Firewall policy and Flow policy in SDN

Question

There is not much enough details about SDN-based firewalls so I've been searching about that and lately I saw this post. In fact, some papers use both terms flow policy and firewall policy without giving a distinction between them to the reader witch confuses me a bit. After a long research, I've come up with the following distinction that I would like to discuss it with this community:

Firewall policies are usually installed proactively by the network operator. In contrast, flow policies are installed reactively by the controller after receiving a Packet-In message from the OpenFlow-based switch to handle the new flow. As a result, the controller create a new flow rule to be installed in the OpenFlow-nased switch and install a new flow policy in the firewall (If no violation occurs).

I'd like to discuss with you about my finding if it is reasonable or not. If not, kindly give us an explanation.

Thank you.

Answer 1

Most of the networking terms we use -- "firewall", "switch","SDN","IDS",etc., are made up by equipment manufacturers as they introduce new products, and are gradually accepted by the community. There is no technical or authoritative definition for any of them.

The distinction you make is fine as far as it goes, but don't expect everyone to follow along, especially if some company has a something that they call a firewall that reacts to in-packet messages. There will always be attempts to blur or combine distinctions.

Answer 2

I have recently spent a good amount of time to differentiate the keywords used in security enforcement in SDN firewalls. Unfortunately, there exists no standard to back these definitions. However, I could narrow the scope of there meanings:

Flow: A sequence of packets traversing a network that share a set of header-field values. Eg.- A flow can consist of all packets with same source and destination IP headers.

Flow Policy: An Openflow switch consists of flow table consisting of rules(also called flows) defining the flows in the network. These rules constitute the flow policy of the network. Eg.- One or many rules in a flowtable of OpenFlow switch.

Firewall Policy: These are the management level security constraints. It consists of different firewall rules (allow/deny). Identifies the characteristics of a packet and accordingly applies some actions. It is different from the traditional firewall rule: Stateful, bidirectional, dynamic. Also, unlike flow policy, this is centrally defined and enforced at the controller.

Eg.- Traffic from Client C to server S should go through a middle box M Eg.- * For a specified switch, block all the traffic from host 10.1.2.2 - 00:00:00:02:00:00 BLOCK srcip=10.1.2.2 *