I'm trying to figure out what is the difference between ACLs, Firewall and static rules in FloodLight OpenFlow controller.

Having look at https://floodlight.atlassian.net/wiki/display/floodlightcontroller/Floodlight+REST+API, there are 3 different things I can do about the controller. I can define ACLs, Firewall rules and static entries.

I have a network background and I know that basically ACL = firewall. Now, coming to the OpenFlow and SDN world, it's hard for me to understand the difference between the 3 of them. Can somebody please explain it?

  • Not knowing FL personally, but having glanced at the doc you refer to, it seems that the FL firewall works in reactive mode (network sends packet to controller, controller decides whether or not it is allowed) while ACL works in proactive mode (controller programs flows on network device that tell it what to allow/deny), and ACL is actually implemented by creating static flow entries. – hertitu Dec 11 '16 at 12:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 16:00

The difference between an ACL and a firewall is keyword stateful. A firewall keeps a state table whereas a basic ACL simply filters based on layer 3/4 properties. In a router, firewall functionality has been called Context based acccess control, CBAC. There are also reflexive ACL's. We now have NGFW's with deepest packet inspection (application aware firewalls).

Static Entries

when a packet reaches an OpenFlow switch without a matching flow. The packet is sent to the controller, which evaluates it, adds the appropriate entries, and lets the switch continue its forwarding. Alternatively, entries can be inserted proactively by the controller in switches before packets arrive.

  • It's still hard for me to spot the differences. – yak Dec 15 '16 at 14:18

From a networking point of view:

ACL - a filter based on either source or destination IP address or port/ protcol. ACLs should never be used in place of a firewall at your network edge.

Firewall - same as above but more intelligent, depending on type can be based on application and behavior, session type etc. They can be staeful and application aware.

Static rules - if I understand your context correctly you're referring to "static firewall rules" which would be more like ACLs i.e. block/allow traffic dependent on IP/port source/destination.

Hope this helps,



To add to the first two responses the Floodlight FW is a dynamic packet-filter, installing reactive rules onto a switch.

It is dynamic in that it responds to packets arriving at the controller and selecting appropriate rules based on the ACL held by the controller (or controller FW app). Rules are then installed on the switch.

Static or pro-active rules in contrast are pre-installed on the switch. No need to refer to the controller.

Neither approach however copes with tracking flow state. Identifying the start of a flow is easy (SYN packet gives it away), sending a remove rule message after seeing, for example, the TCP final handshake of two FINS and two ACKs, is somewhat more difficult. Consequently the Floodlight FW leaves the hole open until a timeout occurs. This gives opportunity for an attacker to maintain the hole.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.