Firewall Object Model - Possibly Plugin

[whitej6]

Looking to start discussion on creating possibly a plugin for modeling firewall objects. Initial idea would be modeling components like object groups, object services with the intention for either later extension or additional plugins to consume the models for feature like NAT.

[jathanism]

When we talk about firewall objects, safe to assume you mean firewall policies/rules? Just trying to be explicit!

[whitej6]

@itdependsnetworks I can always count on you to provide a data structure!

[whitej6]

Feel like it may need to go up a level and the parent be policy with name, applied to & statements. Then your structure nested inside. Order = Index?

[itdependsnetworks]

nesting, yes, I was documenting more of the fields than being explicit about the structure.
yes, order = index.

[jathanism]

Just to contribute to the conversation I have some prior art from the Trigger project which has an ACL parser with its own data model. Not that we would want to adhere strictly to this model, but I do feel that there is a lot of work here that could be used to compare and inspire the design of an abstract model we come up with.

We would be wise to compare modeling a the exact same policy from at least two distinctly different vendor implementations (for example a Palo Alto Networks policy vs. a Juniper SRX policy) to identify commonalities and differences to inform how to accurately come up with an abstract model that can work in the majority of cases.

For example, at the time that the Trigger ACL parser was originally written (back in 2006) we created the same policy using both Juniper JUNOS firewall policies (aka "acl") and Cisco IOS extended access-lists, comparing the features and expressions of each. Juniper policies were much more robust and had more features like header offsets, packet sizes, etc. So at the time it was decided to do the data modeling around the Juniper policies and then allow for graceful degradation of removing features from modeling Cisco IOS access-lists because they were more basic.

[itdependsnetworks]

I do like the idea for convenience methods to parse and output configuration for developers to extend such functionality. It was a bit hard to pull out the model from the read the docs class interpretation. That being said, there may be some more goodies there if can be deconstructed.

[sirtux]

Just my 2 cents:

If i have a policy object, I'd like to be able to attach it to other objects:

• Attach it to a prefix
• Attach it to VLAN
• Attach it to an interface

I think these are the places where I would need them, maybe someone else has some more?

[scetron]

A device as well for those that have global policies?

[itdependsnetworks]

Shouldn't Nautobot's current relationship feature just work for this?

[whitej6]

Proposed data model, looking for feedback. It's meant to be generic enough for multivendor

[whitej6]

tcp_udp_icmp will change to a FK to IANAProtocol & DB be prepopulated

[NoifP]

Is there a reason why there is not a user as a PolicyRule Destination? Is it assumed that a user will only ever be making outbound requests and inbound traffic for that user will be associated with the outbound rule (hence user will only be source, never destination)?

Is it feasible that a user could also be a destination for new inbound sessions?

Apart from this very minor detail it looks great to me!

[whitej6]

When @itdependsnetworks and I talked through the model user I don't think was something available for configuration as a destination in the solution we were looking at. If there's a vendor that has that as a config option it would be easy to add it.

Also if that is possible from a vendor configuration perspective then the source & destination could be collapsed into one model

[itdependsnetworks]

That is my experience, but my experience may be limited.

[NoifP]

Different vendors support different things and I haven't seen user as a destination yet either. However, with lots of talk about "zero trust" maybe user (or user group) as destination is coming soon.

Looking at it another way - if it simplifies the model then why not include it as an option for both source and destination?

[jedelman8]

nice work @whitej6 !

[whitej6]

I have built the models and here's an example GraphQL query with output.

[erjac77]

Hi there. Any news on this plugin? We need this functionality very soon and would like to know if we should wait for this plugin or create our own... Thanks.

[Kircheneer]

There's a beta out now here