A method and apparatus for firewall configuration

Abstract

The present specification relates to the field of information technology, in particular to a firewall configuration method and device. The method comprises: obtaining a configuration data table and a configuration data information table of security policy information by identifying and reading original firewall configuration; associating the configuration data table with the security policy information to obtain complete security policy information; writing data of the configuration data table into a configuration format template to generate target firewall configuration; then writing security policy data into the target firewall configuration to generate a target firewall configuration file, and completing configuration of a new firewall. Through the embodiment of the present specification, the mode of replacing the firewall by manual replacement is realized, the efficiency and accuracy of configuration conversion are improved, and the operation efficiency of the device is improved by reducing configuration entries through merging.

Description

Technical Field

[0001] This specification relates to the field of information technology, and in particular to a method and apparatus for configuring a firewall. Background Technology

[0002] With the continuous development of internet technology, internet security issues have become increasingly prominent. Firewalls, by filtering external requests, serve as a protective barrier between the public and private networks, ensuring the security of internet operations. In practical applications, firewalls need to be updated according to different needs, resulting in a new firewall after the update.

[0003] However, configuration conversion is a challenging aspect when replacing equipment between different brands. Currently, there are two main methods for configuration conversion: one is for professional operations and maintenance personnel to manually convert, optimize, and merge configurations, but this is inefficient and lacks accuracy; the other is to use configuration conversion tools for automated configuration conversion, which improves efficiency and accuracy to some extent, but these tools convert each item one-to-one based on the original configuration and do not have the function of merging security policies with the same characteristics. Different brands of firewalls have different configuration methods and configuration item capacities. When the configuration volume is large, converting each item one-to-one can easily exceed the configuration capacity of the replacement device, causing the configuration to fail to load. In this case, manual intervention is required to merge and reduce the configuration in order to complete the equipment update and replacement. Summary of the Invention

[0004] To address the problems of low efficiency, error-proneness, and the inability to load configurations due to manual configuration conversion and optimization merging or one-to-one configuration conversion in existing technologies, this specification provides a firewall configuration method and apparatus. This method utilizes computer programs to implement the logic of each step in the conversion and merging process, reducing reliance on the experience and skills of maintenance personnel, effectively avoiding the risk of device configuration capacity limitations, reducing the complexity of firewall configuration conversion, and improving resource reuse efficiency.

[0005] To solve the above-mentioned technical problems, the specific technical solution in this specification is as follows:

[0006] On the one hand, the embodiments of this specification provide a firewall configuration method, including,

[0007] Read the original firewall configuration file, convert the format of the custom data in it, and obtain multiple configuration data tables and security policy information;

[0008] By associating the multiple configuration data tables with security policy information, complete security policy information is obtained;

[0009] The complete security policy information is merged to obtain a security policy information data table;

[0010] Write the data from the multiple configuration data tables into a configuration format template to generate the target firewall configuration;

[0011] The data from the security policy information data table is written into the target firewall configuration to generate the target firewall configuration file.

[0012] Furthermore, the original firewall configuration file further includes,

[0013] IP address object configuration, service port object configuration, routing configuration, address translation configuration, and security policy information.

[0014] Furthermore, the original firewall configuration file is exported, converted to a common format, and multiple configuration data tables are obtained, including...

[0015] Read the IP address object configuration, use regular expressions to match the object name and contained IP address information of each address object configuration, obtain the IP address object information, and generate an IP address configuration data table;

[0016] Read the service port object configuration, use regular expressions to match the object name and the included protocol, port, and timeout information of each service port object configuration to obtain the service port information and generate a service port configuration data table;

[0017] Read the routing configuration, use regular expressions to match the virtual router name, destination network segment and subnet mask, outgoing interface, next-hop IP address, priority and description fields of each route to obtain routing information and generate a routing configuration data table;

[0018] The address translation configuration is read, and regular expressions are used to match the configuration field information of each address translation to obtain the address translation information and generate an address configuration data table.

[0019] Furthermore, the multiple configuration data tables are associated with security policy information to obtain complete security policy information, which further includes:

[0020] Associate the timing of security policy calls to different configuration files with that security policy;

[0021] Associate the multiple configuration data tables involved in the security policy with the security policy;

[0022] The complete security policy information is generated based on the relationships between multiple configuration data tables recorded in the security policy.

[0023] Furthermore, the complete security policy information is merged to obtain a security policy information data table, which further includes:

[0024] The entries of the complete security policy information are divided into blocks according to policy actions, and all policies in each block have the same policy actions.

[0025] Feature extraction is performed based on the merging method to obtain the merged feature table;

[0026] Based on the complete security policy information after segmentation and the merged feature table, security policies are merged to generate a security policy information data table.

[0027] Furthermore, the merged feature table further includes,

[0028] Merge feature tables that merge entries with different destination addresses, merge feature tables that merge entries with different source addresses, and merge feature tables that merge entries with different service ports.

[0029] Furthermore, the specific steps of the feature extraction further include,

[0030] Extract the feature table that merges entries with different destination addresses, traverse all entries of the complete security policy information, delete the destination address field of each entry, and determine whether the complete security policy information entry exists in the merged feature table after deleting the destination address. If it does not exist, write it into the merged feature table; if it exists, do not write it. Continue until all entries are processed to obtain the merged feature table that merges entries with different destination addresses.

[0031] Extract the feature table by merging entries with different source addresses, traverse all entries of the complete security policy information, and delete the source address field of each entry;

[0032] Determine whether the complete security policy information entry after deleting the source address already exists in the merge feature table. If it does not exist, write it into the merge feature table; if it exists, do not write it. Continue this process until all entries are processed to obtain the merge feature table that merges entries with different source addresses.

[0033] Extract the feature table by merging entries with different service ports, traverse all entries of the complete security policy information, and delete the service port field of each entry;

[0034] After deleting the service port, determine whether the complete security policy information entry already exists in the merged feature table. If it does not exist, write it into the merged feature table; if it exists, do not write it. Continue this process until all entries have been processed to obtain the merged feature table that merges the entries with different service ports.

[0035] Furthermore, the step of merging security policies based on the segmented complete security policy information and the merged feature table to generate a security policy information data table further includes:

[0036] All security policy information table entries that match the same entry in the merged feature table are merged to generate a single entry in the security policy information data table.

[0037] After all entries in the merged feature table are matched, the final security policy information data table is obtained.

[0038] Furthermore, the configuration format template is a blank configuration format template exported by the target firewall.

[0039] Furthermore, the step of writing the data from the security policy information data table into the target firewall configuration further includes,

[0040] The target firewall configuration includes: target firewall address object configuration, target service port object configuration, target firewall routing configuration, and target firewall address translation configuration.

[0041] Further, the multiple configuration data tables are imported into the firewall configuration generation module to generate the target firewall configuration, which further includes...

[0042] Write the data from the IP address configuration data table and the service port configuration data table into the configuration format template to generate the target firewall address object configuration and the target service port object configuration.

[0043] Write the data from the routing configuration data table into the configuration format template to generate the target firewall routing configuration;

[0044] The data from the address configuration data table is written into the configuration format template according to the packet processing logic to generate the target firewall address translation configuration.

[0045] On the other hand, embodiments of this specification also provide a firewall configuration apparatus, including,

[0046] The original configuration identification unit is used to read the original firewall configuration file, convert the format of the custom data in it, and obtain multiple configuration data tables and security policy information.

[0047] The logical association unit is used to associate the multiple configuration data tables with security policy information to obtain complete security policy information;

[0048] The policy merging unit is used to merge the complete security policy information to obtain a security policy information data table.

[0049] The target configuration generation unit is used to export the configuration format template of the target firewall, write the data of the multiple configuration data tables into the configuration format template, and generate the target firewall configuration.

[0050] The target file generation unit is used to import the data from the security policy information data table into the target firewall configuration and generate the target firewall configuration file.

[0051] On the other hand, embodiments of this specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the above-described method.

[0052] Finally, this specification also provides a computer storage medium storing a computer program, which, when run by the processor of a computer device, executes the above-described method.

[0053] The embodiments in this specification achieve automated configuration conversion and merging of firewalls. By exporting the original firewall configuration file, all configurations of the original firewall are preserved, avoiding related problems caused by configuration differences during the setup of the new firewall. Furthermore, to avoid the risk of device configuration capacity limitations, data information is correlated and configuration entries are merged, reducing the number of configuration entries that need to be entered into the new firewall, lowering operational complexity, and avoiding the risk of device configuration capacity limitations. Simultaneously, a corresponding device is formed based on the configuration conversion steps, which can be reused, improving resource reuse efficiency. This solves the problems of existing manual conversion methods, which rely heavily on the technical skills and experience of maintenance personnel, are prone to errors, result in firewall misconfigurations, cannot be reused as tools, and cause resource waste. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 The diagram shown is a schematic representation of an implementation system for a firewall configuration method according to an embodiment of this specification.

[0056] Figure 2 The diagram shown is a flowchart of a firewall configuration method according to an embodiment of this specification;

[0057] Figure 3 The diagram illustrates the process of exporting the original firewall configuration file, performing general format conversion, and obtaining multiple configuration data tables in an embodiment of this specification.

[0058] Figure 4The diagram illustrates the process by which multiple configuration data tables are associated with security policy information to obtain complete security policy information in an embodiment of this specification.

[0059] Figure 5 The diagram illustrates the process by which complete security policy information is merged to obtain a security policy information data table, as described in this embodiment of the specification.

[0060] Figure 6 The steps for feature extraction in the illustrated text specification example are as follows;

[0061] Figure 7 The diagram shown is a structural schematic of a firewall configuration device according to an embodiment of this specification.

[0062] Figure 8 The diagram shown is a structural schematic of the computer device according to an embodiment of this specification.

[0063] [Explanation of Figure Markers]:

[0064] 1101. Original firewall configuration file;

[0065] 1201. Multiple configuration data tables;

[0066] 1202. Security Policy Information;

[0067] 1301. Target firewall configuration;

[0068] 1302. Security Policy Information Data Sheet;

[0069] 1401. Target firewall configuration file;

[0070] 701. Original configuration identification unit;

[0071] 702. Logical Associative Unit;

[0072] 703. Strategy Merging Unit;

[0073] 704. Target Configuration Generation Unit;

[0074] 705. Target file generation unit;

[0075] 802. Computer equipment;

[0076] 804. Processing equipment;

[0077] 806. Storage resources;

[0078] 808. Drive mechanism;

[0079] 810. Input / Output Module;

[0080] 812. Input devices;

[0081] 814. Output devices;

[0082] 816. Presentation equipment;

[0083] 818. Graphical User Interface;

[0084] 820. Network interface;

[0085] 822. Communication link;

[0086] 824. Communication bus. Detailed Implementation

[0087] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0088] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0089] like Figure 1The diagram illustrates an implementation system for the firewall configuration method described in this specification. It may include an original firewall configuration file 1101, multiple configuration data tables 1201, security policy information 1202, a target firewall configuration 1301, a security policy information data table 1302, and a target firewall configuration file 1401. The original firewall configuration file 1101 includes multiple configuration data tables 1201 and security policy information 1202. These multiple configuration data tables 1201 and security policy information 1202 are associated and merged to obtain a security policy information data table 1302. The target firewall configuration 1301 and the security policy information data table 1302 ultimately generate the required target firewall configuration file 1401. In the prior art, the original firewall configuration file 1101 and the target firewall configuration 1301 can only be converted one-to-one. The number of configuration entries after conversion is not optimized, which can easily lead to the target firewall configuration file 1401 exceeding the target device's configuration capacity limit and failing to be written to the replacement device. This requires manual intervention for configuration adjustments, reducing the efficiency of firewall configuration.

[0090] In the embodiments of this specification, multiple configuration data tables 1201 and security policy information 1202 are associated and merged to obtain a security policy information data table 1302. The security policy information data table 1302 identifies and classifies the policy information in the security policy table according to merging characteristics, and merges identical policies, thereby significantly reducing duplicate policy information entries. Since the merging only occurs within policy blocks, the merging action does not change the current security policy logic, maintaining consistency in policy control scope before and after the merging, only reducing the number of configurations. Then, the merged target firewall configuration 1301 and security policy information data table 1302 are imported into a blank template to generate a target firewall configuration file 1401. Furthermore, during the process of identifying and obtaining multiple configuration data tables 1201 and security policy information 1202 from the original firewall configuration file 1101, the data is also converted to a common data format to ensure that the final generated target firewall configuration file 1401 can be configured for firewalls of different brands, directly completing the conversion, merging, and configuration of the original firewall and the target firewall.

[0091] Furthermore, it should be noted that in practical applications, Figure 1 The application environment shown can be applied to different scenarios such as replacing the firewall with a new one or updating and resetting the firewall system. This manual does not impose any restrictions.

[0092] To address the problems existing in the prior art, this specification provides a firewall configuration method and apparatus. Figure 2The diagram shows a flowchart of a firewall configuration method provided in an embodiment of this specification. The process of merging and transforming firewall configurations is illustrated in the diagram. The order of steps listed in the embodiment is merely one possible execution order among many and does not represent the only possible execution order. In actual system or device products, the methods shown in the embodiment or the accompanying drawings can be executed sequentially or in parallel. Specifically, as shown... Figure 2 As shown, the method may include:

[0093] Step 201: Read the original firewall configuration file, convert the format of the custom data in it, and obtain multiple configuration data tables and security policy information;

[0094] Step 202: Associate the multiple configuration data tables with security policy information to obtain complete security policy information;

[0095] Step 203: Merge the complete security policy information to obtain a security policy information data table;

[0096] Step 204: Write the data from the multiple configuration data tables into the configuration format template to generate the target firewall configuration;

[0097] Step 205: Write the data from the security policy information data table into the target firewall configuration to generate the target firewall configuration file.

[0098] This specification demonstrates an automated configuration conversion and merging process for firewalls. By exporting the original firewall configuration file, all original firewall configurations are preserved, avoiding issues arising from configuration differences during the setup of the new firewall. Furthermore, to mitigate the risk of device configuration capacity limitations, data information is correlated and configuration entries are merged, reducing the number of configuration entries that need to be entered into the new firewall, lowering operational complexity, and avoiding the risk of device configuration capacity limitations. The configuration conversion steps also create a reusable device that improves resource reuse efficiency. This addresses the problems of existing manual conversion methods, which heavily rely on the technical skills and experience of maintenance personnel, are prone to errors, result in incorrect firewall configurations, and cannot be reused as a tool, leading to resource waste.

[0099] In the embodiments described in this specification, the original firewall configuration file is first obtained. Specifically, the configuration identification module retrieves configuration data information for different functional items based on the original firewall's system architecture and configuration format characteristics, exporting the original firewall configuration file. This file primarily includes address object configuration, service port object configuration, routing configuration, address translation configuration, and security policy configuration. Then, because different brands of firewalls have different data processing logic and custom configuration items, they cannot be mutually recognized. Therefore, a conversion tool, the configuration identification module, is needed to match the data information of each configuration item and perform a general format conversion to form a standard data format. Specifically, as shown below... Figure 3 As shown, the method may include:

[0100] Step 301: Read the IP address object configuration, use regular expressions to match the object name and contained IP address information of each address object configuration, obtain the IP address object information, and generate an IP address configuration data table;

[0101] Step 302: Read the service port object configuration, use regular expressions to match the object name and the included protocol, port, and timeout information of each service port object configuration to obtain the service port information and generate a port configuration data table;

[0102] Based on the results of the configuration identification module, the IP addresses, network segments, and custom address objects in the identification results are converted into the standard IP+mask format; the service ports and custom service objects in the identification results are converted into the standard protocol+port format; and the time table objects in the identification results are converted into the standard year-month-day hour-minute-second format.

[0103] Step 303: Read the routing configuration, use regular expressions to match the virtual router name, destination network segment and mask, outgoing interface, next-hop IP address, priority, and description fields of each route to obtain routing information and generate a routing configuration data table;

[0104] Step 304: Read the address translation configuration, use regular expressions to match the configuration field information of each address translation, obtain the address translation information, and generate an address configuration data table.

[0105] In this step, the address configuration data table includes policy ID, policy name, source region (or interface), source IP address, source address translation type, source translation address, destination region (or interface), destination IP address, destination translation type, destination translation address, transport protocol, and destination service port.

[0106] At the same time, the security policy configuration also needs to be transformed to obtain security policy information 1202. The specific steps are as follows: read the original firewall security policy configuration, use regular expressions to match the configuration field information of each policy, including policy ID, policy name, source zone (or interface), source IP address, destination zone (or interface), destination IP address, transport protocol, source service port, destination service port, connection timeout, policy action, policy status, whether the policy is logged, and policy call schedule object, to obtain security policy information 1202.

[0107] According to one embodiment of this specification, the firewall configuration method further includes,

[0108] Obtain complete security policy information;

[0109] The obtained configuration data tables are associated with security policy information, specifically as follows: Figure 4 As shown, the method may include:

[0110] Step 401: Associate the time when the security policy calls different configuration files with the security policy;

[0111] The field information defined under the security policy call object is directly associated with the security policy to build a security policy information data table, and the timeout time of the call through the protocol, the timeout time of the service port object, the effective time of the time schedule object, etc. are associated with the security policy.

[0112] Step 402: Associate the multiple configuration data tables involved in the security policy with the security policy;

[0113] When IP address translation is involved under a security policy, the IP address translation relationship is associated with the security policy; the security domain and interface correspondence of the security policy are also associated.

[0114] Step 403: Generate the complete security policy information based on the relationships between the multiple configuration data tables recorded in the security policy.

[0115] The final security policy information data table mainly includes the following fields: policy ID, policy name, source region (or source interface), source IP address, source address translation type, source address translation address, destination region (or destination interface), destination IP address, destination address translation type, destination address translation address, transport protocol, source service port, destination service port, connection timeout, policy action, policy status, whether the policy is logged, and policy effective time.

[0116] In the embodiments of this specification, the logic of each step in the conversion and merging process is implemented by computer programs, which can reduce the number of configuration entries, effectively avoid the risk of device configuration capacity limitations, and reduce the complexity of operation and maintenance.

[0117] According to one embodiment of this specification, to avoid a large number of configuration entries, such as in Cisco firewalls where each security policy only supports configuring one source address, one destination address, and one service port, while many other firewall brands support multiple source addresses, multiple destination addresses, and multiple service ports per security policy, if each entry is converted one-to-one without optimization, it can easily lead to configuration capacity limitations on the target device, preventing the data from being written to the replacement device. Specifically, according to one embodiment of this specification, the complete security policy information is merged to obtain a security policy information data table, as shown in the following example. Figure 5 As shown, the method may include:

[0118] Step 501: Divide the entries of the complete security policy information into blocks according to the policy action. After the division, all policies in each block have the same policy action.

[0119] Since the merging action is only performed within a block, it avoids changing the original policy matching logic by merging different policy actions. The entries in the security policy information data table are divided into blocks according to the policy actions in a top-down order. After the division, all policies in each block have the same policy actions. The merging is only performed within the policy block, so the merging action will not change the current security policy logic relationship, keep the policy control scope consistent before and after the merging, and only reduce the number of configurations.

[0120] Step 502: Extract features according to the merging method to obtain the merged feature table;

[0121] Step 503: Based on the complete security policy information after segmentation and the merged feature table, merge the security policies to generate a security policy information data table.

[0122] Security policies are merged based on the segmented complete security policy information and the merged feature table. For example, when merging based on the destination IP address, step 501 processes the security policy information data table block, which will be described later using security policy information data table block 1. Step 502 processes security policy information data table block 1 to obtain a merged feature table based on the destination address. The number of entries in the feature table is the number of merged policies. The merged feature table based on the destination address is traversed, and each entry in the merged feature table is sequentially matched against all entries in security policy information data table block 1. When the values ​​of all fields except the destination address field of an entry in security policy information data table block 1 are the same as the field values ​​of the matched entries in the merged feature table based on the destination address, the destination address field value of that entry in security policy information data table block 1 is written to a list. When all entries in security policy information data table block 1 have been matched, the list of destination address field values ​​serves as a type of destination address value in the merged feature table based on the destination address. After matching all entries in the feature table, a new security policy information data table is obtained. Compared with the original security policy information data table, the new table has fewer entries, and the number of generated target policies is also reduced. The principle of merging based on source IP address and merging based on service port is the same. By matching the original security policy information data table with the corresponding feature table, the source addresses and service ports that meet the merging conditions are summarized and written into the corresponding source IP address field and service port field, thereby reducing the number of configurations.

[0123] The specific steps of feature extraction in step 502 are as follows: Figure 6 As shown, the method may include:

[0124] Step 601: Traverse all entries of the complete security policy information and delete the destination address field of each entry;

[0125] Step 602: Determine whether the complete security policy information entry after deleting the destination address already exists in the merge feature table. If it does not exist, write it into the merge feature table; if it exists, do not write it. Continue until all entries are processed to obtain the merge feature table that merges entries with different destination addresses.

[0126] Step 603: Using the same method, extract the feature table that merges entries with different source addresses and entries with different service ports to obtain the merged feature table that merges entries with different source addresses and the merged feature table that merges entries with different service ports.

[0127] For example, when merging based on destination IP address, suppose a security policy information data table block 1 contains 100 policies. 50 of these policies have identical field values ​​except for the destination address field, with the field value type 'A', and are written to entry 1 of the destination address merging feature table. Another 30 policies have identical field values ​​except for the destination address field, with the field value type 'B', and are written to entry 2 of the destination address merging feature table. The remaining 20 policies have identical field values ​​except for the destination address field, with the field value type 'C', and are written to entry 3 of the destination address merging feature table. Entries 1, 2, and 3 of the destination address merging feature table are unique. Therefore, these 100 policies, analyzed based on the destination address, yield three feature types, which can ultimately be merged into three policies. The extraction principle for feature tables used for merging based on source address and service port is the same as for destination address merging. The source address and service port fields are deleted, and duplicate entries in other fields are removed before being written to the root source address merging feature table and the service port merging feature table, respectively.

[0128] In this embodiment of the specification, the blank configuration format template exported by the target firewall is a configuration format template. The IP address configuration data table, service port configuration data table, routing configuration data table, and address configuration data table obtained in steps 301-304 are imported into the configuration format template to obtain the target firewall configuration. Specifically,

[0129] The data from the IP address configuration data table and the service port configuration data table are written into the configuration format template to generate the target firewall address object configuration and the target service port object configuration. The data from the routing configuration data table is written into the configuration format template to generate the target firewall routing configuration. The data from the address configuration data table is written into the configuration format template according to the packet processing logic to generate the target firewall address translation configuration. This yields the target firewall configuration, which includes the target firewall address object configuration, target service port object configuration, target firewall routing configuration, and target firewall address translation configuration. Then, according to step 205, based on the merged security policy information data table, and according to the target firewall's packet forwarding logic and configuration format template, data is written to generate the target firewall file, which is then applied to the target firewall.

[0130] For example, when replacing the firewall in the core production area of ​​a bank's data center, it is necessary to convert the original Cisco firewall configuration file into the target configuration file of the Huawei firewall. Since each security policy of the Cisco firewall only supports configuring one source address, one destination address, and one service port, while the Huawei firewall supports multiple source addresses, multiple destination addresses, and multiple service ports per security policy, the original Cisco firewall's more than 110,000 security policies were converted and merged, reducing the number of policy entries by 50%, thus solving the problem of the target device's limitation of 100,000 configuration entries. The specific implementation steps are as follows:

[0131] Export the original Cisco firewall configuration file, open the original configuration with a conversion tool, perform a general format conversion using the conversion tool, and obtain multiple configuration data tables and security policy information;

[0132] Multiple configuration data tables are associated with security policy information to obtain complete security policy information;

[0133] The complete security policy information is merged. In this embodiment, the merging method is adopted based on the destination address. The number of security policy information data entries is reduced from 110,000 to more than 50,000, and a security policy information data table is obtained.

[0134] Export the configuration format template from Huawei firewall, and then input each piece of data from multiple configuration data tables according to the Huawei firewall configuration template format to generate the target firewall configuration.

[0135] The data from the security policy information table is imported to generate the target firewall configuration file, which is then imported into the device and loaded, completing the configuration migration and conversion. In this embodiment, the conversion process takes less than ten minutes. After the device replacement, actual business testing revealed no configuration errors, and the replacement was successful. This significantly saves manual time and costs, reduces the error rate, and improves the quality of operations and maintenance.

[0136] This specification also provides a firewall configuration device, such as... Figure 7 As shown, including,

[0137] Original configuration identification unit 701 is used to export the original firewall configuration file, perform general format conversion, and obtain multiple configuration data tables and security policy information;

[0138] The logical association unit 702 is used to associate the multiple configuration data tables with security policy information to obtain complete security policy information;

[0139] The policy merging unit 703 is used to merge the complete security policy information to obtain a security policy information data table.

[0140] The target configuration generation unit 704 is used to export the configuration format template of the target firewall, write the data of the multiple configuration data tables into the configuration format template, and generate the target firewall configuration.

[0141] The target file generation unit 705 is used to import the data from the security policy information data table into the target firewall configuration and generate the target firewall configuration file.

[0142] Since the principle of the above-mentioned device in solving the problem is similar to that of the above-mentioned method, the implementation of the above-mentioned device can refer to the implementation of the above-mentioned method, and the repeated parts will not be described again.

[0143] like Figure 8 The diagram illustrates the structure of a computer device according to an embodiment of this specification. The apparatus described in this specification can be the computer device in this embodiment, executing the methods described above. The computer device 802 may include one or more processing devices 804, such as one or more central processing units (CPUs), each of which can implement one or more hardware threads. The computer device 802 may also include any storage resource 806 for storing information of any kind, such as code, settings, data, etc. Without limitation, for example, the storage resource 806 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory, hard disk, optical disk, etc. More generally, any storage resource can use any technology to store information. Furthermore, any storage resource can provide volatile or non-volatile retention of information. Further, any storage resource may represent a fixed or removable component of the computer device 802. In one case, when the processing device 804 executes associated instructions stored in any storage resource or combination of storage resources, the computer device 802 can perform any operation of the associated instructions. The computer device 802 also includes one or more drive mechanisms 808 for interacting with any storage resource, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0144] Computer device 802 may also include an input / output module 810 (I / O) for receiving various inputs (via input device 812) and providing various outputs (via output device 814). A specific output mechanism may include a presentation device 816 and an associated graphical user interface (GUI) 818. In other embodiments, the input / output module 810 (I / O), input device 812, and output device 814 may be omitted, and the device may function solely as a computer device within a network. Computer device 802 may also include one or more network interfaces 820 for exchanging data with other devices via one or more communication links 822. One or more communication buses 824 couple the components described above together.

[0145] Communication link 822 can be implemented in any way, such as via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, or any combination thereof. Communication link 822 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0146] Corresponding to Figures 2 to 6 In addition to the methods described above, embodiments of this specification also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the methods described above.

[0147] This specification also provides computer-readable instructions, wherein when a processor executes the instructions, the program therein causes the processor to perform the following... Figures 2 to 6 The method shown.

[0148] It should be understood that in the various embodiments of this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0149] It should also be understood that, in the embodiments of this specification, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this specification generally indicates that the preceding and following related objects have an "or" relationship.

[0150] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Skilled users can implement the described functions using different methods for each specific application, but such implementations should not be considered beyond the scope of this specification.

[0151] Those skilled in the field will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0152] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.

[0153] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments described in this specification, depending on actual needs.

[0154] Furthermore, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0155] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this specification, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0156] This specification uses specific embodiments to illustrate the principles and implementation methods of this specification. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this specification. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this specification. Therefore, the content of this specification should not be construed as a limitation of this specification.

Claims

1. A method for configuring a firewall, characterized in that, The method includes, Read the original firewall configuration file, convert the format of the custom data in it, and obtain multiple configuration data tables and security policy information; By associating the multiple configuration data tables with security policy information, complete security policy information is obtained; The complete security policy information is merged to obtain a security policy information data table; The complete security policy information entries are divided into blocks according to policy actions, and all policies in each block have the same policy actions. Extract the feature table that merges entries with different destination addresses, traverse all entries of the complete security policy information, delete the destination address field of each entry, and determine whether the complete security policy information entry exists in the merged feature table after deleting the destination address. If it does not exist, write it into the merged feature table; if it exists, do not write it. Continue until all entries are processed to obtain the merged feature table that merges entries with different destination addresses. Extract the feature table by merging entries with different source addresses, traverse all entries of the complete security policy information, and delete the source address field of each entry; Determine whether the complete security policy information entry after deleting the source address already exists in the merge feature table. If it does not exist, write it into the merge feature table; if it exists, do not write it. Continue this process until all entries are processed to obtain the merge feature table that merges entries with different source addresses. Extract the feature table by merging entries with different service ports, traverse all entries of the complete security policy information, and delete the service port field of each entry; Determine whether the complete security policy information entry after deleting the service port already exists in the merge feature table. If it does not exist, write it into the merge feature table; if it exists, do not write it. Continue this process until all entries are processed to obtain the merge feature table that merges the entries with different service ports. Based on the complete security policy information after segmentation and the merged feature table, the security policies are merged to generate a security policy information data table. Write the data from the multiple configuration data tables into a configuration format template to generate the target firewall configuration; The data from the security policy information data table is written into the target firewall configuration to generate the target firewall configuration file.

2. The firewall configuration method according to claim 1, characterized in that, The original firewall configuration file includes IP address object configuration, service port object configuration, routing configuration, address translation configuration, and security policy information.

3. The firewall configuration method according to claim 2, characterized in that, The step of reading the original firewall configuration file, converting the format of the custom data in the file, and obtaining multiple configuration data tables and security policy information further includes: Read the IP address object configuration, use regular expressions to match the object name and contained IP address information of each address object configuration, obtain the IP address object information, and generate an IP address configuration data table; Read the service port object configuration, use regular expressions to match the object name and the included protocol, port, and timeout information of each service port object configuration to obtain the service port information and generate a service port configuration data table; Read the routing configuration, use regular expressions to match the virtual router name, destination network segment and subnet mask, outgoing interface, next-hop IP address, priority and description fields of each route to obtain routing information and generate a routing configuration data table; The address translation configuration is read, and regular expressions are used to match the configuration field information of each address translation to obtain the address translation information and generate an address configuration data table.

4. The firewall configuration method according to claim 1, characterized in that, The multiple configuration data tables are associated with security policy information to obtain complete security policy information, which further includes: Associate the timing of different configuration items being invoked by the security policy with that security policy; Associate the multiple configuration data tables involved in the security policy with the security policy; The complete security policy information is generated based on the relationships between multiple configuration data tables recorded in the security policy.

5. The firewall configuration method according to claim 4, characterized in that, The merged feature table further includes, Merge feature tables that merge entries with different destination addresses, merge feature tables that merge entries with different source addresses, and merge feature tables that merge entries with different service ports.

6. The firewall configuration method according to claim 5, characterized in that, The step of merging security policies based on the segmented complete security policy information and the merged feature table to generate a security policy information data table further includes: All security policy information table entries that match the same entry in the merged feature table are merged to generate a single entry in the security policy information data table. After all entries in the merged feature table are matched, the final security policy information data table is obtained.

7. The firewall configuration method according to claim 1, characterized in that, The configuration format template is a blank configuration format template exported by the target firewall.

8. The firewall configuration method according to claim 1, characterized in that, The step of writing the data from the security policy information data table into the target firewall configuration further includes, The target firewall configuration includes: target firewall address object configuration, target service port object configuration, target firewall routing configuration, and target firewall address translation configuration.

9. The firewall configuration method according to claim 8, characterized in that, Import the multiple configuration data tables into the firewall configuration generation module to generate the target firewall configuration, further including... Write the data from the IP address configuration data table and the service port configuration data table into the configuration format template to generate the target firewall address object configuration and the target service port object configuration. Write the data from the routing configuration data table into the configuration format template to generate the target firewall routing configuration; The data from the address configuration data table is written into the configuration format template according to the packet processing logic to generate the target firewall address translation configuration.

10. A device for configuring a firewall, characterized in that, include, The original configuration identification unit is used to read the original firewall configuration file, convert the format of the custom data in it, and obtain multiple configuration data tables and security policy information. The logical association unit is used to associate the multiple configuration data tables with security policy information to obtain complete security policy information; The policy merging unit is used to merge the complete security policy information to obtain a security policy information data table. The complete security policy information entries are divided into blocks according to policy actions, and all policies in each block have the same policy actions. Extract the feature table that merges entries with different destination addresses, traverse all entries of the complete security policy information, delete the destination address field of each entry, and determine whether the complete security policy information entry exists in the merged feature table after deleting the destination address. If it does not exist, write it into the merged feature table; if it exists, do not write it. Continue until all entries are processed to obtain the merged feature table that merges entries with different destination addresses. Extract the feature table by merging entries with different source addresses, traverse all entries of the complete security policy information, and delete the source address field of each entry; Determine whether the complete security policy information entry after deleting the source address already exists in the merge feature table. If it does not exist, write it into the merge feature table; if it exists, do not write it. Continue this process until all entries are processed to obtain the merge feature table that merges entries with different source addresses. Extract the feature table by merging entries with different service ports, traverse all entries of the complete security policy information, and delete the service port field of each entry; Determine whether the complete security policy information entry after deleting the service port already exists in the merge feature table. If it does not exist, write it into the merge feature table; if it exists, do not write it. Continue this process until all entries are processed to obtain the merge feature table that merges the entries with different service ports. Based on the complete security policy information after segmentation and the merged feature table, the security policies are merged to generate a security policy information data table. The target configuration generation unit is used to export the configuration format template of the target firewall, write the data of the multiple configuration data tables into the configuration format template, and generate the target firewall configuration. The target file generation unit is used to import the data from the security policy information data table into the target firewall configuration and generate the target firewall configuration file.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the computer program is run by the processor, it executes the instructions of the method according to any one of claims 1 to 9.

12. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor of the computer device, it executes the instructions of the method according to any one of claims 1 to 9.

Images