# Misconfiguration in Firewalls and Network Access Controls: Literature Review
## 3 Misconfigurations
### Shadowing  
In a firewall rule list, Reference [3] states that \"A rule is shadowed when a previous rule matches all the packets that match this rule, such that the shadowed rule will never be activated\". A more generic rule with a wide scope is preventing the activation of a second rule with a more narrow scope. This definition, or one very similar to it, is present in every paper discussing the topic of rule shadowing. This definition is fairly generic, and we can see that some authors add one key condition. The author [13] gives the additional condition that the two rules must have different actions, if the shadowed rule is an allow, the shadowing rule must be a deny and vice versa. This distinction is important as it is what differentiates shadowing from other misconfigurations. With this definition, we can now observe exactly how this misconfiguration occurs. Traditionally in firewalls, rules are enforced in the order they occur in the list of rules. Shadowing will occur when a rule higher in the list completely overlaps a rule lower in the list. This makes rule ordering something to take into careful consideration [15]. When you have a rule with a scope that is entirely contained in another rule, shadowing may occur depending on which order they occur in. Having the correct rules makes no difference if they are in the wrong order. Some firewalls have an option to add a numbered priority onto rules to set the order in which they are enforced. An example of a firewall with this implementation would be the firewall in Google Cloud Platform. Instead of relying on the order in which the rules are written, the rule with a higher priority can potentially shadow a rule with lesser priority. In a firewall that enforces rules on a numbered priority system, rule order is completely irrelevant. In this case, take care to assign the correct priorities and know how the firewall handles rules with the same priority. An IDS/IPS such as Snort can suffer from these issues as well, but the reason they occur is different. Reference [39] lays out that rule priority inside of Snort is determined by the action associated with the rule such as log, alert, pass, etc. Shadowing occurs in Snort when one rule has a scope that encompasses a second rule and has a higher-priority action. While action taken has no impact on the order of rule enforcement in a firewall, an action in Snort can only shadow an action of lower priority. For example, an alert rule \begin{table}
\begin{tabular}{c c} \hline \hline Shadowing & [1–52] \\ \hline Correlation & [1–52; 24; 31; 4; 5; 6; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 27; 28; 31; 32; 33; 34; 35; 36; 37; 38; 39; 40; 41; 42; 43; 44; 45; 46; 47; 48; 49; 50; 51; 52] \\ \hline Redundancy & [1–22; 24; 25; 27; 28; 31; 37; 38; 39; 40; 41; 42; 43; 44; 45; 46; 47; 48; 49; 50; 52] \\ \hline Generalization & [1–5; 7; 12; 14; 15; 16; 17; 18; 19; 22; 24; 25; 27–29; 31; 33; 34; 38; 39; 43; 44; 46; 50; 52] \\ \hline Irrelevance & [2,7; 9; 11; 16; 18; 19; 21; 22; 24; 30; 31; 40; 43; 46; 50] \\ \hline Flowbit & [39] \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Types of Misconfigurations covered in literature. in Snort cannot shadow a pass rule, but a pass rule can shadow an alert rule. Due to the higher priority of the pass action, a pass rule will always be evaluated before an alert rule. In the event that a packet matches two or more rules with the same action, every matching rule will be triggered. For instance, if an incoming packet meets the criteria for multiple log rules, each of those rules' alerts will be logged. This trend will continue with the other misconfigurations listed in this SLR, Snort suffers from the same potential misconfigurations, but they occur for slightly different reasons. Shadowing does not only occur when one rule completely encompasses another rule. The authors of [27] list a different kind of shadowing that they call total shadowing.