There is not much enough details about SDN-based firewalls so I've been searching about that and lately I saw this post. In fact, some papers use both terms
flow policy and
firewall policy without giving a distinction between them to the reader witch confuses me a bit. After a long research, I've come up with the following distinction that I would like to discuss it with this community:
Firewall policies are usually installed proactively by the network operator. In contrast, flow policies are installed reactively by the controller after receiving a Packet-In message from the OpenFlow-based switch to handle the new flow. As a result, the controller create a new flow rule to be installed in the OpenFlow-nased switch and install a new flow policy in the firewall (If no violation occurs).
I'd like to discuss with you about my finding if it is reasonable or not. If not, kindly give us an explanation.