29. Firewall

The Firewall area reads firewall rule sets - from a live connection or an imported configuration file - analyses them (shadowed, redundant, unused and risky rules, compliance mapping), proposes fixes, proves which fixes do not change any traffic decision, and can push an approved plan back to the device with an automatic rollback if the device does not come back as expected.

Permissions:

29.1 Supported firewalls#

An imported firewall is analysed and optimised in the same way; the change is delivered as a downloadable script or full configuration that you load on the device yourself.

29.2 The devices list#

Path: Firewall. The page title is Firewalls.

The Devices table: Name, Vendor, Connection, Status (offline file, unreachable, reachable, not read yet), Last read, Version, Drift ("matches baseline" or "drifted from baseline"), Rules, Risk. Click a row to open the device.

Below it: Connect a firewall and Import a configuration.

Procedure: connect a live firewall#

Permission: Manage firewall. Four-eyes: no (reading changes nothing).

Use a dedicated read-and-write account on the firewall for Lawliet, not a personal one.

1. Open Firewall and go to Connect a firewall.
2. Choose the Vendor. For a Linux host choose Linux host (iptables / nftables through the Lawliet agent).
3. Fill Name, Host, Port (the default is shown), Username and Password (or API key for API-based vendors). For a Linux host give the Agent id and the Backend (iptables, nftables or auto) instead.
4. Fill the vendor-specific fields when shown:

5. Press Connect, test and read.

What you see: "Saving the connection...", "Testing the connection...", "Reading the policy...", then the device opens on its Policy tab.

"SSH devices record their host key on first use; compare it with the device console before applying." Do that check before the first apply.

If it fails: the error names the step. Typical causes: wrong port or credentials, the firewall does not allow management access from the Lawliet server's address, or an untrusted certificate. A failed connection is removed again.

Procedure: import a configuration file#

1. Go to Import a configuration.
2. Choose the Export file (at most 20 MB).
3. Leave Vendor on Detect from the file, or choose it.
4. Give a Name and press Import.

What you see: the device opens on its Policy tab, Status "offline file".

Procedure: test the connection and read the policy again#

Permission: Manage firewall. Four-eyes: no. Risk: none; both only read from the device.

1. Open Firewall and click the device. The header shows the connection, its state (reachable, unreachable, not read yet), the current version and the baseline.
2. Press Test connection. The line under the header says "Reachable" (with the host key for SSH devices) or "Not reachable: <reason>".
3. Press Read now (it shows Working...). The line says one of: "Read: a new version was saved.", "Read: no change since the last version." or "Read: the policy differs from the approved baseline."

Read now is also on each live device's row in the devices list. An imported file has no connection, so neither button is shown; import the new export instead (29.2).

If it fails: "Not reachable: ..." names the cause (address, port, credentials, certificate, or management access not allowed from the Lawliet server).

Removing a device#

The console has no button to remove a firewall in this release. To stop Lawliet using a live device, do this instead:

1. Open the device, tab Monitor, and press Stop monitoring, so no scheduled read runs.
2. On the firewall itself, disable or delete the account you created for Lawliet. Lawliet can then no longer read or change the device.
3. The device stays in the list as a record, with its versions and plans.

29.3 The device tabs#

29.4 Findings#

The header line says "N findings over R rules in S section(s)" and where the hit counts came from. Without hit counts, no rule is called unused.

Lines not understood lists configuration lines the parser did not understand. They are kept and written back on export, but rules among them are not checked.

Compliance mapping maps the findings to PCI-DSS v4.0, NIST SP 800-53, CIS Controls v8 or ISO/IEC 27001 (choose in Framework).

29.5 Procedure: make an optimisation plan#

Permission: Manage firewall. Four-eyes: no (a plan is a new version in Lawliet, not a change on the device).

1. Open the device and the Optimise tab. The badge shows "N fixes, M safe".

2. Tick Disable rules instead of deleting them if you prefer disabling (easier to undo by hand).

3. Either press Plan all M safe fixes, or tick fixes and press Plan the N chosen fixes. Choose the safe ones ticks the safe set; Clear unticks all.

   "Safe" fixes are proven not to change any traffic decision before the plan is saved. A fix marked as changing behaviour ("Applying this fix changes what the firewall lets through") is never in the safe set; choose it only after checking with the rule owner.

4. Wait for "Planning and proving...". The plan view shows the Change script, the Full configuration and the diff (Changed, Objects).

Next: apply it (29.6), or download it from Export and load it yourself.

29.6 Procedure: apply a plan to the firewall (four-eyes)#

Permission: Push firewall policy. Four-eyes: yes.

Risk: this changes what the firewall lets through. A wrong change can cut traffic, including management access.

Rollback: built in. Each apply runs these steps, shown live in Steps:

1. Backup - read the running policy (and the vendor's own backup where it has one).
2. Arm rollback - set up a restore that does not depend on Lawliet's connection surviving (a scheduled restore on the device, commit confirmed, or an agent-side timer).
3. Change - push the plan.
4. Verify - reconnect, read the policy back, and check it now means what was approved.
5. Confirm - disarm the rollback.

If Lawliet cannot reconnect and confirm within the Rollback window, the armed rollback fires on the device by itself.

Procedure:

1. Open the device and the Apply tab. Choose the Plan.

2. Read "Target: <name> (<address>) through <SSH / API / the Lawliet agent>." and the plan.

3. Choose the Rollback window: 2, 3, 5 or 10 min. Use a longer window for slow devices.

4. Press Request apply. Type the reason and Send for approval.

   What you see: "Four-eyes request #N: pending", "Waiting for a second person to approve."

5. The approver opens the same tab (or Approvals), reads the plan, optionally writes a Comment, and presses Approve or Reject.

6. The requester presses Run the approved apply.

   What you see: "Approved apply started." The steps appear one by one; the status ends applied, failed or rolled back.

If it fails:

29.7 Versions, baseline and export#

Versions lists every version (Version, Source, Summary, Rules, When). Versions are never deleted: every read, import and plan stays.

Procedure: compare two versions#

Permission: View firewall.

1. Open the device, tab Versions. "Tick two versions to compare them."
2. Tick the two versions (Compare v<N> on each row).
3. Read the diff "Diff v<A> to v<B>": Removed, Added, Moved, Changed, Objects - or "The two versions are the same."

Procedure: set the baseline#

Permission: Manage firewall. Four-eyes: no. Risk: none on the device; it changes what Lawliet calls drift.

1. Open the device, tab Versions.
2. On the version that is the approved state, press Set as baseline. The row is marked baseline.
3. What you see: from now on the devices list and the device header show "drifted from baseline" when a later read differs from it. To move the baseline, press Set as baseline on another version.

Procedure: export a configuration or a plan#

Permission: View firewall. Nothing is changed on the device.

1. Open the device, tab Export.
2. To save the current policy in the vendor's own syntax, press Download <vendor> configuration under Current version v<N>. Lines the parser did not understand are written back as they were.
3. To save a plan, find it in the table (Plan, Status, Changes, Created) and press one of: script (only the change commands), full config (the whole optimised configuration) or model JSON (the policy model).
4. The file downloads to your computer. Load a script or full configuration on the device by your own change procedure (this is the route for import-only firewalls).

"No plans yet: make one on the Optimise tab." means no plan exists; see 29.5.

29.8 Monitoring and hit counts#

Procedure: start or stop live monitoring#

Permission: Manage firewall. Four-eyes: no. Risk: each scheduled read logs in to the device and reads its policy; choose an interval the device's management plane can carry.

1. Open the connected device, tab Monitor.
2. Choose the interval (1, 5, 15, 60 or 240 min) and press Start monitoring. The tab then says "Read every N min" and shows Busiest rules and Events, refreshing by itself.
3. To end it, press Stop monitoring. The tab says "Scheduled reads are off".

Procedure: count hits from logs#

For firewalls whose counters cannot be read. Each firewall log line collected in Logs names the rule that decided it. Permission: Manage firewall. Four-eyes: no. Nothing is changed on the device.

1. Collect the firewall's logs first (a syslog source, chapter 30).
2. Open the device, tab Monitor, section for hit counts from logs.
3. Choose the Log sources, the Host the firewall logs as, and Days.
4. Press Count from logs (it shows Counting...).
5. What you see: the Hits column on the Policy tab and the Findings are worked out from the counts. Only rules that log can be counted; the rest stay unknown and are never called unused. When the device has its own counters, those win.

To stop using a device altogether, see "Removing a device" in 29.2.