the margrave tool for firewall analysis · 14. ip nat pool localnet 209.172.108.16 prefix-length 24...

The Margrave Tool for Firewall Analysis

Tim Nelson (WPI), Christopher Barratt (Brown),

Daniel J. Dougherty (WPI), Kathi Fisler (WPI)

and Shriram Krishnamurthi (Brown)

1

…and other dens of iniquity

2

“I don’t really know what’s wrong.”

“I’m having this strange issue with

Cisco IOS…”

“I need your advice…”

3

4

Policy-based routing

Static routing,NAT

ACLs, reflexive access-lists

6

Try this!

7

Try this!No! Try

this!

8

Try this!No! Try

this!

No, no, try this.

Suggestions do not always agree.

9

Try this!No! Try

this!

No, no, try this.

Debugging Questions:

10


11

Q: Which hop will SMTP packets take next?


12


…

192.168.100.4

192.168.200.5

A:


13

Q: Which configuration rules caused the incorrect routing?


…

192.168.100.4

192.168.200.5

A:


14



…

192.168.100.4

192.168.200.5

A: Line 14 applied to…

Line 15 applied to…

…

A:


15

Q: What packets will pass the firewall?



…

192.168.100.4

192.168.200.5



…

A:


16




…

192.168.100.4

192.168.200.5



…

A:

…

TCP From X to YA:


17




Q: How do a pair of configurationsbehave differently?

…

192.168.100.4

192.168.200.5



…

A:

…

TCP From X to YA:


18





…

192.168.100.4

192.168.200.5



…

A:

…

TCP From X to YA:

…

Time Connection State

A:


19





…

192.168.100.4

192.168.200.5



…

A:

…

TCP From X to YA:

…


A:

Scenarios


20





…

192.168.100.4

192.168.200.5



…

A:

…

TCP From X to YA:

…


A:Margrave

Scenarios

1. interface FastEthernet02. ip address 209.172.108.16 255.255.255.2243. ip access-group 102 in4. ip nat outside5. speed auto6. full-duplex7. !8. interface Vlan19. ip address 192.168.2.1 255.255.255.010. ip nat inside11. !12. ip route 0.0.0.0 0.0.0.0 209.172.108.113. !14. ip nat pool localnet 209.172.108.16 prefix-length 2415. ip nat inside source list 1 pool localnet overload16. ip nat inside source list 1 interface FastEthernet017. ip nat inside source static tcp 192.168.2.6 80 209.172.108.16 8018. ip nat inside source static tcp 192.168.2.6 21 209.172.108.16 2119. ip nat inside source static tcp 192.168.2.6 3389 209.172.108.16 338920. !21. access-list 1 permit 192.168.2.0 0.0.0.25522. access-list 102 permit tcp any host 209.172.108.16 eq 8023. access-list 102 permit tcp any host 209.172.108.16 eq 2124. access-list 102 permit tcp any host 209.172.108.16 eq 2025. access-list 102 permit tcp any host 209.172.108.16 eq 2326. access-list 102 deny tcp any host 209.172.108.16

Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

28

“The web can access my server, but my server can’t access the web.”


Firewall

Server: 192.168.2.6

29


Fe0 209.172.108.16

Vlan1 192.168.2.1/24

interface FastEthernet0ip address 209.172.108.16 255.255.255.224

interface Vlan1ip address 192.168.2.1 255.255.255.0


Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

30


access-list 102 permit tcp any host 209.172.108.16 eq 80access-list 102 permit tcp any host 209.172.108.16 eq 21access-list 102 permit tcp any host 209.172.108.16 eq 20access-list 102 permit tcp any host 209.172.108.16 eq 23access-list 102 deny tcp any host 209.172.108.16

ip access-group 102 in


Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

31


ip route 0.0.0.0 0.0.0.0 209.172.108.1


Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

32


ip nat outside

access-list 1 permit 192.168.2.0 0.0.0.255

ip nat inside

ip nat pool localnet 209.172.108.16 prefix-length 24ip nat inside source list 1 pool localnet overloadip nat inside source list 1 interface FastEthernet0ip nat inside source static tcp 192.168.2.6 80 209.172.108.16 80ip nat inside source static tcp 192.168.2.6 21 209.172.108.16 21ip nat inside source static tcp 192.168.2.6 3389 209.172.108.16

3389


Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

33




Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

34




Firewall

Server: 192.168.2.6

Fe0 209.172.108.16

Vlan1 192.168.2.1/24

35



36


Passes fe0’sInbound ACL?

Can it be routed?

Passes vlan1’sOutbound

ACL?

Returning packets

37



Can it be routed?


ACL?

Returning packets

Passes fe0’sOutbound

ACL?

Can it be routed?

Passes vlan1’sInbound ACL?

Outgoing packets

38


“Can returning packets be lost?”

39



40


EXPLORE

“Find me scenarios where…”


41


EXPLORENOT passes-firewall(<pkt>);

“Dropped or rejected”

<pkt> =entry-interface

src-addr-inprotocol

…


42


EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) ;

“Compute next hop and NAT”

<pktplus> =<pkt>

+temporary variables


43


EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) AND FastEthernet0 = entry-interface;

“Arriving at FastEthernet0”


44


EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) AND FastEthernet0 = entry-interfaceAND NOT src-addr-in IN 192.168.2.0/255.255.255.0;

“Reasonable source”


45


EXPLORENOT passes-firewall(<pkt>)AND internal-result(<pktplus>) AND FastEthernet0 = entry-interfaceAND NOT src-addr-in IN 192.168.2.0/255.255.255.0

AND prot-TCP = protocolAND port-80 = src-port-in;

“TCP from port 80”


46



AND prot-TCP = protocolAND port-80 = src-port-in;AND dest-addr-in = 209.172.108.16;

“To public address”


47



AND prot-TCP = protocolAND port-80 = src-port-in;AND dest-addr-in = 209.172.108.16;

“To public address”Here, a scenario is:

Data about a packet’scontents & handling


48

Check for denied return packets:

Result:

> EXPLORENOT src-addr-in IN 192.168.2.0/255.255.255.0 AND FastEthernet0 = entry-interfaceAND prot-TCP = protocolAND port-80 = src-port-inAND dest-addr-in = 209.172.108.16AND internal-result(<pktplus>) AND NOT passes-firewall(<pkt>);

> IS POSSIBLE?;


49


Result:


> IS POSSIBLE?;true>

Some return packets will be

dropped.


50


Result:

Similar query: outgoing packets all pass the firewall.


> IS POSSIBLE?;true>

Some return packets will be

dropped.

“Which rule(s) were responsible?”

51


> SHOW REALIZED InboundACL:router-FastEthernet0-line22_applies(<pkt>),InboundACL:router-FastEthernet0-line23_applies(<pkt>),InboundACL:router-FastEthernet0-line24_applies(<pkt>),InboundACL:router-FastEthernet0-line25_applies(<pkt>),InboundACL:router-FastEthernet0-line26_applies(<pkt>);


52



The ACL rules tied to FastEthernet0


53





{ InboundACL:router-FastEthernet0-line26_applies( … ) }>

54

{ InboundACL:router-FastEthernet0-line26_applies( … ) }

The ACL rule…

Can apply.

Appearing on line 26

Tied to the router’s

FastEthernet0interface

55


The ACL rule…

Can apply.




EXPLORE InboundACL:router-FastEthernet0-line26_applies(<pkt>);

Use these in queries too:

56


The ACL rule…

Can apply.




EXPLORE InboundACL:router-FastEthernet0-line26_applies(<pkt>);

EXPLORE InboundACL:router-FastEthernet0-line26_matches (<pkt>);

Use these in queries too:

“Add a rule allowing all returning traffic from

port 80…”

57

Will this change fix my problem?


port 80…”

58

Will it introduce new problems?

Will this change fix my problem?


port 80…”

59

60

22. access-list 102 permit tcp any host 209.172.108.16 eq 8023. access-list 102 permit tcp any host 209.172.108.16 eq 2124. access-list 102 permit tcp any host 209.172.108.16 eq 2025. access-list 102 permit tcp any host 209.172.108.16 eq 2326. access-list 102 permit tcp any eq 80 any27. access-list 102 deny tcp any host 209.172.108.16

22. access-list 102 permit tcp any host 209.172.108.16 eq 8023. access-list 102 permit tcp any host 209.172.108.16 eq 2124. access-list 102 permit tcp any host 209.172.108.16 eq 2025. access-list 102 permit tcp any host 209.172.108.16 eq 2326. access-list 102 deny tcp any host 209.172.108.16

diff says:

25a26> access-list 102 permit tcp any eq 80 any

61



62



EXPLORENOT src-addr-in IN 192.168.2.0/255.255.255.0 ANDFastEthernet0 = entry-interface AND

internal-result1(<pktplus>) AND

(passes-firewall1(<pkt>) AND NOT passes-firewall2(<pkt>)ORpasses-firewall2(<pkt>) AND NOT passes-firewall1(<pkt>) );

63






64









65






Change-impact analysis

> EXPLORENOT src-addr-in IN 192.168.2.0/255.255.255.0 ANDfastethernet0 = entry-interface ANDinternal-result1(<pktplus>) AND(passes-firewall1(<pkt>) AND NOT passes-firewall2(<pkt>)ORpasses-firewall2(<pkt>) AND NOT passes-firewall1(<pkt>) );

> SHOW ALL;

66


> SHOW ALL;

protocol: prot-tcpentry-interface: fastethernet0 dest-addr-in: 209.172.108.16

src-addr-in: ipaddressdest-port-in: port

src-port-in: port-80 exit-interface: vlan1

67


> SHOW ALL;




68

Public address of server


> SHOW ALL;




“Some other address”

“Some other port”

69


> SHOW ALL;




70

Packet is routed successfully


> SHOW ALL;




71

protocol: prot-tcpentry-interface: fastethernet0

dest-addr-in: ipaddresssrc-addr-in: ipaddress

dest-port-in: port src-port-in: port-80 exit-interface: vlan1


> SHOW ALL;




72




More than we intended?


> SHOW ALL;

…protocol: prot-tcp

entry-interface: fastethernet0 dest-addr-in: 209.172.108.16



73






> SHOW ALL;

…protocol: prot-tcp

entry-interface: fastethernet0 dest-addr-in: 209.172.108.16



74





75

Query:

76

EXPLOREpasses-firewall(<pkt>)

Query:

77


Query:

Variables for packet contents & handling

78


Query:

entry-interface,next-hop,

dest-addr-in,…

79

entry-interface: fe0 next-hop: 192.168.2.6

dest-addr-in: 209.172.108.16…


Query: Scenario:

entry-interface,next-hop,

dest-addr-in,…

80


dest-addr-in: 209.172.108.16…


Query: Scenario:

192.168.2.6

209.172.108.16

fe0

…

81


dest-addr-in: 209.172.108.16…


Query: Scenario:

192.168.2.6

209.172.108.16

fe0

…

How large a scenario do we need to check?

82


dest-addr-in: 209.172.108.16…


Query: Scenario:

192.168.2.6

209.172.108.16

fe0

…

How large a scenario do we need to check?

Margrave computes a bound automatically, most of the time.

Let’s Recap:

83

Let’s Recap:

84

Do scenarios exist?

True/false

Let’s Recap:

85

Do scenarios exist?

True/false

Which scenarios exist?




Let’s Recap:

86

Do scenarios exist?

True/false

Which scenarios exist? Which rules can

take effect?

“InboundACL forFastEthernet0 onLine26”




Let’s Recap:

87

Do scenarios exist?

True/false

Which scenarios exist? Which rules can

take effect?

“InboundACL forFastEthernet0 onLine26”

Single-configuration

and

multi-configuration queries

(Change-impact analysis)





Can it be routed?


ACL?

Returning packets

88

interface GigabitEthernet0/0ip address 10.232.0.1 255.255.252.0ip access-group 101 inip policy route-map internet!ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130!access-list 101 deny ip 10.232.0.0 0.0.3.255 10.232.4.0 0.0.3.255access-list 101 deny ip 10.232.4.0 0.0.3.255 10.232.0.0 0.0.3.255access-list 101 permit ip any any!access-list 10 permit 10.232.0.0 0.0.3.255access-list 10 permit 10.232.100.0 0.0.3.255!route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15

89

Can it be routed?

interface GigabitEthernet0/0ip address 10.232.0.1 255.255.252.0ip access-group 101 inip policy route-map internet!ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130!access-list 101 deny ip 10.232.0.0 0.0.3.255 10.232.4.0 0.0.3.255access-list 101 deny ip 10.232.4.0 0.0.3.255 10.232.0.0 0.0.3.255access-list 101 permit ip any any!access-list 10 permit 10.232.0.0 0.0.3.255access-list 10 permit 10.232.100.0 0.0.3.255!route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15

90

How is it routed?

92

InboundACL:PermitInboundACL:Deny


Provides these query terms:

interface GigabitEthernet0/0ip address 10.232.0.1 255.255.252.0

93

LocalSwitching:ForwardLocalSwitching:Pass




94

ip policy route-map internet

route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15 PolicyRouting:Forward

PolicyRouting:RoutePolicyRouting:Pass




95


route-map internet permit 10match ip address 10set ip next-hop 10.232.0.15 StaticRouting:Forward

StaticRouting:RouteStaticRouting:Pass


ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130



96

DefaultPolicyRouting:ForwardDefaultPolicyRouting:RouteDefaultPolicyRouting:Pass



route-map internet permit 10match ip address 10set ip [default] next-hop 10.232.0.15

ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130



97

NetworkSwitching:ForwardNetworkSwitching:Pass




ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130



98

OutboundACL:PermitOutboundACL:Deny

ip access-group 102 in ip access-group 102 out



ip route 10.232.100.0 255.255.252.0 10.254.1.130ip route 10.232.104.0 255.255.252.0 10.254.1.130


EXPLORE

entry-interface = fastethernet0

AND NOT LocalSwitching:Forward(<pkt>)

I only want packets that don’t have a local

destination.

99

EXPLORE

entry-interface = fastethernet0

AND NOT LocalSwitching:Forward(<pkt>)

I only want packets that don’t have a local

destination.

Which permitted packets are

handled by policy routing?

Does the static route ever apply

to WWW packets?

100

Scenario-finding logic engine

101


102

Kodkod& SAT Solving


General Policy Language

103

Kodkod& SAT Solving


Query Language


104

Kodkod& SAT Solving


Query Language


105

Kodkod& SAT Solving


Query Language


Supported subset of Cisco IOS

106

Kodkod& SAT Solving


Query Language


Supported subset of Cisco IOS

107

Kodkod& SAT Solving

XACML

Amazon SQSIptables

(in progress)

Future Work

109

Future Work

110

192.168.1.5

Port 25

192.168.1.5

Port 80

Future Work

111

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

Future Work

112

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

Future Work

113

EXPLOREFastEthernet0 = entry-interface AND prot-TCP = protocol AND port-80 = src-port-in

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

Future Work

114

EXPLOREFastEthernet0 = entry-interface AND prot-TCP = protocol AND port-80 = src-port-in

“Try stateful inspection.”

192.168.1.5

Port 25

192.168.1.5

Port 80

192.168.1.5

Ports 25, 80

What configuration problems do you face?

Come talk to me! (I’m here until Friday.)

Text me: (774) 314-1128

Email me: [email protected]

Download the tool:

www.margrave-tool.org

Thank you to:

Varun Singh (Brown), Morgan Quirk (WPI), Emina Torlak (IBM Watson)

115

mailto:[email protected]

http://www.margrave-tool.org/



the margrave tool for firewall analysis · 14. ip nat pool localnet 209.172.108.16 prefix-length 24...

Documents