mask 255.255.255.255

[0178] destination-address 172.16.13.155mask 255.255.255.255

[0179] service icmp

[0180] service protocol tcp source-port 0to 65535destination-port 80 4438080action permit

[0181] rule name CRQ202110180001295000129

[0182] description CRQ202110180001295

[0183] source-zone untrust

[0184] destination-zone trust

[0185] source-address 19.15.69.85mask 255.255.255.255

[0186] destination-address 172.16.13.107mask 255.255.255.255

[0187] destination-address 172.16.13.220mask 255.255.255.255

[0188] destination-address 172.16.13.236mask 255.255.255.255

[0189] service icmp

[0190] service protocol tcp source-port 0to 65535destination-port 80 4438080

[0191] action permit

[0192] The selected strategies are aggregated and deduplicated based on the port number.

[0193] Generate port configuration information and apply it to the first selected policy;

[0194] Configure deletion policies for the selected duplicate policies, specifically including:

[0195] Perform an undo operation to delete the corresponding firewall configuration information;

[0196] To delete the corresponding record in the database, follow these steps:

[0197] rule name CRQ202110180001291000129

[0198] description CRQ202110180001291

[0199] source-zone untrust

[0200] destination-zone trust

[0201] source-address 19.15.69.85mask 255.255.255.255

[0202] destination-address 172.16.13.104mask 255.255.255.255

[0203] destination-address 172.16.13.123mask 255.255.255.255

[0204] destination-address 172.16.13.155mask 255.255.255.255

[0205] destination-address 172.16.13.107mask 255.255.255.255

[0206] destination-address 172.16.13.220mask 255.255.255.255

[0207] destination-address 172.16.13.236mask 255.255.255.255

[0208] service icmp

[0209] service protocol tcp source-port 0to 65535destination-port 80 4438080

[0210] action permit

[0211] undo rule name CRQ202110180001295000129

[0212] S4, replying to the work order, also includes:

[0213] For firewall policies in the database that have the same source IP and destination IP but different ports, retrieve the corresponding policy name from the database and reply, then issue a command to add the port policy.

[0214] Assuming the above policy already exists, a new work order is requested to add access from source IP 19.15.69.85 to destination IP 172.16.13.107 via port 804438080. A database query reveals the policy CRQ202110180001291000129, which uses the source IP...

[0215] If port 80, 443, and 8080 are opened on 19.15.69.85, then you need to enter CRQ202110180001291000129 and execute the following policy command:

[0216] rule name CRQ202110180001291000129

[0217] destination-address 172.16.13.107mask 255.255.255.255

[0218] For existing policies where the source IP and destination IP are the same but the ports are different, all ports are aggregated, all ports are opened on one policy, and the undo rule name operation is performed on other policies, and the database connection records are deleted.

[0219] Based on the database information, policies with the same source IP and destination IP are aggregated and grouped. Policies with the same source IP and destination IP but different ports are filtered out, and the ports of these policies are aggregated and deduplicated. Port configuration information is generated and applied to the first policy. Then, for policies with duplicate policy names, an undo operation is performed to delete the firewall configuration information and the corresponding database records with the same source IP and destination IP but different ports are deleted.

[0220] Preferably, S3, policy convergence of the policy database further includes:

[0221] To filter out several sources with the same source IP and port but different destination IPs, the following steps are performed:

[0222] rule name CRQ202110180001291000129

[0223] description CRQ202110180001291

[0224] source-zone untrust

[0225] destination-zone trust

[0226] source-address 19.15.69.85mask 255.255.255.255

[0227] destination-address 172.16.13.104mask 255.255.255.255

[0228] destination-address 172.16.13.123mask 255.255.255.255

[0229] destination-address 172.16.13.155mask 255.255.255.255

[0230] service icmp

[0231] service protocol tcp source-port 0to 65535destination-port 80 4438080

[0232] action permit

[0233] rule name CRQ202110180001295000129

[0234] description CRQ202110180001295

[0235] source-zone untrust

[0236] destination-zone trust

[0237] source-address 19.15.69.85mask 255.255.255.255

[0238] destination-address 172.16.13.107mask 255.255.255.255

[0239] destination-address 172.16.13.220mask 255.255.255.255

[0240] destination-address 172.16.13.236mask 255.255.255.255

[0241] service icmp

[0242] service protocol tcp source-port 0to 65535destination-port 80 4438080

[0243] action permit

[0244] The selected strategies are aggregated and deduplicated based on the target IP;

[0245] Generate the configuration information for the destination IP and apply it to the first filtering policy;

[0246] Configure a deletion policy for the duplicate filtering strategy, specifically including:

[0247] Perform an undo operation to delete the corresponding firewall configuration information;

[0248] Delete the corresponding record from the database;

[0249] S4, replying to the work order, also includes:

[0250] For firewall policies in the database that have the same source IP and port but different destination IPs, retrieve the corresponding policy name from the database and reply, then issue a command to add the destination IP to the policy.

[0251] For existing policies with the same source IP and port but different destination IPs, aggregate all destination IPs, enable all destination IPs on one policy, and perform an undo rule name operation on other policies, and delete the database connection records.

[0252] Based on the database information, policies with the same source IP and port but different destination IPs are aggregated and grouped. Policies with the same source IP and port but different destination IPs are filtered out, and the destination IPs of these policies are aggregated and deduplicated to generate destination IP configuration information, which is then applied to the first policy. Then, for policies with duplicate policy names, an undo operation is performed to delete the firewall configuration information and the corresponding database records with the same source IP and port but different destination IPs are deleted.

[0253] For policies that are determined to have the same source IP and port but different destination IP, obtain the existing policy name and issue a command to add a policy with a different destination IP.

[0254] Destination IPs are aggregated into an ip_list. Since IPs can be single IPs, bit-based ranges ip_list_bit(xxx.xxx.xxx.xxx / xx), and hyphenated ranges ip_list_range(xxx.xxx.xxx.xxx-xxx.xxx.xxx.xxx), format processing and deduplication are required.

[0255] 1. Based on the IP format, filter out the bit-format IP range ip_list_bit from ip_list, filter out the -x format IP range ip_list_range from ip_list, and delete ip_list_bit and ip_list_range from ip_list.

[0256] 2. Then, deduplicate ip_list_bit. Check each IP address in ip_list to see if it falls within the range of ip_list_bit; if so, remove it from ip_list to remove duplicates.

[0257] 3. Then, deduplicatize ip_list_range. ip_list_range is separated by '-'. IPs to the left and right of the '-' are converted into integers IntStartIP and IntlastIP. Integers within the range of IntStartIP and IntlastIP are then converted into IP address format and collected in the address pool list ipPool. Then, it is checked whether each IP in ip_list belongs to the ipPool address pool. If it does, it is removed from ip_list to remove duplicates.

[0258] 4. After deduplicating ip_list_bit and ip_list_range from ip_list, ip_list will no longer contain addresses accessed by ip_list_bit and ip_list_range. Then, ip_list_bit and ip_list_range are appended to ip_list, thus completing the aggregation and deduplication of destination IPs.

[0259] Convergence results:

[0260] rule name CRQ202110180001291000129

[0261] description CRQ202110180001291

[0262] source-zone untrust

[0263] destination-zone trust

[0264] source-address 19.15.69.85mask 255.255.255.255

[0265] destination-address 172.16.13.104mask 255.255.255.255

[0266] destination-address 172.16.13.123mask 255.255.255.255

[0267] destination-address 172.16.13.155mask 255.255.255.255

[0268] destination-address 172.16.13.107mask 255.255.255.255

[0269] destination-address 172.16.13.220mask 255.255.255.255

[0270] destination-address 172.16.13.236mask 255.255.255.255

[0271] service icmp

[0272] service protocol tcp source-port 0to 65535destination-port 80 4438080

[0273] action permit

[0274] undo rule name CRQ202110180001295000129

[0275] When a new policy is opened and a new work order is received, if it is determined that there is an existing policy with the same source IP and port but a different destination IP, the existing policy name is obtained and a command to add a policy with a destination IP is issued.

[0276] Assuming the above policy already exists, a new work order is requested to add access from source IP 19.15.69.85 to destination IP 172.16.13.107 via port 804438080. A database query reveals the policy CRQ202110180001291000129, which uses the source IP...

[0277] If port 80, 443, and 8080 are opened on 19.15.69.85, then you need to enter CRQ202110180001291000129 and execute the following policy command:

[0278] rule name CRQ202110180001291000129

[0279] destination-address 172.16.13.107mask 255.255.255.255

[0280] Preferably, S3, policy convergence of the policy database further includes:

[0281] A strategy to filter out several ports and destination IPs that are the same but have different source IPs: rule name CRQ202210180001291000129

[0282] description CRQ202210180001291

[0283] source-zone trust

[0284] destination-zone untrust

[0285] source-address 172.16.13.104mask 255.255.255.255

[0286] source-address 172.16.13.123mask 255.255.255.255

[0287] source-address 172.16.13.155mask 255.255.255.255

[0288] destination-address 19.96.245.25mask 255.255.255.255

[0289] service icmp

[0290] service protocol tcp source-port 0to 65535destination-port 8087actionpermit

[0291] rule name CRQ202112200000504000050

[0292] description CRQ202112200000504

[0293] source-zone trust

[0294] destination-zone untrust

[0295] source-address 172.16.13.107mask 255.255.255.255

[0296] source-address 172.16.13.220mask 255.255.255.255

[0297] source-address 172.16.13.236mask 255.255.255.255

[0298] destination-address 19.96.245.25mask 255.255.255.255

[0299] service icmp

[0300] service protocol tcp source-port 0to 65535destination-port 8087actionpermit

[0301] The selected strategies are aggregated and deduplicated based on the source IP;

[0302] Generate port configuration information and apply it to the first selected policy;

[0303] Configure deletion policies for the selected duplicate policies, specifically including:

[0304] Perform an undo operation to delete the corresponding firewall configuration information;

[0305] Delete the corresponding record from the database;

[0306] The source IPs are aggregated into an ip_list. Since IPs can be single IPs, bit-based ranges (ip_list_bit(xxx.xxx.xxx.xxx / xx)), and hyphenated ranges (ip_list_range(xxx.xxx.xxx.xxx-xxx.xxx.xxx.xxx)), format processing and deduplication are required. Specifically, this includes:

[0307] 1. Based on the IP format, filter out the bit-format IP range ip_list_bit from ip_list, filter out the -x format IP range ip_list_range from ip_list, and delete ip_list_bit and ip_list_range from ip_list.

[0308] 2. Then, deduplicate ip_list_bit. Check each IP address in ip_list to see if it falls within the range of ip_list_bit; if so, remove it from ip_list to remove duplicates.

[0309] 3. Then, deduplicatize ip_list_range. ip_list_range is separated by '-'. IPs to the left and right of the '-' are converted into integers IntStartIP and IntlastIP. Integers within the range of IntStartIP and IntlastIP are then converted into IP address format and collected in the address pool list ipPool. Then, it is checked whether each IP in ip_list belongs to the ipPool address pool. If it does, it is removed from ip_list to remove duplicates.

[0310] 4. After deduplicating ip_list_bit and ip_list_range from ip_list, ip_list will no longer contain addresses accessed by ip_list_bit and ip_list_range. Then, ip_list_bit and ip_list_range are appended to ip_list, thus completing the aggregation and deduplication of destination IPs.

[0311] Convergence results:

[0312] rule name CRQ202210180001291000129

[0313] description CRQ202210180001291

[0314] source-zone trust

[0315] destination-zone untrust

[0316] source-address 172.16.13.107mask 255.255.255.255

[0317] source-address 172.16.13.220mask 255.255.255.255

[0318] source-address 172.16.13.236mask 255.255.255.255

[0319] source-address 172.16.13.104mask 255.255.255.255

[0320] source-address 172.16.13.123mask 255.255.255.255

[0321] source-address 172.16.13.155mask 255.255.255.255

[0322] destination-address 19.96.245.25mask 255.255.255.255

[0323] service icmp

[0324] service protocol tcp source-port 0to 65535destination-port 8087

[0325] action permit

[0326] undo rule name CRQ202112200000504000050

[0327] When a new policy is opened and a new work order is received, if it is determined that there is an existing policy with the same destination IP and port but a different source IP, the existing policy name is obtained and a command to add a policy with the source IP is issued.

[0328] If the strategy described above already exists, and a new work order has been received, you need to add the source IP 172.16.13.107 to access the destination IP.

[0329] Port 8087 on IP address 19.96.245.25. A database query revealed a policy CRQ202210180001291000129 with port 8087 open for destination IP address 19.15.69.85. Therefore, it is necessary to access CRQ202210180001291000129 and execute the following policy command:

[0330] The rule name CRQ202210180001291000129 enters the rule name where the source and destination IPs are the same.

[0331] The command `source-address 172.16.13.107mask 255.255.255.255` adds a new source IP address, 172.16.13.107.

[0332] Based on an existing firewall configuration with 10,729 policies, 1,163 policies match (source IP, destination IP, port), which can be deduplicated to 533. 2,268 policies match (source IP and destination IP, but different ports), which can be deduplicated to 974. 4,073 policies match (source IP and port, but different destination IP), which can be deduplicated to 1,230. 6,546 policies match (destination IP and port, but different source IP), which can be deduplicated to 1,192. Based on actual application needs, the number of policies can be reduced by more than half, reducing firewall load, ensuring stable business operation, and improving service perception.

[0333] Example 2

[0334] Based on the same inventive concept as the firewall policy convergence and intelligent distribution method of the present invention, this embodiment also provides a firewall policy convergence and intelligent distribution system, including:

[0335] The work order acquisition module is used to acquire firewall policy work orders. The work order includes source information, organization information, operation and maintenance information, firewall policy, policy name, source IP, destination IP, protocol and port.

[0336] The parsing module is used to parse the work order and store it in the strategy database;

[0337] The policy convergence module is used to converge policies in the policy database, including:

[0338] Aggregate and group the source IP, destination IP, and port;

[0339] Filter out policies that have the same source IP, destination IP, and port, and output the corresponding policy name;

[0340] Configure a deletion policy for policies with duplicate policy names, specifically including:

[0341] Perform an undo operation to delete the corresponding firewall configuration information;

[0342] Delete the corresponding record from the database;

[0343] The work order processing module is used to respond to work orders, including:

[0344] For firewall policies that have the same source IP, destination IP, or port in the database, retrieve the corresponding policy name from the database and reply; otherwise, enable the policy and reply.

[0345] Preferably, the strategy convergence module further includes:

[0346] A strategy to filter out several sources with the same source IP and destination IP but different ports;

[0347] The selected strategies are aggregated and deduplicated based on the port number.

[0348] Generate port configuration information and apply it to the first selected policy;

[0349] Configure deletion policies for the selected duplicate policies, specifically including:

[0350] Perform an undo operation to delete the corresponding firewall configuration information;

[0351] Delete the corresponding record from the database;

[0352] The work order processing module also includes:

[0353] For firewall policies in the database that have the same source IP and destination IP but different ports, retrieve the corresponding policy name from the database and reply, then issue a command to add the port policy.

[0354] Preferably, the strategy convergence module further includes:

[0355] A strategy to filter out several sources with the same source IP and port but different destination IPs;

[0356] The selected strategies are aggregated and deduplicated based on the target IP;

[0357] Generate the configuration information for the destination IP and apply it to the first filtering policy;

[0358] Configure a deletion policy for the duplicate filtering strategy, specifically including:

[0359] Perform an undo operation to delete the corresponding firewall configuration information;

[0360] Delete the corresponding record from the database;

[0361] The work order processing module also includes:

[0362] For firewall policies in the database that have the same source IP and port but different destination IPs, retrieve the corresponding policy name from the database and reply, then issue a command to add the destination IP to the policy.

[0363] Preferably, the strategy convergence module further includes:

[0364] A strategy to filter out several ports and destination IPs that are the same but have different source IPs;

[0365] The selected strategies are aggregated and deduplicated based on the source IP;

[0366] Generate port configuration information and apply it to the first selected policy;

[0367] Configure deletion policies for the selected duplicate policies, specifically including:

[0368] Perform an undo operation to delete the corresponding firewall configuration information;

[0369] Delete the corresponding record from the database;

[0370] The work order processing module also includes:

[0371] For firewall policies in the database that have the same port and destination IP but different source IP, retrieve the corresponding policy name from the database and reply, then issue a command to add a policy with the source IP.

[0372] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solution of the present invention, and are not intended to limit the specific implementation of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A method for converging and intelligently distributing firewall policies, characterized in that, include: S1. Obtain firewall policy work order, the work order including source information, unit information, operation and maintenance information, firewall policy, policy name, source IP, destination IP, protocol and port; S2. Parse the work order and store it in the strategy database; S3. Perform policy convergence on the policy database, specifically including: Aggregate and group the source IP, destination IP, and port; Filter out policies that have the same source IP, destination IP, and port, and output the corresponding policy name; Configure a deletion policy for policies with duplicate policy names, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; S4. Reply to the work order, specifically including: For firewall policies that have the same source IP, destination IP, or port in the database, retrieve the corresponding policy name from the database and reply; otherwise, enable the policy and reply.

2. The method for converging and intelligently distributing firewall policies according to claim 1, characterized in that, S3. Policy convergence of the policy database also includes: A strategy to filter out several sources with the same source IP and destination IP but different ports; The selected strategies are aggregated and deduplicated based on the port number. Generate port configuration information and apply it to the first selected policy; Configure deletion policies for the selected duplicate policies, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; S4, replying to the work order, also includes: For firewall policies in the database that have the same source IP and destination IP but different ports, retrieve the corresponding policy name from the database and reply, then issue a command to add the port policy.

3. The method for converging and intelligently distributing firewall policies according to claim 1, characterized in that, S3. Policy convergence of the policy database also includes: A strategy to filter out several sources with the same source IP and port but different destination IPs; The selected strategies are aggregated and deduplicated based on the target IP; Generate the configuration information for the destination IP and apply it to the first filtering policy; Configure a deletion policy for the duplicate filtering strategy, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; S4, replying to the work order, also includes: For firewall policies in the database that have the same source IP and port but different destination IPs, retrieve the corresponding policy name from the database and reply, then issue a command to add the destination IP to the policy.

4. The method for converging and intelligently distributing firewall policies according to claim 1, characterized in that, S3. Policy convergence of the policy database also includes: A strategy to filter out several ports and destination IPs that are the same but have different source IPs; The selected strategies are aggregated and deduplicated based on the source IP; Generate port configuration information and apply it to the first selected policy; Configure deletion policies for the selected duplicate policies, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; S4, replying to the work order, also includes: For firewall policies in the database that have the same port and destination IP but different source IP, retrieve the corresponding policy name from the database and reply, then issue a command to add a policy with the source IP.

5. The method for converging and intelligently distributing firewall policies according to claim 3 or claim 4, characterized in that, The aggregation and deduplication process specifically includes: Compile the destination IPs or source IPs into a list; Filter the list to find IP ranges in bit format and range format, and then delete them from the list; Determine whether an IP in the list belongs to the IP segment in the bit format; if so, remove it from the list. Determine whether an IP in the list belongs to the IP range specified in the range format; if so, remove it from the list. Add the bit-form IP segment and the range-form IP segment to the list; The range-form IP segment consists of two IP addresses connected by a "-" symbol.

6. The method for converging and intelligently distributing firewall policies according to claim 5, characterized in that, The determination of whether an IP in the list belongs to the IP range specified in the definition includes: Convert the IP addresses on both sides of the "-" sign to integer values ​​to get the number of IP addresses in that range; Collect all IP addresses in that range into an address pool list; Based on the stated quantity, iterate through the list to determine if all IP ranges in the list are the same as the IP addresses in the address pool list. If so, remove them from the list.

7. A firewall policy convergence and intelligent distribution system, characterized in that, include: The work order acquisition module is used to acquire firewall policy work orders. The work order includes source information, organization information, operation and maintenance information, firewall policy, policy name, source IP, destination IP, protocol and port. The parsing module is used to parse the work order and store it in the strategy database; The policy convergence module is used to converge policies in the policy database, including: Aggregate and group the source IP, destination IP, and port; Filter out policies that have the same source IP, destination IP, and port, and output the corresponding policy name; Configure a deletion policy for policies with duplicate policy names, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; The work order processing module is used to respond to work orders, including: For firewall policies that have the same source IP, destination IP, or port in the database, retrieve the corresponding policy name from the database and reply; otherwise, enable the policy and reply.

8. The firewall policy convergence and intelligent distribution system according to claim 7, characterized in that, The strategy convergence module also includes: A strategy to filter out several sources with the same source IP and destination IP but different ports; The selected strategies are aggregated and deduplicated based on the port number. Generate port configuration information and apply it to the first selected policy; Configure deletion policies for the selected duplicate policies, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; The work order processing module also includes: For firewall policies in the database that have the same source IP and destination IP but different ports, retrieve the corresponding policy name from the database and reply, then issue a command to add the port policy.

9. The firewall policy convergence and intelligent distribution system according to claim 7, characterized in that, The strategy convergence module also includes: A strategy to filter out several sources with the same source IP and port but different destination IPs; The selected strategies are aggregated and deduplicated based on the target IP; Generate the configuration information for the destination IP and apply it to the first filtering policy; Configure a deletion policy for the duplicate filtering strategy, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; The work order processing module also includes: For firewall policies in the database that have the same source IP and port but different destination IPs, retrieve the corresponding policy name from the database and reply, then issue a command to add the destination IP to the policy.

10. The firewall policy convergence and intelligent distribution system according to claim 7, characterized in that, The strategy convergence module also includes: A strategy to filter out several ports and destination IPs that are the same but have different source IPs; The selected strategies are aggregated and deduplicated based on the source IP; Generate port configuration information and apply it to the first selected policy; Configure deletion policies for the selected duplicate policies, specifically including: Perform an undo operation to delete the corresponding firewall configuration information; Delete the corresponding record from the database; The work order processing module also includes: For firewall policies in the database that have the same port and destination IP but different source IP, retrieve the corresponding policy name from the database and reply, then issue a command to add a policy with the source IP.

Images