JP2017028403A - Device and program for firewall management - Google Patents

Abstract

PROBLEM TO BE SOLVED: To generate an entry to be added to an access control list of each firewall according to a communication requirement, if there are a plurality of packet relay firewalls.SOLUTION: A requirement reception unit 110 receives requirement data 101 which includes a transmission source address, a destination address and an action indicative of the availability of communication. When a packet in which the received transmission source address and the received destination address are set is transmitted, a firewall identification unit 120 identifies a packet relay firewall device using a firewall setting file 180 for each firewall device. An entry generation unit 130 generates an entry, to which the received action is set, as an entry to be added to the access control list of the identified firewall device.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technique for managing a firewall device.

Based on a list called an access control list (ACL), a firewall that is a network security device determines whether to pass or block a communication packet that passes through the firewall.
In ACL, an action is defined in association with information such as a transmission source IP address, a transmission source port, a destination IP address, a destination port, and a communication protocol. The action indicates whether the communication packet is permitted or denied.

If the ACL is incorrect, the communication packet to be passed is blocked by the firewall and a communication failure occurs, and the communication packet to be blocked passes through the firewall to cause a security threat.
Therefore, the ACL must be introduced after it has been fully verified.

The ACL is created based on communication requirements, but the user who creates the communication requirements does not always fully understand the network configuration of the target system. Therefore, an incorrect requirement may be created, and an incorrect ACL may be created based on the incorrect requirement.
For example, for a system in which multiple ports are used, one or more of the ports used may leak from the communication requirements. In this case, an incorrect ACL is created and a communication failure occurs.

Patent Document 1 discloses a technique related to a shared firewall setting method in a hosting service.
The technology receives a requirement change request from a user using a hosting service, adds an IP address allocated to the user to the requirement change request, automatically generates an ACL, and sets the generated ACL in a shared firewall. That's it.
However, when there is a requirement change request regarding a communication packet passing through a plurality of firewalls, it is not possible to appropriately set a firewall that requires ACL setting based on the routing information set in each firewall. Therefore, an optimal ACL cannot be generated.

JP 2005-217757 A

  An object of the present invention is to make it possible to generate an entry to be added to an access control list of each firewall according to communication requirements even when there are a plurality of firewalls that relay packets.

The firewall management apparatus of the present invention
A requirement receiving unit that receives a source address, a destination address, and an action indicating whether communication is possible;
When a packet in which an accepted source address and an accepted destination address are set is transmitted, at least one of the source address and the destination address set in the packet for relaying the packet A firewall identifying unit that identifies a converted firewall that is a firewall device that converts an address by using an address conversion table that is a table for each firewall device and associates an address before conversion and an address after conversion;
As an entry to be registered in the access control list set in the specified conversion firewall, an entry generation unit that generates an entry in which an accepted action is set is provided.

  According to the present invention, even if there are a plurality of firewalls that relay packets, each firewall can be specified. Therefore, an entry to be added to the access control list of each firewall can be generated according to the communication requirements.

2 is a functional configuration diagram of a firewall management apparatus 100 according to Embodiment 1. FIG. FIG. 3 is a configuration diagram of requirement data 101 according to the first embodiment. FIG. 3 is a functional configuration diagram of a requirement receiving unit 110 according to the first embodiment. FIG. 3 is a schematic diagram showing division of communication requirements 102 in the first embodiment. FIG. 3 is a configuration diagram of a firewall setting file 180 in the first embodiment. 2 is a functional configuration diagram of a firewall specifying unit 120 according to Embodiment 1. FIG. FIG. 3 is a configuration diagram of an address conversion list 122 and specific information 124 according to the first embodiment. FIG. 3 is a schematic diagram showing generation of specific information 126 in the first embodiment. FIG. 6 is a relationship diagram of specific information 124, specific information 126, and specific information 103 in the first embodiment. 2 is a functional configuration diagram of an entry generation unit 130 according to Embodiment 1. FIG. FIG. 4 is a relationship diagram among the communication requirement 102, the specific information 103, and the access control entry 104 in the first embodiment. FIG. 3 is a schematic diagram showing aggregation of access control entries 104 according to the first embodiment. FIG. 3 is a configuration diagram of a firewall management file 191 in the first embodiment. 5 is a flowchart of a firewall management method according to the first embodiment. 5 is a flowchart of requirement division processing (S120) in the first embodiment. 5 is a flowchart of firewall specifying processing (S140) in the first embodiment. The flowchart of the conversion specific process (S141) in Embodiment 1. FIG. 6 is a flowchart of source address processing (S1411) in the first embodiment. 6 is a flowchart of destination address processing (S1412) in the first embodiment. 5 is a flowchart of relay identification processing (S142) in the first embodiment. 5 is a flowchart of entry aggregation processing (S170) in the first embodiment. FIG. 6 is a functional configuration diagram of the firewall management apparatus 100 according to the second embodiment. FIG. 9 is a schematic diagram showing division of an access control entry 104 in the second embodiment. 10 is a flowchart of entry division processing according to the second embodiment. 10 is a flowchart of entry division processing according to the second embodiment. FIG. 6 is a configuration diagram of a communication verification system 200 according to Embodiment 3. FIG. 10 is a functional configuration diagram of the firewall management apparatus 100 according to the third embodiment. The block diagram of the past requirement file 170 in Embodiment 3. FIG. The block diagram of the similarity table 192 in Embodiment 3. FIG. The hardware block diagram of the firewall management apparatus 100 in embodiment.

Embodiment 1 FIG.
A form in which an entry to be registered in the access control list set in the firewall apparatus is generated according to communication requirements will be described with reference to FIGS.

*** Explanation of configuration ***
A functional configuration of the firewall management apparatus 100 will be described with reference to FIG.
The firewall management apparatus 100 includes a requirement accepting unit 110, a firewall specifying unit 120, an entry generation unit 130, a setting file acquisition unit 140, and a storage unit 190.

The requirement accepting unit 110 accepts requirement data 101 indicating one or more communication requirements 102.
In FIG. 2, the requirement data 101 associates each information of a transmission source address, a transmission source port, a destination address, a destination port, a protocol, and an action. These pieces of information are information indicating one or more communication requirements 102.
The source address information indicates a source address or a source group. The transmission source group is an address group including a plurality of continuous transmission source addresses. An IP address is an example of a source address. 1.1.1.1-3 in the figure is a transmission source group including three transmission source addresses 1.1.1.1 to 1.1.1.3.
The information of the transmission source port indicates the transmission port. Any in the figure means all transmission ports.
The destination address information indicates a destination address or a destination group. The destination group is an address group including a plurality of consecutive destination addresses. An IP address is an example of a destination address. 2.2.2.1-2 in the figure is a destination group including two destination addresses from 2.2.2.1 to 2.2.2.2.
The destination port information indicates the destination port.
The protocol information indicates a protocol such as tcp or udp.
The action information indicates whether communication is possible.

Based on FIG. 3, the functional configuration of the requirement receiving unit 110 will be described.
The requirement receiving unit 110 includes a requirement data receiving unit 111 and a firewall specifying unit 120.
The requirement data receiving unit 111 receives the requirement data 101.

The requirement dividing unit 112 divides the requirement data 101 into a plurality of communication requirements 102 when the requirement data 101 indicates a plurality of communication requirements 102.
That is, the requirement dividing unit 112 generates the communication requirement 102 for each combination of the transmission source address included in the transmission source group indicated by the requirement data 101 and the destination address included in the destination group indicated by the requirement data 101.

In FIG. 4, the requirement data 101 indicates a transmission source group including three transmission source addresses and a destination group including two destination addresses.
Therefore, the requirement division unit 112 generates six communication requirements 102 by combining three transmission source addresses and two destination addresses.

Returning to FIG. 1, the function of the firewall identifying unit 120 will be described.
The firewall identifying unit 120 identifies at least one of the conversion firewall and the relay firewall for each communication requirement 102 using the firewall setting file 180 for each firewall device.
When a packet in which the source address indicated in the communication requirement 102 and the destination address indicated in the communication requirement 102 are set, the conversion firewall transmits the packet to the source set in the packet. This is a firewall device that converts at least one of an address and a destination address. The address translation is called NAT or NAPT. NAT is an abbreviation for Network Address Translation, and NAPT is an abbreviation for Network Address Port Translation.
The relay firewall is a firewall device that does not convert any of the source address and the destination address set in the packet in order to relay the packet.

The configuration of the firewall setting file 180 will be described with reference to FIG.
The firewall setting file 180 includes an address conversion table 181 used for specifying a conversion firewall, a routing table 182 used for specifying a relay firewall, and an access control list 183. The access control list 183 is called an abbreviation ACL.

The address conversion table 181 associates information on the inner interface, the inner address, the outer interface, and the outer address with each other.
The information on the inside interface indicates an interface name that identifies an interface connected to the inside network. The inner network is one of the two networks to which the firewall device is connected.
The inner address information indicates a pre-conversion address corresponding to the source address before conversion and a post-conversion address corresponding to the destination address after conversion.
The information on the outside interface indicates an interface name that identifies an interface connected to the outside network. The outside network is the other network of the two networks to which the firewall device is connected.
The information of the outside address indicates a post-conversion address corresponding to the source address after conversion and a pre-conversion address corresponding to the destination address before conversion.

The routing table 182 associates each information of the destination, the output interface, and the next hop with each other.
The destination information indicates a route address. The root address is an address used in any network to which the firewall device is connected. The default in the figure means an address excluding y ′ and Z.
The output interface information indicates an interface name that identifies an interface connected to the network in which the route address is used.
The next hop information indicates a relay device that relays the packet next.

Similar to the requirement data 101 and the communication requirement 102, the access control list 183 associates information of a transmission source address, a transmission source port, a destination address, a destination port, a protocol, and an action with each other.
An entry registered in the access control list 183 is referred to as an access control entry.

Based on FIG. 6, the functional configuration of the firewall identification unit 120 will be described.
The firewall specifying unit 120 includes a list generating unit 121, a conversion specifying unit 123, a relay specifying unit 125, and a specifying control unit 127.

The list generation unit 121 generates the address conversion list 122 using the address conversion table 181 for each firewall device.
Based on FIG. 7, the structure of the address translation list 122 will be described.
The address conversion list 122 associates firewall names, inner addresses, and outer addresses with each other.
The inside address and the outside address indicate addresses extracted from the address conversion table 181 for each firewall.
The firewall name indicates a name for identifying the firewall device corresponding to the address conversion table 181.

Returning to FIG. 6, the function of the conversion specifying unit 123 will be described.
The conversion specifying unit 123 uses the address conversion list 122 to specify a conversion firewall for each communication requirement 102.
Then, the conversion specifying unit 123 generates specific information 124 that is information about the specified conversion firewall.

An example of a conversion firewall is a first source firewall, a second source firewall, and a destination firewall.
The first transmission source firewall is a firewall device corresponding to the address conversion table 181 including the same address before conversion as the transmission source address indicated in the communication requirement 102 and the address after conversion associated with the address before conversion.
In FIG. 7, when the transmission source address indicated by the communication requirement 102 is x, the first transmission source firewall is FW1 whose inner address is x.
Here, the same pre-conversion address as the source address indicated in the communication requirement 102 is referred to as a first pre-conversion address, and the post-conversion address associated with the first pre-conversion address is referred to as a first post-conversion address.

The second source firewall is a firewall device corresponding to the address conversion table 181 including the same address as the first post-conversion address associated with the first pre-conversion address as the pre-conversion address.
In FIG. 7, when the first translated address is x ′, the second source firewall is FW 5 whose inner address is x ′.

The destination firewall is a firewall device corresponding to the address conversion table 181 including the same pre-conversion address as the destination address indicated in the communication requirement 102.
In FIG. 7, when the destination address indicated in the communication requirement 102 is y, the destination firewall is FW3 whose outside address is y.

  As shown in FIG. 7, the specific information 124 includes the firewall name of the conversion firewall (source firewall, destination firewall), the (source address, destination address) before conversion, and the (source address, destination address) after conversion. Indicates.

Returning to FIG. 6, the function of the relay identifying unit 125 will be described.
The relay specifying unit 125 uses the routing table 182 to specify a relay firewall for each communication requirement 102. Here, the conversion firewall is excluded from the target firewall device for specifying the relay firewall.
Then, the relay identification unit 125 generates identification information 126 that is information of the identified relay firewall.

The relay firewall is a firewall device corresponding to the routing table 182 that satisfies the following condition (1) or condition (2).
In condition (1), the routing table 182 indicates that the interface name associated with the same route address as the source address before translation by the translation firewall is associated with the same route address as the destination address before translation by the translation firewall. Is different.
In condition (2), the routing table 182 shows that the interface name associated with the same route address as the source address before translation by the translation firewall is associated with the same route address as the destination address before translation by the translation firewall. Is different.
The above condition is based on the fact that the interface corresponding to the source address and the interface corresponding to the destination address are different from each other in normal routing settings. Packets are not routed from the firewall device interface to the same interface.

In FIG. 8, as the specific information 124 indicates, the conversion firewalls are FW1, FW5, and FW3.
The (source address, destination address) before conversion by the conversion firewall and (source address, destination address) after conversion are (x, y), (x ′, y), (x ″, y). And (x ″, y ′).
In the routing table 182 of FW2, all the output interfaces associated with the addresses (x, y), (x ′, y), (x ″, y) and (x ″, y ′) are if1. It is. That is, in any case, the output interface associated with the source address is the same as the output interface associated with the destination address. Therefore, FW2 is not a relay firewall.
In the routing table 182 of FW4, the output interface associated with the transmission source address (x) of (x, y) is if1. On the other hand, the output interface associated with the destination address (y) of (x, y) is if2. That is, the output interface associated with the source address (x) is different from the output interface associated with the destination address (y). Therefore, FW4 is a relay firewall.

  As illustrated in FIG. 8, the specific information 126 indicates the firewall name of the relay firewall, (transmission source address, destination address) before conversion, and (transmission source address, destination address) after conversion.

Returning to FIG. 6, the function of the specific control unit 127 will be described.
The identification control unit 127 controls the list generation unit 121, the conversion identification unit 123, and the relay identification unit 125.
Further, the specific control unit 127 generates the specific information 103 using the specific information 124 and the specific information 126.
As illustrated in FIG. 9, the specific information 103 is information including specific information 124 and specific information 126. That is, the specific information 103 indicates the firewall names of the conversion firewall and the relay firewall, (transmission source address, destination address) before conversion, and (transmission source address, destination address) after conversion.

Returning to FIG. 1, the function of the entry generation unit 130 will be described.
The entry generation unit 130 generates an entry in which the action indicated in the communication requirement 102 is set as an entry to be registered in the access control list set in the conversion firewall indicated in the specific information 103.
Further, the entry generation unit 130 generates an entry in which the action indicated in the communication requirement 102 is set as an entry to be registered in the access control list set in the relay firewall indicated in the specific information 103.

For example, the entry generation unit 130 generates the following entry.
The entry generation unit 130 generates an entry in which the transmission source address indicated in the communication requirement 102 and the action indicated in the communication requirement 102 are set as an entry for the first transmission source firewall.
The entry generation unit 130 generates an entry in which the first post-translation address associated with the first pre-translation address and the action indicated in the communication requirement 102 are set as an entry for the second transmission source firewall. .
The entry generation unit 130 generates an entry in which the destination address indicated in the communication requirement 102 and the action indicated in the communication requirement 102 are set as an entry for the destination firewall.
The entry generation unit 130 generates an entry in which the source address before conversion by the conversion firewall, the destination address before conversion by the conversion firewall, and the action indicated in the communication requirement 102 are set as an entry for the relay firewall.

When a firewall device that converts each of a plurality of consecutive source addresses is identified as a conversion firewall, the entry generation unit 130 accepts a source group including a plurality of source addresses as an entry for the conversion firewall. Create an entry with the specified action.
When a firewall device that converts each of a plurality of consecutive destination addresses is identified as a conversion firewall, the entry generation unit 130 receives an action accepted as a destination group including a plurality of destination addresses as an entry for the conversion firewall. Create an entry with and set.

A functional configuration of the entry generation unit 130 will be described with reference to FIG.
The entry generation unit 130 includes an address replacement unit 131 and an entry aggregation unit 132.

The address replacement unit 131 generates each access control entry 104 of the firewall device indicated in the specific information 103 for each communication requirement 102.
As illustrated in FIG. 11, the access control entry 104 replaces (source address, destination address) indicated in the communication requirement 102 with (source address, destination address) before conversion indicated in the specific information 103. Generated.

Returning to FIG. 10, the function of the entry aggregation unit 132 will be described.
When a plurality of access control entries 104 in which at least one of a source address and a destination address is generated as an entry for one firewall device, the entry aggregating unit 132 sets the plurality of access control entries 104 as 1 Aggregate into one or more access control entries 104.
In FIG. 12, the FWx access control file 105 includes six access control entries 104.
In the upper three access control entries 104, the transmission source addresses (1.1.1.1 to 1.1.1.3) are continuous, and the information other than the transmission source address is the same. Similarly, in the lower three access control entries 104, the transmission source addresses are continuous, and information other than the transmission source addresses is the same.
Therefore, the six access control entries 104 are aggregated into two access control entries 104. In the two access control entries 104 after aggregation, the source address information indicates a source group including three source addresses from 1.1.1.1 to 1.1.1.3. .
Furthermore, in the two access control entries 104 after aggregation, destination addresses (2.2.2.1 to 2.2.2.2) are continuous, and information other than the destination address is the same.
Therefore, the two access control entries 104 after aggregation are aggregated into one access control entry 104. In one access control entry 104 after aggregation, the destination address information indicates a destination group including two destination addresses from 2.2.2.1 to 2.2.2.2.

Returning to FIG. 1, the function of the setting file acquisition unit 140 will be described.
The setting file acquisition unit 140 acquires a firewall setting file 180 for each firewall device.
For example, the setting file acquisition unit 140 communicates with each firewall device and acquires the firewall setting file 180 from each firewall device.
Further, the user may input the firewall setting file 180 for each firewall device into the firewall management apparatus 100, and the setting file acquisition unit 140 may acquire the input firewall setting file 180 for each firewall device.

The storage unit 190 stores data used, generated or input / output by the firewall management apparatus 100.
Examples of data stored in the storage unit 190 are a firewall setting file 180 for each firewall device, an access control file 105 for each firewall device, and a firewall management file 191.
The firewall device-specific access control file 105 is a file including one or a plurality of access control entries 104 generated for each firewall device.
The firewall management file 191 is a file for managing the firewall setting file 180 and the access control file 105 for each firewall device.

As shown in FIG. 13, the firewall management file 191 associates a firewall name, a setting file name, and a control file name with each other.
The setting file name is a name for identifying the firewall setting file 180.
The control file name is a name for identifying the access control file 105.

*** Explanation of operation ***
The operation of the firewall management apparatus 100 corresponds to a firewall management method. The firewall management method corresponds to the processing procedure of the firewall management program.

A firewall management method will be described with reference to FIG.
S110 is a requirement reception process.
In S110, the requirement data receiving unit 111 receives the requirement data 101 as shown in FIG.

S120 is a requirement division process.
In S <b> 120, when the requirement data 101 indicates a plurality of communication requirements 102, the requirement division unit 112 divides the requirement data 101 into a plurality of communication requirements 102.
That is, the requirement dividing unit 112 generates the communication requirement 102 for each combination of the transmission source address included in the transmission source group indicated by the requirement data 101 and the destination address included in the destination group indicated by the requirement data 101.
In FIG. 4, the requirement data 101 indicates a transmission source group including three transmission source addresses and a destination group including two destination addresses.
Therefore, the requirement division unit 112 generates six communication requirements 102 by combining three transmission source addresses and two destination addresses.

Based on FIG. 15, the requirement dividing process (S120) will be described.
In S121, the requirement division unit 112 determines whether the requirement data 101 includes the communication requirement 102 in which the source address information indicates the source group. In S121, the communication requirement 102 in which the information of the transmission source address indicates the transmission source group is referred to as a target communication requirement.
If there is a target communication requirement, the process proceeds to S122.
If there is no target communication requirement, the process proceeds to S123.

  In S122, the requirement dividing unit 112 divides the communication requirement 102 indicating the transmission source group into the communication requirement 102 for each transmission source address included in the transmission source group.

In S123, the requirement division unit 112 determines whether the requirement data 101 includes the communication requirement 102 whose destination address information indicates the destination group. In S123, the communication requirement 102 in which the destination address information indicates the destination group is referred to as a target communication requirement.
If there is a target communication requirement, the process proceeds to S124.
If there is no target communication requirement, the requirement division processing (S120) ends.

In S124, the requirement dividing unit 112 divides the communication requirement 102 indicating the destination group into communication requirements 102 for each destination address included in the destination group.
After S124, the requirement dividing process (S120) ends.

Returning to FIG. 14, the description will be continued from S130.
S130 is a communication requirement selection process.
In S <b> 130, the specific control unit 127 selects one unselected communication requirement 102 from the requirement data 101.

S140 is a firewall specifying process.
In S140, the firewall identifying unit 120 identifies the conversion firewall and the relay firewall using the selected communication requirement 102 and the firewall setting file 180 for each firewall.

Based on FIG. 16, the firewall specifying process (S140) will be described.
S141 is a conversion specifying process.
In S <b> 141, the conversion specifying unit 123 specifies a conversion firewall using the communication requirement 102 and the address conversion list 122.
Then, the conversion specifying unit 123 generates specific information 124 that is information about the specified conversion firewall.
The address conversion list 122 is generated in advance by the list generation unit 121.

The conversion specifying process (S141) will be described with reference to FIG.
S1411 is a transmission source address process.
In S1411, the conversion specifying unit 123 specifies a conversion firewall for the source address indicated in the communication requirement 102. The specified conversion firewall is the source firewall.

Based on FIG. 18, the source address processing (S1411) will be described.
In step S <b> 14111, the conversion specifying unit 123 searches the address conversion list 122 for the same inner address as the transmission source address indicated in the communication requirement 102. In S14111 to S14113, the same inner address as the source address indicated in the communication requirement 102 is referred to as a target inner address.
If there is a target inner address, the process proceeds to S14112.
If there is no target inner address, the source address processing (S1411) ends.

In step S1412, the conversion specifying unit 123 selects a firewall name associated with the target inner address from the address conversion list 122.
The firewall device identified by the selected firewall name is a conversion firewall.
In FIG. 7, the transmission source address indicated in the communication requirement 102 is x. The firewall name associated with the target inner address x is FW1. Therefore, the firewall device identified by FW1 is a conversion firewall.

In step S <b> 14113, the conversion specifying unit 123 selects an outer address associated with the target inner address from the address conversion list 122.
In FIG. 7, the outer address associated with the target inner address x is x ′.

In S14114, the conversion specifying unit 123 searches the address conversion list 122 for the same inner address as the selected outer address. In S14114 to S14116, the same inner address as the selected outer address is referred to as a target inner address.
If there is a target inner address, the process proceeds to S14115.
If there is no target inner address, the source address processing (S1411) ends.

In step S <b> 14115, the conversion specifying unit 123 selects a firewall name associated with the target inner address from the address conversion list 122.
The firewall device identified by the selected firewall name is a conversion firewall.
In FIG. 7, when the selected outer address is x ′, the firewall name associated with the target inner address x ′ is FW5. Therefore, the firewall device identified by FW5 is a conversion firewall.

In step S <b> 14116, the conversion specifying unit 123 selects the outer address associated with the target inner address from the address conversion list 122.
In FIG. 7, the outer address associated with the target inner address x ′ is x ″.
After S14116, the process returns to S14114.

Returning to FIG. 17, the description will be continued from S1412.
S1412 is a destination address process.
In step S1412, the conversion specifying unit 123 specifies a conversion firewall for the destination address indicated in the communication requirement 102. The specified conversion firewall is the destination firewall.

The destination address process (S1412) will be described based on FIG.
In step S <b> 14121, the conversion specifying unit 123 searches the address conversion list 122 for the same outer address as the destination address indicated in the communication requirement 102. In S14121 to S14123, the same outer address as the destination address indicated in the communication requirement 102 is referred to as a target outer address.
If there is a target outside address, the process proceeds to S14122.
If there is no target outside address, the destination address processing (S1412) ends.

In S14122, the conversion specifying unit 123 selects the firewall name associated with the target outside address from the address conversion list 122.
The firewall device identified by the selected firewall name is a conversion firewall.
In FIG. 7, the destination address indicated in the communication requirement 102 is y. The firewall name associated with the target outside address y is FW3. Therefore, the firewall device identified by FW3 is a conversion firewall.

In step S <b> 14123, the conversion specifying unit 123 selects the inner address associated with the target outer address from the address conversion list 122.
In FIG. 7, the inner address associated with the target outer address y is y ′.

In step S <b> 14124, the conversion specifying unit 123 searches the address conversion list 122 for the same outer address as the selected inner address. In S14124 to S14126, the same outer address as the selected inner address is referred to as a target outer address.
If there is a target outside address, the process proceeds to S14125.
If there is no target outside address, the destination address processing (S1412) ends.

In step S <b> 14125, the conversion specifying unit 123 selects a firewall name associated with the target outside address from the address conversion list 122.
The firewall device identified by the selected firewall name is a conversion firewall.

In S <b> 14126, the conversion specifying unit 123 selects an inner address associated with the target outer address from the address conversion list 122.
After S14126, the process returns to S14124.

Returning to FIG. 17, the description will be continued from S1413.
S1413 is a specific information generation process.
In S1413, the conversion specifying unit 123 generates specific information 124 that is information of the specified conversion firewall.
As shown in FIG. 7, the specific information 124 indicates the firewall names of the conversion firewalls FW1, FW5, and FW3, the (source address, destination address) before conversion, and the (source address, destination address) after conversion.

Returning to FIG. 16, the description will be continued from S142.
S142 is a relay identification process.
In S142, the relay identifying unit 125 identifies the relay firewall using the communication requirement 102, the identification information 124, and the firewall-specific routing table 182.
Then, the conversion specifying unit 123 generates specific information 126 that is information of the specified relay firewall.

Based on FIG. 20, the relay identification process (S142) will be described.
In S1421, the relay specifying unit 125 extracts the address set of the source address and the destination address from the specifying information 124.
In FIG. 8, four address sets (x, y), (x ′, y), (x ″, y) and (x ″, y ″) are extracted from the specific information 124.

In step S <b> 1422, the relay specifying unit 125 specifies relay firewall candidates.
The candidate for the relay firewall is a firewall device other than the conversion firewall.
When FW1, FW3, and FW5 are conversion firewalls among the five firewall devices FW1 to FW5, the candidate for the relay firewall is FW2 and FW4.

  In S1423, the relay identification unit 125 selects one unselected candidate from the relay firewall candidates.

  In S1424, the relay identifying unit 125 selects one unselected address set for the selected candidate.

In step S1425, the relay specifying unit 125 acquires the interface name associated with the transmission source address included in the selected address set from the selected candidate routing table 182.
Further, the relay specifying unit 125 acquires the interface name associated with the destination address included in the selected address set from the selected candidate routing table 182.
In FIG. 8, when the selected candidate is FW4 and the selected address set is (x, y), the acquired interface names are if1 and if2.

In step S1426, the relay identification unit 125 determines whether the acquired two interface names are different.
If the two acquired interface names are different, the process proceeds to S1427.
If the two acquired interface names are the same, the process proceeds to S1428.

In step S <b> 1427, the relay identification unit 125 registers the selected candidate information in the identification information 126 as relay firewall information.
As shown in FIG. 8, the specific information 126 indicates the firewall name of the relay firewall FW4, the (source address, destination address) before conversion, and the (source address, destination address) after conversion.
After S1427, the process proceeds to S1429.

In S1428, the relay identifying unit 125 determines whether there is an unselected address set that has not been selected for the selected candidate.
If there is an unselected address set, the process returns to S1424.
If there is no unselected address set, the process proceeds to S1429.

In S1429, the relay identifying unit 125 determines whether there is an unselected candidate.
If there is an unselected candidate, the process returns to S1423.
If there is no unselected candidate, the relay identification process (S142) ends.

Returning to FIG. 16, the description will be continued from S143.
S143 is a specific information generation process.
In S143, the specific control unit 127 generates the specific information 103 using the specific information 124 and the specific information 126.
As illustrated in FIG. 9, the specific information 103 is information including specific information 124 and specific information 126.

Returning to FIG. 14, the description will be continued from S150.
S150 is an entry generation process.
In S150, the address replacement unit 131 generates each access control entry 104 of the firewall device indicated by the specific information 103.
As illustrated in FIG. 11, the access control entry 104 replaces (source address, destination address) indicated in the communication requirement 102 with (source address, destination address) before conversion indicated in the specific information 103. Generated.

  The address replacement unit 131 registers the generated access control entry 104 in the access control file 105 for each firewall device.

In S160, the specific control unit 127 determines whether there is an unselected communication requirement 102.
If there is an unselected communication requirement 102, the process returns to S130.
If there is no unselected communication requirement 102, the process proceeds to S170.

In S <b> 170, when the access control file 105 for each firewall device includes a plurality of access control entries 104 in which at least one of the source address and the destination address is continuous, the entry aggregation unit 132 sets the plurality of access control entries 104. Aggregate into one or more access control entries 104.
After S170, the firewall management method processing ends.

The entry aggregation process (S170) will be described with reference to FIG.
In S171, the entry aggregating unit 132 selects one unselected access control file 105.

In S172, the entry aggregating unit 132 determines whether there are a plurality of access control entries 104 in which transmission source addresses are continuous and information other than the transmission source address matches. In S172 and S173, the plurality of access control entries 104 in which the transmission source addresses are continuous and the information other than the transmission source addresses match are referred to as a target entry group.
If there is a target entry group, the process proceeds to S173.
If there is no target entry group, the process proceeds to S174.

In S173, the entry aggregating unit 132 aggregates the target entry group into one access control entry 104 for each target entry group.
In FIG. 12, the FWx access control file 105 includes six access control entries 104.
In the upper three access control entries 104, the transmission source addresses (1.1.1.1 to 1.1.1.3) are continuous, and the information other than the transmission source address is the same. Similarly, in the lower three access control entries 104, the transmission source addresses are continuous, and information other than the transmission source addresses is the same.
Therefore, the six access control entries 104 are aggregated into two access control entries 104. In the two access control entries 104 after aggregation, the source address information indicates a source group including three source addresses from 1.1.1.1 to 1.1.1.3. .

In S174, the entry aggregating unit 132 determines whether there are a plurality of access control entries 104 in which destination addresses are continuous and information other than the destination addresses matches. In S174 and S175, a plurality of access control entries 104 in which destination addresses are continuous and information other than the destination addresses match are referred to as target entry groups.
If there is a target entry group, the process proceeds to S175.
If there is no target entry group, the process proceeds to S176.

In S175, the entry aggregating unit 132 aggregates the target entry group into one access control entry 104 for each target entry group.
In FIG. 12, in the two access control entries 104 after aggregation, destination addresses (2.2.2.1 to 2.2.2.2) are continuous, and information other than the destination addresses is the same.
Therefore, the two access control entries 104 after aggregation are aggregated into one access control entry 104. In one access control entry 104 after aggregation, the destination address information indicates a destination group including two destination addresses from 2.2.2.1 to 2.2.2.2.

In S176, the entry aggregation unit 132 determines whether there is an unselected access control file 105.
If there is an unselected access control file 105, the process returns to S171.
If there is no unselected access control file 105, the entry aggregation process (S170) ends.

*** Explanation of effects ***
The firewall management apparatus 100 relays the packet even if the address indicated by the communication requirement 102 of the requirement data 101 is not the address set in the terminal apparatus that communicates the packet but the address before being converted by the firewall apparatus. A firewall device can be identified.
Therefore, even if there are a plurality of firewall devices that relay packets, the firewall management device 100 can generate an entry of the access control list 183 necessary for each firewall device according to the communication requirement 102 of the requirement data 101. it can.

Embodiment 2. FIG.
A mode of dividing the aggregated access control entry 104 based on the past access control list 183 will be described with reference to FIGS. However, the description which overlaps with Embodiment 1 is abbreviate | omitted.

*** Explanation of configuration ***
A functional configuration of the firewall management apparatus 100 will be described with reference to FIG.
The firewall management apparatus 100 includes an entry division unit 150.
The storage unit 190 stores a past setting file 189 for each firewall device.
The past setting file 189 is a past firewall setting file 180.

The entry dividing unit 150 operates as follows when an entry in which at least one address group of a transmission source group and a destination group is set as an entry for the conversion firewall or the relay firewall.
The entry dividing unit 150 divides the generated entry into a plurality of entries by using the past access control list 183 that is the access control list 183 set in the conversion firewall.

The entry dividing unit 150 divides the generated entry into a plurality of entries as follows.
The entry dividing unit 150 extracts an address group included in the address group set in the generated entry from the address groups of the transmission source group and the destination group shown in the past access control list 183.
The entry dividing unit 150 divides the generated entry into an entry in which the extracted address group is set and an entry in which the remaining address groups are set among the address groups set in the generated entry.

In FIG. 23, the FWx access control file 105 includes one access control entry 104. In this access control entry 104, a transmission source group (1.1.1.1-100) is set.
Further, the past access control list 183 of FWx includes two address groups (1.1.1.1-10, 1.1.1.20-30). Both of these two address groups are included in the transmission source group set in the access control entry 104 of the access control file 105.
Therefore, the access control entry 104 of the access control file 105 is divided into four access control entries 104.
In the first and third access control entries 104, the address group (1.1.1.1-10, 1.1.1.20-30) of the access control list 183 is set as the source address information. Entry.
The second and fourth access control entries 104 are the remaining address groups (1.1.1.11-19, 1.1.1.31-100) of the transmission source group of the access control file 105. Is an entry set as information of a source address.

*** Explanation of operation ***
Based on FIG. 24 and FIG. 25, the entry division processing by the entry division unit 150 will be described.
In S181, the entry division unit 150 selects one unselected access control file 105. In the processing after S182, the firewall device corresponding to the selected access control file 105 is referred to as a target firewall device.

  In S <b> 182, the entry dividing unit 150 selects one unselected access control entry 104 that has not been selected for the selected access control file 105.

In S183-1, the entry division unit 150 determines whether a transmission source group is set in the selected access control entry 104.
If a transmission source group is set in the selected access control entry 104, the process proceeds to S183-2. In S183-2 and S183-3, the transmission source group set in the selected access control entry 104 is referred to as the transmission source group of the entry.
If the transmission source group is not set in the selected access control entry 104, the process proceeds to S184-1.

In S183-2, the entry division unit 150 extracts an address group included in the entry transmission source group from the past access control list 183 of the target firewall device.
In FIG. 23, when the transmission source group of the entry is 1.1.1.1-100, two address groups (1.1.1.1-10, 1.1.1) from the past access control list 183. 20-30) are extracted.

In S183-3, the entry dividing unit 150 divides the selected access control entry 104 into an entry in which the extracted address group is set and an entry in which the remaining transmission source group is set among the transmission source groups of the entry. To do.
In FIG. 23, the access control entry 104 of the access control file 105 is divided into four access control entries 104.
The first and third access control entries 104 are entries in which the extracted address groups (1.1.1.1-10, 1.1.1.20-30) are set as source address information. It is.
The second and fourth access control entries 104 are the remaining address groups (1.1.1.11-19, 1.1.1.31-100) of the transmission source group of the access control file 105. Is an entry set as information of a source address.

In step S184-1, the entry dividing unit 150 determines whether a destination group is set for the selected access control entry 104.
If a destination group is set for the selected access control entry 104, the process proceeds to S184-2. The destination group set in the selected access control entry 104 in S184-2 and S184-3 is referred to as the entry destination group.
If no destination group is set for the selected access control entry 104, the process proceeds to S185.

  In S184-2, the entry dividing unit 150 extracts an address group included in the entry destination group from the past access control list 183 of the target firewall device.

  In S184-3, the entry dividing unit 150 divides the selected access control entry 104 into an entry in which the extracted address group is set and an entry in which the remaining destination group of the entry destination groups is set.

In S185, the entry division unit 150 determines whether there is an unselected access control entry 104 that has not been selected for the selected access control file 105.
If there is an unselected access control entry 104, the process returns to S182.
If there is no unselected access control entry 104, the process proceeds to S186.

In step S186, the entry dividing unit 150 determines whether there is an unselected access control file 105.
If there is an unselected access control file 105, the process returns to S181.
If there is no unselected access control file 105, the entry division process ends.

*** Explanation of effects ***
The firewall management apparatus 100 can divide the generated access control entry 104 for each address group. Dividing the access control entry 104 for each address group means dividing the access control entry 104 for each role of a server group or a terminal group. This is because, in general, sequential addresses (address groups) are assigned to servers having the same role, and sequential addresses are also assigned to terminals having the same role. An example of a server group by role is a database server group, a Web server group, an authentication server group, a mail server group, a DNS server group, an NTP server group, a domain management server group, and a log management server group. An example of a group of terminals by role is a management terminal group and an office terminal group. DNS is an abbreviation for Domain Name Service, and NTP is an abbreviation for Network Time Protocol.
As a result, the operation of the firewall device is made more efficient, and it becomes easy to find a setting error in the access control entry 104 and an unnecessary access control entry 104.

Embodiment 3 FIG.
A form for verifying whether the generated access control entry 104 satisfies the communication requirement 102 of the requirement data 101 will be described with reference to FIGS. However, the description which overlaps with Embodiment 1 is abbreviate | omitted.

*** Explanation of configuration ***
Based on FIG. 26, the structure of the communication verification system 200 is demonstrated.
The communication verification system 200 includes a firewall management device 100, a test environment 210, and a communication monitoring device 220.

The test environment 210 includes a plurality of packet communication devices 211 and a plurality of firewall devices 212.
The packet communication apparatus 211 generates a packet 213 according to the test data 106 generated by the firewall management apparatus 100, and transmits the generated packet 213 to another packet communication apparatus 211 via the plurality of firewall apparatuses 212.
The firewall device 212 is set with the access control list 183 including the generated access control entry 104, determines whether the communication of the packet 213 is permitted according to the access control list 183, and relays the packet 213 that permits the communication.

The communication monitoring apparatus 220 captures the packet 213 flowing through the network 219 in the test environment 210 and generates test result data 221 indicating information of the captured packet 213.
That is, the test result data 221 indicates information on communication performed in the test environment 210 using the test data 106.

The firewall management apparatus 100 generates an access control entry 104 and test data 106 for each firewall apparatus 212.
Further, the firewall management apparatus 100 verifies whether the generated access control entry 104 satisfies the communication requirement 102 of the requirement data 101 using the test result data 221.

Based on FIG. 27, the functional configuration of the firewall management apparatus 100 will be described.
The firewall management apparatus 100 includes a past requirement selection unit 161, a test data generation unit 162, and an entry verification unit 163.
The storage unit 190 stores a plurality of past requirement files 170, test data 106, and verification result data 107.

The configuration of the past requirement file 170 will be described with reference to FIG.
The past requirement file 170 includes past requirement data 171, past test data 172, and past result data 173.
The past requirement data 171 is the past requirement data 101.
The past test data 172 is past test data 106.
The past result data 173 is past verification result data 107.

Returning to FIG. 27, functions of the past requirement selection unit 161, the test data generation unit 162, and the entry verification unit 163 will be described.
The past requirement selection unit 161 selects the past requirement file 170 from the plurality of past requirement files 170 using the transmission source address and the destination address indicated in the requirement data 101.

  The test data generation unit 162 generates the test data 106 to be used in the test environment 210 using the past test data 172 included in the selected past requirement file 170.

The entry verification unit 163 verifies the generated access control entry 104 using the test result data 221 and the past result data 173 included in the selected past requirement file 170.
Then, the entry verification unit 163 generates verification result data 107 indicating the verification result.

*** Explanation of operation ***
First, the past requirement selection process by the past requirement selection unit 161 will be described.
The past requirement selection unit 161 calculates the similarity between the accepted requirement data 101 and the past requirement data 171 included in the past requirement file 170 for each past requirement file 170.

For example, the past requirement selection unit 161 calculates the similarity between the requirement data 101 and the past requirement data 171 using the similarity table 192 as shown in FIG.
That is, the past requirement selection unit 161 compares the transmission source group indicated in the requirement data 101 with the transmission source group indicated in the past requirement data 171. Comparison of transmission source groups means comparison of information of transmission source addresses.
Further, the past requirement selection unit 161 compares the destination group indicated in the requirement data 101 with the destination group indicated in the past requirement data 171. Comparison of destination groups means comparison of information on destination addresses.
Then, the past requirement selection unit 161 acquires the similarity corresponding to the comparison result from the similarity table 192.

The past requirement selection unit 161 selects the past requirement file 170 based on the similarity for each past requirement file 170.
For example, the past requirement selection unit 161 selects the past requirement file 170 having the highest similarity.

Next, test data generation processing by the test data generation unit 162 will be described.
The test data generation unit 162 displays the past test data 172 included in the selected past requirement file 170 on the display device.
When the correction instruction for the displayed past test data 172 is input, the test data generation unit 162 generates the test data 106 by correcting the past test data 172 according to the correction instruction.

Finally, entry verification processing by the entry verification unit 163 will be described.
The entry verification unit 163 compares the test result data 221 with the past result data 173 included in the selected past requirement file 170.
Then, the entry verification unit 163 generates data indicating the comparison result as verification result data 107.
When the test result shown in the test result data 221 is the same as or similar to the test result shown in the past result data 173, if there is no problem in the actual environment after the past test, It is expected that there will be no problems even in the environment.
In this case, the access control entry 104 included in the access control file 105 for each firewall device 212 is considered to be a correct entry that satisfies the communication requirement 102 of the requirement data 101.

*** Explanation of effects ***
According to the third embodiment, it is possible to verify whether the access control entry 104 generated by the firewall management apparatus 100 satisfies the communication requirement 102.
As a result, even when the version of the firewall product or firewall program is changed and an implicit access control rule is added to the firewall device, an access control entry 104 that satisfies the communication requirement 102 can be generated so that a communication failure does not occur. it can.
An example of an implicit access control rule is as follows.
After transmitting the PING request, communication of a PING response that is reverse communication is permitted for a certain period of time.
Connections that have been idle for a certain time are disconnected.

A hardware configuration example of the firewall management apparatus 100 will be described with reference to FIG.
The firewall management apparatus 100 is a computer having hardware such as a processor 901, an auxiliary storage device 902, a memory 903, a communication device 904, an input interface 905, and an output interface 906.
The processor 901 is connected to other hardware via a signal line 910. The input interface 905 is connected to the input device 907 via a cable 911. The output interface 906 is connected to the output device 908 via the cable 912.

The processor 901 is an IC that performs processing, and controls other hardware. An example of the processor 901 is a CPU, DSP, or GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit, DSP is an abbreviation for Digital Signal Processor, and GPU is an abbreviation for Graphics Processing Unit.
The auxiliary storage device 902 stores data. An example of the auxiliary storage device 902 is a ROM, a flash memory, and an HDD. ROM is an abbreviation for Read Only Memory, and HDD is an abbreviation for Hard Disk Drive.
The memory 903 stores data. An example of the memory 903 is a RAM. RAM is an abbreviation for Random Access Memory.
The communication device 904 includes a receiver 9041 that receives data and a transmitter 9042 that transmits data. An example of the communication device 904 is a communication chip or a NIC. NIC is an abbreviation for Network Interface Card.
The input interface 905 is a port to which a cable 911 is connected, and an example of the port is a USB terminal. USB is an abbreviation for Universal Serial Bus.
The output interface 906 is a port to which the cable 912 is connected, and the USB terminal and the HDMI terminal are examples of ports. HDMI (registered trademark) is an abbreviation for High Definition Multimedia Interface.
The input device 907 inputs data, instructions and requests. An example of the input device 907 is a mouse, a keyboard, and a touch panel.
The output device 908 outputs data, results and responses. An example of the output device 908 is a display or a printer. An example of a display is an LCD. LCD is Liquid
Abbreviation for Crystal Display.

The auxiliary storage device 902 stores an OS. OS is an abbreviation for Operating System.
The auxiliary storage device 902 includes a requirement receiving unit 110, a firewall specifying unit 120, an entry generating unit 130, a setting file acquiring unit 140, an entry dividing unit 150, a past requirement selecting unit 161, a test data generating unit 162, and an entry verifying unit. A program for realizing the function of “unit” such as 163 is stored.
At least a part of the OS is loaded into the memory 903, and the processor 901 executes a program that realizes the function of “unit” while executing the OS. A program that realizes the function of “unit” is loaded into the memory 903, read into the processor 901, and executed by the processor 901.
The firewall management apparatus 100 may include a plurality of processors 901, and the plurality of processors 901 may execute a program that realizes the function of “unit” in cooperation with each other.

  Data, information, signal values, variable values, and the like indicating the processing result of “part” are stored in the memory 903, the auxiliary storage device 902, a register in the processor 901, or a cache memory in the processor 901.

The “part” may be implemented as “circuitry”. “Part” may be read as “circuit”, “process”, “procedure”, or “processing”.
“Circuit” and “circuitry” are concepts including a processing circuit such as the processor 901, logic IC, GA, ASIC, and FPGA. GA is an abbreviation for Gate Array, and ASIC is Application Specific Integrated.
Circuit is an abbreviation for FPGA, and FPGA is an abbreviation for Field-Programmable Gate Array.

Each embodiment is an example of a preferred embodiment and is not intended to limit the technical scope of the present invention. Each embodiment may be implemented partially or in combination with other embodiments.
The processing procedure described using the flowchart and the like is an example of the processing procedure of the firewall management apparatus, the firewall management method, and the firewall management program.

100 Firewall management device, 101 requirement data, 102 communication requirement, 103
Specific information, 104 Access control entry, 105 Access control file, 106 Test data, 107 Verification result data, 110 Requirement reception unit, 111 Requirement data reception unit, 112 Requirement division unit, 120 Firewall specification unit, 121 List generation unit, 122
Address translation list, 123 translation identification unit, 124 identification information, 125 relay identification unit, 126 identification information, 127 identification control unit, 130 entry generation unit, 131 address substitution unit, 132 entry aggregation unit, 140 setting file acquisition unit, 150 entry Dividing unit, 161 Past requirement selecting unit, 162 Test data generating unit, 163 Entry verification unit, 170
Past requirement file, 171 Past requirement data, 172 Past test data, 173 Past result data, 180 Firewall setting file, 181 Address conversion table, 182 Routing table, 183 Access control list, 189 Past setting file, 190 Storage unit, 191 Firewall management File, 192 similarity table, 200 communication verification system, 210 test environment, 211 packet communication device, 212 firewall device, 213 packet, 219 network, 220 communication monitoring device, 221 test result data, 901 processor, 902 auxiliary storage device, 903 Memory, 904 communication device, 9041 receiver, 9042 transmitter, 905 input interface, 906 output interface, 907 input device, 9 08 Output device, 910 signal line, 911 cable, 912 cable.

Claims (14)

A requirement receiving unit that receives a source address, a destination address, and an action indicating whether communication is possible;
When a packet in which an accepted source address and an accepted destination address are set is transmitted, at least one of the source address and the destination address set in the packet for relaying the packet A firewall identifying unit that identifies a converted firewall that is a firewall device that converts an address by using an address conversion table that is a table for each firewall device and associates an address before conversion and an address after conversion;
A firewall management apparatus comprising: an entry generation unit configured to generate an entry in which an accepted action is set as an entry to be registered in an access control list set in the specified conversion firewall. The firewall specifying unit includes a first source firewall that is a firewall device corresponding to an address conversion table including the same pre-conversion address as the accepted source address and a post-conversion address associated with the pre-conversion address; Each of the second source firewalls that are firewall devices corresponding to the address translation table including the same address as the post-translation address associated with the pre-translation address as the pre-translation address is identified as the translation firewall. The firewall management apparatus according to claim 1. The entry generation unit generates an entry in which an accepted source address and an accepted action are set as an entry for the first source firewall, and an entry for the second source firewall The firewall management apparatus according to claim 2, wherein an entry in which the post-translation address associated with the pre-translation address and the accepted action are set is generated. The firewall management apparatus according to claim 2, wherein the firewall specifying unit further specifies a destination firewall, which is a firewall apparatus corresponding to an address conversion table including the same pre-conversion address as the received destination address, as the conversion firewall. . The firewall management apparatus according to claim 4, wherein the entry generation unit generates an entry in which an accepted destination address and an accepted action are set as an entry for the destination firewall. The firewall specifying unit is a table for each firewall device, a relay firewall that is a firewall device that does not convert any of the source address and the destination address set in the packet to relay the packet. Identify using the routing table, which is a table that correlates route addresses and interface names,
The firewall management apparatus according to claim 1, wherein the entry generation unit generates an entry in which an accepted action is set as an entry to be registered in an access control list set in the identified relay firewall. The firewall specifying unit
The interface name associated with the same route address as the source address before translation by the translation firewall corresponds to a different routing table from the interface name associated with the same route address as the destination address before translation by the translation firewall. Firewall device to
The interface name associated with the same route address as the source address after translation by the translation firewall corresponds to a different routing table from the interface name associated with the same route address as the destination address after translation by the translation firewall. Firewall device to
The firewall management apparatus according to claim 6, which identifies the relay firewall as the relay firewall. The entry generation unit generates, as an entry for the relay firewall, an entry in which a source address before conversion by the conversion firewall, a destination address before conversion by the conversion firewall, and an accepted action are set. 8. The firewall management device according to 7. The requirement receiving unit receives a source group including a plurality of continuous source addresses, a destination group including a plurality of continuous destination addresses, and the action,
The firewall management device according to claim 1, wherein the firewall specifying unit specifies the conversion firewall for each combination of a source address included in the received source group and a destination address included in the received destination group. . The entry generation unit
When a firewall device that converts each of a plurality of consecutive source addresses is identified as the conversion firewall, an action accepted as a source group including the plurality of source addresses as an entry for the conversion firewall Create an entry with
When a firewall device that converts each of a plurality of consecutive destination addresses is specified as the conversion firewall, a destination group including the plurality of destination addresses and an accepted action are set as an entry for the conversion firewall. The firewall management apparatus according to claim 1, wherein the entry is generated. When an entry in which at least one of the source group and the destination group is set as an entry for the conversion firewall is generated, the past is an access control list set in the conversion firewall. The firewall management apparatus according to claim 10, further comprising an entry dividing unit that divides the generated entry into a plurality of entries by using an access control list. The entry dividing unit includes:
An address group included in the address group set in the generated entry is extracted from each address group of the transmission source group and the destination group shown in the past access control list,
The firewall management according to claim 11, wherein the generated entry is divided into an entry in which the extracted address group is set and an entry in which the remaining address group among the address groups set in the generated entry is set. apparatus. Select a past requirement file from a plurality of past requirement files that include the source address, destination address, past test data, and past test result data, using the accepted source address and accepted destination address. A past requirement selection unit,
A test data generation unit that generates test data to be used in a test environment including a firewall device in which an access control list including the generated entry is set, using past test data included in the selected past requirement file; Using the generated test data, the test result data indicating information of communication performed in the test environment and the past test result data included in the selected past requirement file are used to create a generated entry. The firewall management apparatus according to any one of claims 1 to 12, further comprising an entry verification unit for verification. A requirement receiving process for receiving a source address, a destination address, and an action indicating whether communication is possible;
When a packet in which an accepted source address and an accepted destination address are set is transmitted, at least one of the source address and the destination address set in the packet for relaying the packet A firewall specifying process for specifying a conversion firewall, which is a firewall device that converts addresses, by using an address conversion table that is a table for each firewall device and associates an address before conversion and an address after conversion;
A firewall management program for causing a computer to execute entry generation processing for generating an entry in which an accepted action is set as an entry to be registered in an access control list set in a specified conversion firewall.

Images