The Margrave Tool for Firewall Analysis

Tim Nelson (WPI), Christopher Barratt (Brown),

Daniel J. Dougherty (WPI), Kathi Fisler (WPI)

and Shriram Krishnamurthi (Brown)

…and other dens of iniquity

“I don’t really know what’s wrong.”

“I’m having this strange issue with

Cisco IOS…”

“I need your advice…”

Policy-based routing

Static routing,NAT

ACLs, reflexive access-lists

Try this!

Try this!No! Try

No, no, try this.

Suggestions do not always agree.

Try this!No! Try

No, no, try this.

Debugging Questions:

Q: Which hop will SMTP packets take next?

192.168.100.4

192.168.200.5

Q: Which configuration rules caused the incorrect routing?

192.168.100.4

192.168.200.5

192.168.100.4

192.168.200.5

A: Line 14 applied to…

Line 15 applied to…

Q: What packets will pass the firewall?

192.168.100.4

192.168.200.5

192.168.100.4

192.168.200.5

TCP From X to YA:

Q: How do a pair of configurationsbehave differently?

192.168.100.4

192.168.200.5

TCP From X to YA:

192.168.100.4

192.168.200.5

TCP From X to YA:

Time Connection State

192.168.100.4

192.168.200.5

TCP From X to YA:

Scenarios

192.168.100.4

192.168.200.5

TCP From X to YA:

A:Margrave

Scenarios

1. interface FastEthernet02. ip address 209.172.108.16 255.255.255.2243. ip access-group 102 in4. ip nat outside5. speed auto6. full-duplex7. !8. interface Vlan19. ip address 192.168.2.1 255.255.255.010. ip nat inside11. !12. ip route 0.0.0.0 0.0.0.0 209.172.108.113. !14. ip nat pool localnet 209.172.108.16 prefix-length 2415. ip nat inside source list 1 pool localnet overload16. ip nat inside source list 1 interface FastEthernet017. ip nat inside source static tcp 192.168.2.6 80 209.172.108.16 8018. ip nat inside source static tcp 192.168.2.6 21 209.172.108.16 2119. ip nat inside source static tcp 192.168.2.6 3389 209.172.108.16 338920. !21. access-list 1 permit 192.168.2.0 0.0.0.25522. access-list 102 permit tcp any host 209.172.108.16 eq 8023. access-list 102 permit tcp any host 209.172.108.16 eq 2124. access-list 102 permit tcp any host 209.172.108.16 eq 2025. access-list 102 permit tcp any host 209.172.108.16 eq 2326. access-list 102 deny tcp any host 209.172.108.16

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

“The web can access my server, but my server can’t access the web.”

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

interface FastEthernet0ip address 209.172.108.16 255.255.255.224

interface Vlan1ip address 192.168.2.1 255.255.255.0

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

access-list 102 permit tcp any host 209.172.108.16 eq 80access-list 102 permit tcp any host 209.172.108.16 eq 21access-list 102 permit tcp any host 209.172.108.16 eq 20access-list 102 permit tcp any host 209.172.108.16 eq 23access-list 102 deny tcp any host 209.172.108.16

ip access-group 102 in

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

ip route 0.0.0.0 0.0.0.0 209.172.108.1

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

ip nat outside

access-list 1 permit 192.168.2.0 0.0.0.255

ip nat inside

ip nat pool localnet 209.172.108.16 prefix-length 24ip nat inside source list 1 pool localnet overloadip nat inside source list 1 interface FastEthernet0ip nat inside source static tcp 192.168.2.6 80 209.172.108.16 80ip nat inside source static tcp 192.168.2.6 21 209.172.108.16 21ip nat inside source static tcp 192.168.2.6 3389 209.172.108.16

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

Passes fe0’sInbound ACL?

Can it be routed?

Passes vlan1’sOutbound

Returning packets

Can it be routed?

Returning packets

Passes fe0’sOutbound

Can it be routed?

Passes vlan1’sInbound ACL?

Outgoing packets

“Can returning packets be lost?”

EXPLORE

“Find me scenarios where…”

EXPLORENOT passes-firewall(<pkt>);

“Dropped or rejected”

<pkt> =entry-interface

src-addr-inprotocol

EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) ;

“Compute next hop and NAT”

+temporary variables

EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) AND FastEthernet0 = entry-interface;

“Arriving at FastEthernet0”

EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) AND FastEthernet0 = entry-interfaceAND NOT src-addr-in IN 192.168.2.0/255.255.255.0;

“Reasonable source”

EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) AND FastEthernet0 = entry-interfaceAND NOT src-addr-in IN 192.168.2.0/255.255.255.0

AND prot-TCP = protocolAND port-80 = src-port-in;

“TCP from port 80”

AND prot-TCP = protocolAND port-80 = src-port-in;AND dest-addr-in = 209.172.108.16;

“To public address”

AND prot-TCP = protocolAND port-80 = src-port-in;AND dest-addr-in = 209.172.108.16;

“To public address”Here, a scenario is:

Data about a packet’scontents & handling

Check for denied return packets:

Result:

> EXPLORENOT src-addr-in IN 192.168.2.0/255.255.255.0 AND FastEthernet0 = entry-interfaceAND prot-TCP = protocolAND port-80 = src-port-inAND dest-addr-in = 209.172.108.16AND internal-result(<pktplus>) AND NOT passes-firewall(<pkt>);

> IS POSSIBLE?;

Result:

> IS POSSIBLE?;true>

Some return packets will be

dropped.

Result:

Similar query: outgoing packets all pass the firewall.

> IS POSSIBLE?;true>

Some return packets will be

dropped.

“Which rule(s) were responsible?”

> SHOW REALIZED InboundACL:router-FastEthernet0-line22_applies(<pkt>),InboundACL:router-FastEthernet0-line23_applies(<pkt>),InboundACL:router-FastEthernet0-line24_applies(<pkt>),InboundACL:router-FastEthernet0-line25_applies(<pkt>),InboundACL:router-FastEthernet0-line26_applies(<pkt>);

The ACL rules tied to FastEthernet0

{ InboundACL:router-FastEthernet0-line26_applies( … ) }>

{ InboundACL:router-FastEthernet0-line26_applies( … ) }

The ACL rule…

Can apply.

Appearing on line 26

Tied to the router’s

FastEthernet0interface

The ACL rule…

Can apply.

EXPLORE InboundACL:router-FastEthernet0-line26_applies(<pkt>);

Use these in queries too:

The ACL rule…

Can apply.

EXPLORE InboundACL:router-FastEthernet0-line26_applies(<pkt>);

EXPLORE InboundACL:router-FastEthernet0-line26_matches (<pkt>);

Use these in queries too:

“Add a rule allowing all returning traffic from

port 80…”

Will this change fix my problem?

port 80…”

Will it introduce new problems?

Will this change fix my problem?

port 80…”

22. access-list 102 permit tcp any host 209.172.108.16 eq 8023. access-list 102 permit tcp any host 209.172.108.16 eq 2124. access-list 102 permit tcp any host 209.172.108.16 eq 2025. access-list 102 permit tcp any host 209.172.108.16 eq 2326. access-list 102 permit tcp any eq 80 any27. access-list 102 deny tcp any host 209.172.108.16

22. access-list 102 permit tcp any host 209.172.108.16 eq 8023. access-list 102 permit tcp any host 209.172.108.16 eq 2124. access-list 102 permit tcp any host 209.172.108.16 eq 2025. access-list 102 permit tcp any host 209.172.108.16 eq 2326. access-list 102 deny tcp any host 209.172.108.16

diff says:

25a26> access-list 102 permit tcp any eq 80 any

EXPLORENOT src-addr-in IN 192.168.2.0/255.255.255.0 ANDFastEthernet0 = entry-interface AND

internal-result1(<pktplus>) AND

(passes-firewall1(<pkt>) AND NOT passes-firewall2(<pkt>)ORpasses-firewall2(<pkt>) AND NOT passes-firewall1(<pkt>) );

Change-impact analysis

> EXPLORENOT src-addr-in IN 192.168.2.0/255.255.255.0 ANDfastethernet0 = entry-interface ANDinternal-result1(<pktplus>) AND(passes-firewall1(<pkt>) AND NOT passes-firewall2(<pkt>)ORpasses-firewall2(<pkt>) AND NOT passes-firewall1(<pkt>) );

> SHOW ALL;

protocol: prot-tcpentry-interface: fastethernet0 dest-addr-in: 209.172.108.16

src-addr-in: ipaddressdest-port-in: port

src-port-in: port-80 exit-interface: vlan1

> SHOW ALL;

Public address of server

> SHOW ALL;

“Some other address”

“Some other port”

> SHOW ALL;

Packet is routed successfully

> SHOW ALL;

protocol: prot-tcpentry-interface: fastethernet0

dest-addr-in: ipaddresssrc-addr-in: ipaddress

dest-port-in: port src-port-in: port-80 exit-interface: vlan1

> SHOW ALL;

More than we intended?

> SHOW ALL;

…protocol: prot-tcp

entry-interface: fastethernet0 dest-addr-in: 209.172.108.16

> SHOW ALL;

…protocol: prot-tcp

entry-interface: fastethernet0 dest-addr-in: 209.172.108.16

Query:

EXPLOREpasses-firewall(<pkt>)

Query:

Variables for packet contents & handling

Query:

entry-interface,next-hop,

dest-addr-in,…

entry-interface: fe0 next-hop: 192.168.2.6

dest-addr-in: 209.172.108.16…

Query: Scenario:

entry-interface,next-hop,

dest-addr-in,…

dest-addr-in: 209.172.108.16…

Query: Scenario:

192.168.2.6

209.172.108.16

dest-addr-in: 209.172.108.16…

Query: Scenario:

192.168.2.6

209.172.108.16

How large a scenario do we need to check?

dest-addr-in: 209.172.108.16…

Query: Scenario:

192.168.2.6

209.172.108.16

How large a scenario do we need to check?

Margrave computes a bound automatically, most of the time.

Let’s Recap:

Do scenarios exist?

True/false

Let’s Recap:

Do scenarios exist?

True/false

Which scenarios exist?

Let’s Recap:

Do scenarios exist?

True/false

Which scenarios exist? Which rules can

take effect?

“InboundACL forFastEthernet0 onLine26”

Let’s Recap:

Do scenarios exist?

True/false

Which scenarios exist? Which rules can

take effect?

“InboundACL forFastEthernet0 onLine26”

Single-configuration

multi-configuration queries

(Change-impact analysis)

Can it be routed?

Returning packets

interface GigabitEthernet0/0ip address 10.232.0.1 255.255.252.0ip access-group 101 inip policy route-map internet!ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130!access-list 101 deny ip 10.232.0.0 0.0.3.255 10.232.4.0 0.0.3.255access-list 101 deny ip 10.232.4.0 0.0.3.255 10.232.0.0 0.0.3.255access-list 101 permit ip any any!access-list 10 permit 10.232.0.0 0.0.3.255access-list 10 permit 10.232.100.0 0.0.3.255!route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15

Can it be routed?

interface GigabitEthernet0/0ip address 10.232.0.1 255.255.252.0ip access-group 101 inip policy route-map internet!ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130!access-list 101 deny ip 10.232.0.0 0.0.3.255 10.232.4.0 0.0.3.255access-list 101 deny ip 10.232.4.0 0.0.3.255 10.232.0.0 0.0.3.255access-list 101 permit ip any any!access-list 10 permit 10.232.0.0 0.0.3.255access-list 10 permit 10.232.100.0 0.0.3.255!route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15

How is it routed?

InboundACL:PermitInboundACL:Deny

Provides these query terms:

interface GigabitEthernet0/0ip address 10.232.0.1 255.255.252.0

LocalSwitching:ForwardLocalSwitching:Pass

ip policy route-map internet

route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15 PolicyRouting:Forward

PolicyRouting:RoutePolicyRouting:Pass

route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15 StaticRouting:Forward

StaticRouting:RouteStaticRouting:Pass

ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130

DefaultPolicyRouting:ForwardDefaultPolicyRouting:RouteDefaultPolicyRouting:Pass

route-map internet permit 10match ip address 10set ip [default] next-hop 10.232.0.15

ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130

NetworkSwitching:ForwardNetworkSwitching:Pass

ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130

OutboundACL:PermitOutboundACL:Deny

ip access-group 102 in ip access-group 102 out

ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130

EXPLORE

entry-interface = fastethernet0

AND NOT LocalSwitching:Forward(<pkt>)

I only want packets that don’t have a local

destination.

EXPLORE

entry-interface = fastethernet0

AND NOT LocalSwitching:Forward(<pkt>)

I only want packets that don’t have a local

destination.

Which permitted packets are

handled by policy routing?

Does the static route ever apply

to WWW packets?

Scenario-finding logic engine

Kodkod& SAT Solving

General Policy Language

Kodkod& SAT Solving

Query Language

Kodkod& SAT Solving

Query Language

Kodkod& SAT Solving

Query Language

Supported subset of Cisco IOS

Kodkod& SAT Solving

Query Language

Supported subset of Cisco IOS

Kodkod& SAT Solving

Amazon SQSIptables

(in progress)

Future Work

192.168.1.5

Port 25

192.168.1.5

Port 80

Future Work

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

Future Work

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

Future Work

EXPLOREFastEthernet0 = entry-interface AND prot-TCP = protocol AND port-80 = src-port-in

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

Future Work

EXPLOREFastEthernet0 = entry-interface AND prot-TCP = protocol AND port-80 = src-port-in

“Try stateful inspection.”

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

What configuration problems do you face?

Come talk to me! (I’m here until Friday.)

Text me: (774) 314-1128

Email me: tn@cs.wpi.edu

Download the tool:

www.margrave-tool.org

Thank you to:

Varun Singh (Brown), Morgan Quirk (WPI), Emina Torlak (IBM Watson)

The Margrave Tool for Firewall Analysis · The Margrave Tool for Firewall Analysis Tim Nelson...

Documents

wpi Agustus 011

Solar Salvation at WPI - Worcester Polytechnic Institute (WPI)

The Margrave Mini History website: Home Mini British...met een Griekse eigenaar, die over een werkelijk schitterende Wood and Pickett Inno Cooper beschikt. Geen Margrave dus, maar

WPI International Brochure

Windows 7 Firewall. Windows 7 Firewall Topics What is a firewall? What is a firewall? Firewall types Firewall types How a firewall works How a firewall

WPI Aula 04

WPI Research · 2017-02-10 · WPI Research Discovery and Innovation with Purpose > wpi.edu/+research 2017 KEEP UP WITH RESEARCH AT WPI > Read the latest WPI research news, watch

The Margrave Tool for Firewall Analysis › legacy › event › lisa10 › tech › ... · 14. ip nat pool localnet 209.172.108.16 prefix-length 24 15. ip nat inside source list

Margrave: An Improved Analyzer for Access-Control and Con ...€¦ · Margrave: An Improved Analyzer for Access-Control and Con guration Policies by Tim Nelson A Thesis Submitted

WPI London Centre Paul Davis Director, WPI London Centre

WPI London Centre

WPI Aula 05

Margrave: XACML Verification and Change-Impact Analysis Kathi Fisler, WPI Shriram Krishnamurthi, Brown Leo Meyerovich, Brown Michael Carl Tschantz, Brown

WPI Monthly

WPI Aula 03

Policy Analysis Using Margrave

Gary F. Margrave, Samantha Taylor, and Joanna K. Cooper · 2021. 3. 30. · Gary F. Margrave, Samantha Taylor and Joanna K. Cooper Subject: CREWES Research Report Volume 20 (2008)

Tianci Cui and Gary F. Margrave - CREWES...Tianci Cui and Gary F. Margrave ABSTRACT In this paper, four methods of seismic wavelet estimation are investigated:the statistical method,

Elisa Negrini (WPI) Advisors: Professors Luca Capogna (WPI ... · Elisa Negrini (WPI) Advisors: Professors Luca Capogna (WPI) and Giovanna Citti (UNIBO) In this work we reconstruct

WPI 2010 Baccalaureate