Research on abnormal traffic diagnosis based on deployment mode of firewall

摘要

The firewall based on quintuple for access control plays a very basic and vital role in network security protection, but the diversified firewall deployment mode also brings challenges to the network configuration: unreasonable network configuration may cause that the network traffic is interrupted, and when the interruption occurs, it is impossible to find the cause of the interruption if only analyzing the switching and routing involved in the network configuration. This article first analyzed the forwarding characteristics of traffic passing through the firewall, then proposed four types of firewall traffic forwarding models. No matter how the firewall deployment mode changes, the way of the traffic passes through the firewall must belong to one of the four models. This article further analyzed the four types of forwarding models based on the characteristics of firewalls, and found that three of them can cause abnormal firewall traffic. For this reason, this article proposed an algorithm for diagnosing abnormal models, and provided a solution based on network technology and firewall characteristics.