Abstract:
Firewall system for interconnecting a first IP network ( 10 ) to a second IP network ( 16 ), these networks belonging to two different entities having each a different administration wherein any data packet transmitted/received by the first IP network is filtered by using a first firewall function and any data packet transmitted/received by the second IP network is filtered by using a second firewall function. The system comprises essentially a single firewall device ( 20 ) including filtering means ( 41, 43 ) performing both first firewall function and second firewall function, a console port ( 37 ) enabling the administrator in charge of each IP network to enter filtering rules for updating the associated firewall function and control means ( 39, 47, 49 ) interconnecting the console port and the filtering means for transmitting thereto the filtering rules so that each administrator may independently manage the system from the console port.

Description:
TECHNICAL FIELD  
         [0001]    The present invention relates generally to the firewall mechanisms which are used to connect together two data transmission networks such as Intranet networks belonging to two different entities such as two different companies having each a specific administrative control, and relates in particular to a firewall system for interconnecting two IP networks managed by two different administrators.  
         BACKGROUND  
         [0002]    Many techniques for network security are using today a firewall, which is generally known as a combination of hardware and software used to implement a security policy governing network traffic between two or more networks, some of which may be private as being under administrative control of a customer or network provider (e.g., organizational networks) and some of which may not be under administrative control (e.g., the Internet) also called a public network. A network firewall commonly serves as a primary line of defense against external threats to an organization&#39;s computer systems, networks, and critical information. Firewalls can also be used to partition networks or isolate/interconnect VPNs.  
           [0003]    Using other words, a Firewall is a system designed to prevent unauthorized access to or from a private network. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially Intranets but can also be used between two Intranets. All messages entering or leaving the Intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria. They may also be used to interconnect private networks managed by two different administrative entities. In that case, generally, two firewalls are cascaded with an intermediate link called DMZ, each one managed by a different administrative authority.  
           [0004]    The firewalls achieve various decision-making processes and principally the packet filtering consisting in looking at each packet entering or leaving the associated network and accepting or rejecting this packet based on user-defined rules. However, other security-related functions can be implemented in a firewall such as an application gateway applying a security mechanism to specific applications such as FTP and Telnet servers, circuit-level gateway applying a security mechanism when a TCP or UDP connection is established and a proxy server which enables to establish a connection on behalf of a client between the proxy server and destination device.  
           [0005]    In addition to these security-related functions, firewalls can also perform routing functions that are associated with the network being protected and that are conventionally associated with a separate/individual router. Routing is the process of deciding the disposition of each packet that a routing device handles. This applies to incoming packets, outbound packets leaving a network for external destinations, and packets being routed among internal networks. Ultimately, there can be only two possibilities for the packets: forward or discard. The routing mechanism based upon a routing table takes the decision by using the destination IP address in the packet header.  
           [0006]    A routing configuration that reflects the network topology is generally used so that the firewall is able to deliver legitimate packets to their desired destinations. A firewall routing table contains a list of IP network addresses for which the firewall is intended to provide routing services. If the lookup of the routing table is successful for a packet, the table provides either the address of the next router to send the packet or the interface to be used for sending the packet out. If the table lookup fails, the packet is discarded and an ICMP “unreachable” message is generally returned to the source indicating that the packet was undeliverable.  
           [0007]    However, the routing mechanism being too dynamic and unreliable, it cannot be used to implement security policy. It is why a security technique called stateful inspection or dynamic packet filtering is often used. Whereas the classical packet filtering is based only on the header information on each individual packet without considering any prior packets, the stateful inspection filtering allows both complex combinations of payload (message content) and context established by prior packets to influence filtering decisions. As with packet filtering, stateful inspection is implemented as an “add-on” to routing. The principle motivation for stateful inspection is a compromise between performance and security. As a routing “add-on,” stateful inspection provides much better performance than the proxies. It also provides an increase in the level of firewall function beyond simple packet filtering. Like proxies, much more complex access control criteria can be specified and like packet filtering, stateful inspection depends on a high quality (i.e. correct) underlying routing implementation.  
           [0008]    But, in any case, two physically different firewalls are implemented one after the other in an interconnection between Intranet networks because each network is administratively managed by a different organization that wants to have a dedicated administrative access to the firewall for defining rules and taking logs. Some of the rules are common but are run twice which decrease the overall system performance. The cost and the complexity are high, and the reliability is lower because two serial equipments are used. Configuration is more complex because there is an additional link between the two firewalls.  
         SUMMARY OF THE INVENTION  
         [0009]    Accordingly, the main object of the invention is to replace the classical firewall system including two physically different firewalls in series by a firewall system including a single firewall device for interconnecting two IP networks belonging to two different entities managed by two different administrations.  
           [0010]    The invention relates therefore to a firewall system for interconnecting a first IP network to a second IP network, these networks belonging to two different entities having each a different administration wherein any data packet transmitted or received by the first IP network is filtered by using a first firewall function and any data packet transmitted or received by the second IP network is filtered by using a second firewall function. The system comprises essentially a single firewall device including filtering means performing both first firewall function and second firewall function, a console port enabling the administrator in charge of administrating each IP network to enter filtering rules for updating the associated firewall function and control means interconnecting the console port and the filtering means for transmitting thereto the filtering rules so that each administrator may independently manage the system from the console port. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0011]    The above and other objects, features and advantages of the invention will be better understood by reading the following more particular description of the invention in conjunction with the accompanying drawings wherein:  
         [0012]    [0012]FIG. 1 is a block-diagram of a prior system including two firewalls for interconnecting two IP networks belonging to two different entities having two different administrators.  
         [0013]    [0013]FIG. 2 is a block-diagram of the same system as the one illustrated in FIG. 1 but wherein the two firewalls have been replaced by a single firewall according to the invention.  
         [0014]    [0014]FIG. 3 is a block-diagram representing the functional blocks of a firewall device.  
         [0015]    [0015]FIG. 4A and 4B are block-diagrams representing respectively the functional blocks of a firewall system according to the invention for the data path from the first network to the second network and for the data path from the second network to the first network.  
         [0016]    [0016]FIG. 5 is a schematic diagram representing the method achieving the rule merging. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0017]    [0017]FIG. 1 shows a classical system where two networks NET 1   10  and NET 2   16  belonging to two different administrative entities, such as different companies, are securely interconnected via a complex firewall system comprising a first firewall FW 1   12  and a second firewall FW 2   14 . The administrative owner, referenced as MG 1   11  of NET  1 , manages FW 1  while the network owner MG 2   17  of NET 2  manages FW 2 . A LAN  15  interconnects FW 1  and FW 2  which is, in this example, a demilitarized zone DMZ  15  shared by the two companies. Common servers may be implemented in this zone such as a web server SR  18 . Both companies may use such a server. Such a zone is also called community of interest COI.  
         [0018]    The system illustrated in FIG. 1 is costly and adds an overhead in the path since the firewall processing is run twice. Furthermore, any failure on one of the two firewalls stops the traffic. These drawbacks are overcome by the Firewall system according to the invention illustrated in FIG. 2 wherein the two firewalls FW 1  and FW 2  are replaced by a single physical device FW  20  which can also provide a locally demilitarized zone to connect an external shared server such as SR  18 . The single firewall  20  allows MG 1   11  and MG 2   17  to manage respectively their logical firewall part within the dual firewall system.  
         [0019]    In such a system, no visibility to the configuration on one side is provided to the administrator of the other side but the rules that can be aggregated allow optimizing the performance of the solution. Therefore the cost of such implementation will be lower and the reliability better.  
         [0020]    A standard firewall with its functional blocks is represented in FIG. 3. Note that a firewall is normally divided into two devices which are functionally identical for the two data paths except for the stateful inspection mechanism which includes an additional control flow between the transmit and receive sides. Insofar as the functional blocks are the same for the two data paths, only the firewall device controlling the data path outputting from the NET 1  is represented in FIG. 3.  
         [0021]    The functional blocks of the firewall include in the transmission order from NET 1   10  to DMZ  15  as an example, a first Network Address Translation (NAT) function NATin  30 , which is optional insofar as NAT is necessary only if there is a mapping rule for changing the source IP address, and which forwards data to a second block called FILTin  31 . The latter function performs the filtering on the input interface and forwards granted packets to IPgw  35 , which is the forwarding engine of the firewall. It can take routing decision based on the routing defined by the routing control point RCP  34 . RCP maintains the routes with its peer routing devices and updates the forwarding table of the IP gateway  35 . Based on these rules, a packet may be sent to an integrated function, such as an application proxy PXY  36  or a server entity SRV  38  for authentication, encryption or other service module like DHCP service. It may also be sent to RCP if the packet is a routing update message. Otherwise, the main path is to forward the packet to the output interface. In that case, the packet has again to path through two blocks: a first filtering block for output packets FILTout  33  followed by a second NAT function NATout  32 . This second NAT is active only if there is a mapping rule for changing the destination IP address. Then, the packet is sent out of the firewall, into the DMZ  15  in the example. The need for output filtering and NAT is mainly for packets modified in the proxy and servers for which the input rules are irrelevant. These blocks should exist even if the NAT functions are not used.  
         [0022]    In the filtering block  31 , filtering rules determine whether or not a packet will be allowed through IP Filtering, into the kernel&#39;s TCP/IP routines or out onto the network. The Access List based Static filtering filters the packets using statically configured filters based on the following fields:  
         [0023]    Range of Source and Destination addresses  
         [0024]    Protocol Type (e.g. TCP, UDP, ICMP, IGMP, RSVP, OSPF, IGP, EGP, NVP)  
         [0025]    Source and Destination Port numbers  
         [0026]    TOS (Type of Service) field  
         [0027]    IP Options  
         [0028]    IP Fragmentation  
         [0029]    ICMP type and code  
         [0030]    Ack and Rst bit of TCP  
         [0031]    For IP Accounting, input and output rules can be also separately setup, recording the number of bytes that pass through. Each time a rule match occurs, the byte count of the packet is added to the rule (allowing for cascading statistics to be collected). IP accounting data may be kept either from filtering module or from IP Gateway module IPgw  35 . Raw data is given to control block CTRL  39  that gathers it for providing it to the administrative entity. IP routing in IPgw  35  is a option that allows to forward packets according to routing rules defined in the routing control point RCP. Server  38  and proxy  36  support may also be included.  
         [0032]    Other functions may be integrated in server  38  or proxy  36  such as the IP Authentication function. In that case, packets which are authenticated, are only passed through the firewall loops once to prevent double-processing.  
         [0033]    Encryption such as IPsec tunneling is a function very often used in a firewall. As it is not possible to scan an encrypted tunnel, the decrypted packet coming from the encryption module will have to path through the output filtering function and therefore will be scanned.  
         [0034]    It must be noted that control block CTRL 1   39 , administrating the firewall performs user (administrator of the firewall) authentication, configuration, log, statistics and problem determination so it has a link to any of the internal functional blocks (the links are not shown on the drawing as being not functional paths but only control means). The access to the firewall for administration can be always done through CONSOLE PORT  37 . The configuration may allow as well access to control CTRL  39  from NET 1  or DMZ sides even if the latter is not recommended for security reasons.  
         [0035]    According to the invention, a single firewall device illustrated in FIG. 4A and 4B replaces the two classical cascaded firewalls. As explained hereafter, the functional blocks are the same as in a classical firewall but they are not duplicated in two firewalls. In reference to FIG. 4A representing the firewall for data path from NET 1  to NET 2 , the first and last functions are the network address translation in blocks NATin 1   30  and NATout 2   42 . The associated rules may be needed between the input interface and the internal DMZ or between the DMZ and the output interface or both. The rules require the following parameters:  
         [0036]    Original Source, Original Destination, Original Service referring to the source and destination address and service of the packet before translation and Translated Source, Translated Destination, Translated Service referring to those parameters after translation.  
         [0037]    A type of translation parameter (for example SNAT as static NAT, DNAT as Dynamic NAT, MASQUERADING also called Port address translation).  
         [0038]    The administrator of the locally attached network only manages NAT on its local interface. So only one input NAT NATin 1   30  is implemented on NET 1  side and managed by the NET 1  administrator while the output NAT NATout 2   42  is interfacing NET 2  and managed by the NET 2  administrator.  
         [0039]    As in a classical firewall, an essential function is the filtering, as already mentioned in reference to FIG. 3, achieved in the block FILTin 12   41 . Some rules are associated with this function, such as Sequence Number Hardening rules, Stateful Inspection rules, Time-Sensitive Rules, Static Filtering Rules Per logical firewall split between input and output filtering blocks. Insofar as the data packets can be processed by further functions in a server or a proxy as already mentioned, another filtering block FILTout 12   43  is necessary before NATout 2   42 . The function of the output block is the same as the function of the block FILTin 12  located at the input.  
         [0040]    Importing/Exporting routing Rules are also defined for all packets but set by each administrator on the corresponding IP gateway also called Virtual routing and forwarding engine referenced as IPgw 1   35  and IPgw 2   45  located between blocks FILTin 12   41  and FILTout 12   42 . Each gateway gets the forwarding rules thanks to a dedicated Routing Control Point RCP 1   34  and RCP 2   44  respectively managing and advertising the routes for IPgw 1  and IPgw 2 . The administrators must exchange some information for providing route advertisement between these two gateways but no common block is required for that in a design using two different gateways. An optional design based on a single shared IP gateway is feasible when no routing visibility constraint exist between the two external networks NET 1  and NET 2  or if the IP gateway can be managed by only one of the administrator, the other one advertising its network routes thanks to an external router to the internal IP gateway and associated Routing Control Point.  
         [0041]    IP accounting information, gathered by one administrative entity from functional blocks such as NAT  30  and  42 , FILTERING blocks  41  and  43 , and IP gateways  35  and  45 , is stored in dedicated control block either CTRL 1   39  or CTRL 2   49 . Global statistics of the aggregated traffic are stored in COMMON CTRL  47 .  
         [0042]    Other dedicated administrative functions such as Email Notification, network management and Password security are managed separately in CTRL 1   39  and CTRL 2   49 . Original firewall configuration from each administrator is also kept in the respective control block. The security and integrity of each part of the configuration are achieved thanks to certified configuration (certificates) that allows reducing to a single equipment this dual entity without security issue.  
         [0043]    The existing dedicated proxy such as PXY 1   36  and PXY 2   46 , and server functions such as SRV 1   38  and SRV 2   48  continue to be dedicated in the proposed design being each attached to the corresponding IPgateway block respectively IPgw 1   35  and IPgw 2   45 .  
         [0044]    The connection from IPgw 1  to IPgw 2  may be considered as the remaining DMZ and may provide an external connection for external servers such as SR  18 .  
         [0045]    [0045]FIG. 4B shows the flow for traffic from NET 2   16  to NET 1   10 . Most of the functional blocks are common with the opposite flow described in FIG. 4A since they are the same blocks as for legacy simple firewalls.  
         [0046]    The main differences concern blocks NATin 2   42 ′ and block FILTin 21   43 ′ on NET 2  side and blocks NATout 1   30 ′ and block FILTout 21   41 ′ on NET 1  side.  
         [0047]    NATin 2   42 ′ has a strong relationship with NATout 2   42  since, as soon one NAT mapping is defined in one of the two blocks, the reverse mapping has to be activated on the other block as a swap back function. Similarly NATout 1   30 ′ and NATin 1   30  have the same link between them.  
         [0048]    FILTin 21  and FILTout 12  have no relationship except for stateful inspection rules insofar as one flow identified on one side will be granted on the other side. This means that dynamic rules are added on both blocks thanks to the stateful inspection function as done for legacy firewalls. The same stateful link may be implemented between FILTout  21  and FILTin 12 .  
         [0049]    Referring again to FIG. 4A and 4B, an essential feature of the invention is the MERGE block  40  used to merge the rules. Before explaining the merging process, it is useful to mention that the filtering mechanism of a firewall applies the rules in a sequence mode by using a list of rules. If the incoming packet matches the first rule, it exits the filtering block and is forwarded to the next firewall functional block. If not, the second rule is applied and so on. Normally it should match a rule. For security reason, the last rule applied is an implicit rule to deny all the unmatched messages. The unmatched messages are messages which have not matched a rule before the end of the rule sequence. As the last rule is most often a “deny all”, a packet arriving at this last rule is discarded. In a dual firewall mechanism according to the invention, it is therefore essential to merge the rules so as to apply a reduced number of rules.  
         [0050]    The merging process is done independently for FILTin 12  or FILTout 12 . Thanks to this mechanism, the dual administrated Firewall can check for redundant rules from each administrator in order to optimize the performance. No one of the two administrators may gain access to the result of the merging in order to protect the rules knowledge but the administrator of each side can identify that his rules have been correctly implemented thanks to the identification of the merging done rule by rule.  
         [0051]    In a classical system, the cascade of two firewalls means that on each direction output rules on one firewall are followed by input rules on the second firewall. This is no longer the case with the proposed rules merging function since most of the filtering rules can be run once in a simplified model integrating the two logical firewalls as it will be explained with more details hereafter.  
         [0052]    Two sets of logs are built and managed by CTRL 1  and CTRL 2  insofar as each rule even after merging is identified with its parent rule from each side. Each administrator may define each information, rule or file as common or local so that some logs or alarms for example may be shared. In that case, the control is given to the common control Block COMMON CTRL  47  which handles all common features, files and services. The Common features include the Configuration Interface used by both administrators to set each new configuration from each side, the Activity Viewer which shows in real time the traffic from NET 1  to NET 2  including the DMZ activity, the Logging mechanism of alerts and events that defines to which block CTRL 1 , CTRL 2  or COMMON CTRL the events have to be stored, the hardware management for installation and problem determination and the user authentication interface as a common mechanism required to identify administrators of each logical firewall entity on login request coming from CONSOLE PORT  37  or interfaces with NET 1  or NET 2 .  
         [0053]    For comparison, a legacy firewall includes as control block what is in CTRL 1  and COMMON CONTROL except that in such case, identification to which logical firewall the user belongs is not necessary and logging of traffic information does not have to be define since only one set of log files is available.  
         [0054]    An administrator may allow or not the access to the other side of the firewall administration on its direct access interface. On a legacy firewall, the administration using for example telnet is feasible from any interface. Of course, the administrator can lock some ports such as the public network interface. On a dual firewall, the administrator of each side manages this authorization and therefore the access using other ports or interfaces than the one dedicated to its network may be locked. This means that the port lock cannot be done at the protocol level, for example authorizing telnet or not on a port, because the administrator of one side wants to keep this protocol access on an interface for himself but not for the administrator of the other side. A more complex filtering mechanism using an external authentication server such as TACACS or RADIUS is recommended to securely authenticate the user and its rights to one side or the other of the dual firewall. If there is a need to allow administration from the different interfaces, the authentication servers of the two administrative entities should be linked together to allow forwarding of the authentication to the appropriate server.  
         [0055]    In reference to FIG. 5, a merger function using  2  input configuration files  50  and  51  has to be considered. The merger function has to take into account the rules that can be fully merged or partially merged and the order to apply them against the remaining set of rules. It is based on a tree per configuration that allows a new common tree to be built and then leaf merged.  
         [0056]    The remaining merged set of rules becomes the applied common set of rules. Whether this configuration file is visible to both administrative entities or visible to only one or none of them depends on the agreement between companies.  
         [0057]    In order to explain how rules can be merged, it is necessary to detail how, in a standard firewall, the filtering rules are built with the same structure for defining them which looks like the following set of fields by rule: “Action”, “ProtocolType”, “@sourceA”, “@destinationB”, “PortNumber”, “Options”.  
         [0058]    The fields value or content may be as an example:  
         [0059]    “Action” is Permit or Deny  
         [0060]    “Protocol Type” defines the protocol on which this rule is applied (i.e. IP,TCP,UDP . . . )  
         [0061]    “@sourceA” describes the Source IP address of IP Datagram  
         [0062]    “@destinationB” describes the Destination IP address of IP Datagram  
         [0063]    “PortNumber” defines the specific port number related of the chosen protocol  
         [0064]    “Options” defines the additional parameters which can be set to create rules more precise (i.e. Tos, Dscp, . . . )  
         [0065]    In the firewall system according to the invention the two administrators can define the filtering rules. To know which administrator has defined the rules an implicit Tag is added in the rule structure.  
         [0066]    This tag is coded with 3 bits and has 5 different states:  
         [0067]    “0” coded “000”: describes that this rule has been defined in CTRL 1   39 ,  
         [0068]    “1” coded “001”: describes that this rule has been defined in CTRL 2   49 ,  
         [0069]    “2” coded “010”: describes that this rule has been defined in CTRL 1   39  and in CTRL 2   49 ,  
         [0070]    “3” coded “011”: describes that the rule defined in CTRL 2   49  includes the rule defined in CTRL 1   39 ,  
         [0071]    “4” coded “100”: describes that the rule defined in CTRL 1   39  includes the rule defined in CTRL 2   49 .  
         [0072]    In order to separate action logs (for debugging purpose) by Control Block CTRL 1   39  and CTRL 2   49  and using a secure way, a point of reference makes the correspondence between the Tag Number and at which Control Block the rule is referring to:  
         [0073]    Tag Value=0 then Control Block of reference is CTRL 1   39 ,  
         [0074]    Tag Value=1 then Control Block of reference is CTRL 2   49 ,  
         [0075]    Tag Value=2 then Control Blocks of reference are CTRL 1   39  and CTRL 2   49 ,  
         [0076]    Tag Value=3 then Control Block of reference is CTRL 2   49 ,  
         [0077]    Tag Value=4 then Control Block of reference is CTRL 1   39 .  
         [0078]    The first step is to compare a rule from the configuration file CF 1   50  (defined through CTRL 1   39 ) with rules from the configuration file CF 2   51  (defined through CTRL 2   49 ) in order to check whether a CF 1  rule can be merged with one of the CF 2  rules. When a rule processing is completed, the next rule from CF 1  is put in the merging process block  40 .  
         [0079]    The checking process for identifying a possible merge is done in step  52 . The comparison is done against the 5 fields of a rule as mentioned above. The minimum requirements to merge two rules are to have the same Action, the same Protocol and the same Port number if present plus Source Addresses overlapping and/or Destination Addresses overlapping.  
         [0080]    If these requirements are met then the rules can be merged and the checking process  52  forwards the corresponding rules to the checking process  53 .  
         [0081]    If one requirement is missing, then the rules cannot be merged and then the checking process  52  forwards the rules to the process  56 .  
         [0082]    The process  56  modifies the rule 1  and rule 2  by adding the appropriate TAG values (0 for rule 1  and 1 for rule 2 ) and put the two rules in the rule config file  60 . The corresponding rule 2  with TAG=0 is kept in CF 2  rules config file  51  as it can be merged with a next CF 1  rule. In that case the TAG value in COMMON RULE CONFIG  60  may be overwritten  
         [0083]    When a merge is possible, the step  53  checks if the two rules (rule 1  and rule 2 ) are the same. If Yes, this process sends only the rule 1  to the process  57 , which modifies the rule 1  by adding the TAG value 2 and put it in the rule config file  60 . If the rule 1  and rule 2  are in some aspect different then the two rules are forwarded to step  54 .  
         [0084]    Step  54  checks if rule 1  is included in term of Source/Destination addresses in rule 2 .  
         [0085]    If yes, the process  54  sends rule 1  to the process  58  which modifies rule 1  by adding the tag value 3, and sends it in the rule config file  60 . If rule 1  is not included in rule 2  then the two rules are forwarded to step  55 . Step  55  reversely checks if rule 2  is included in term of Source/Destination addresses in rule 1 .  
         [0086]    If yes, the process of step  55  sends rule 2  to step  59  which modifies the rule by adding the tag value 4 and put it in the rule config file  60  If the rule 2  is not included in rule 1  then the two rules are re-forwarded to the checking process  52 , which knows that these rules have been already checked, and then send them to the process of step  56 , as they cannot be merged in an improved way.  
         [0087]    Note that the Rule inclusion is different whether the rule is a DENY or PERMIT rule.  
         [0088]    A PERMIT rule A is included into another permit rule B if subnet space—source or destination—of the former is larger than the one of the latter. The most restrictive one in terms of addressing space is kept: rule B.  
         [0089]    A DENY rule A is included into another deny rule B if subnet space—source or destination—of the former is smaller than the one of the latter. The most restrictive one is kept: rule B.  
         [0090]    When two rules match, the checking with the remaining part of the list is stopped. An improved merging process with more than one pass is possible. It may be recommended when the number of rules is very important. It that case, multiple inclusion of rules may be used.  
         [0091]    The merging process will be better understood with the following example wherein the list of CF 1  rules and the list of CF 2  rules are as follows:  
         [0092]    CF 1  list of rules  
                                                                   Permit   TTCP   172.20.0.0   192.0.0.0   23           Permit   ICMP   any   any           Deny   IP   192.168.10.0   192.168.20.0                      
 
         [0093]    CF 2  list of rules  
                                                                   Permit   ICMP   172.0.0.0   192.168.0.0               Permit   TCP   any   any   23           Permit   UDP   172.0.0.0   192.0.0.0                      
 
         [0094]    The first CF 1  rule is compared to CF 2  rule  1 :  
         [0095]    The protocol types are not the same then these rules cannot be merged.  
         [0096]    The first CF 1  rule is compared to CF 2  rule  2 :  
         [0097]    The CF 1  rule  1  is included in CF 2  rule  2 , then these rules can be merged: CF 1  Rule  1  is kept.  
         [0098]    The second CF 1  rule is compared to CF 2  rule  1   
         [0099]    The CF 2  rule  1  is included in CF 1  rule  2 , then these rules can be merged: CF 2  Rule  1  is kept.  
         [0100]    The third CF 1  rule is compared to CF 2  rule  1   
         [0101]    The Action fields are not the same then these rules cannot be merged.  
         [0102]    The third CF 1  rule is compared to CF 2  rule  2   
         [0103]    The Action fields are not the same then these rules cannot be merged.  
         [0104]    The third CF 1  rule is compared to CF 2  rule  3   
         [0105]    The Action fields are not the same then these rules cannot be merged.  
         [0106]    In this example, the common configuration file CF 12  got after rules comparison and merging is the following:  
                                                               Permit   TCP   172.20.0.0   192.0.0.0           Permit   ICMP   172.0.0.0   192.168.0.0           Deny   IP   192.168.10.0   192.168.20.0           Permit   UDP   172.0.0.0   192.0.0.0