2

I'm trying to figure out what is the difference between ACLs, Firewall and static rules in FloodLight OpenFlow controller.

Having look at https://floodlight.atlassian.net/wiki/display/floodlightcontroller/Floodlight+REST+API, there are 3 different things I can do about the controller. I can define ACLs, Firewall rules and static entries.

I have a network background and I know that basically ACL = firewall. Now, coming to the OpenFlow and SDN world, it's hard for me to understand the difference between the 3 of them. Can somebody please explain it?

Improve this question
2
  • Not knowing FL personally, but having glanced at the doc you refer to, it seems that the FL firewall works in reactive mode (network sends packet to controller, controller decides whether or not it is allowed) while ACL works in proactive mode (controller programs flows on network device that tell it what to allow/deny), and ACL is actually implemented by creating static flow entries.
    – hertitu
    Commented Dec 11, 2016 at 12:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 16:00

3 Answers 3

Reset to default
1

The difference between an ACL and a firewall is keyword stateful. A firewall keeps a state table whereas a basic ACL simply filters based on layer 3/4 properties. In a router, firewall functionality has been called Context based acccess control, CBAC. There are also reflexive ACL's. We now have NGFW's with deepest packet inspection (application aware firewalls).

Static Entries

when a packet reaches an OpenFlow switch without a matching flow. The packet is sent to the controller, which evaluates it, adds the appropriate entries, and lets the switch continue its forwarding. Alternatively, entries can be inserted proactively by the controller in switches before packets arrive.

Improve this answer
1
  • It's still hard for me to spot the differences.
    – yak
    Commented Dec 15, 2016 at 14:18
0

From a networking point of view:

ACL - a filter based on either source or destination IP address or port/ protcol. ACLs should never be used in place of a firewall at your network edge.

Firewall - same as above but more intelligent, depending on type can be based on application and behavior, session type etc. They can be staeful and application aware.

Static rules - if I understand your context correctly you're referring to "static firewall rules" which would be more like ACLs i.e. block/allow traffic dependent on IP/port source/destination.

Hope this helps,

Paul

Improve this answer
0

To add to the first two responses the Floodlight FW is a dynamic packet-filter, installing reactive rules onto a switch.

It is dynamic in that it responds to packets arriving at the controller and selecting appropriate rules based on the ACL held by the controller (or controller FW app). Rules are then installed on the switch.

Static or pro-active rules in contrast are pre-installed on the switch. No need to refer to the controller.

Neither approach however copes with tracking flow state. Identifying the start of a flow is easy (SYN packet gives it away), sending a remove rule message after seeing, for example, the TCP final handshake of two FINS and two ACKs, is somewhat more difficult. Consequently the Floodlight FW leaves the hole open until a timeout occurs. This gives opportunity for an attacker to maintain the hole.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.