## 3 The Proposed Firewall on an FPGA
The 'Packet analysis' module is implemented as a combinational circuit (zero clock cycles latency) and calculates a set of parameters, such as the MAC source and destination addresses, the IP source and destination addresses and the source and destination ports. The packet parameters are then used by the 'Check firewall rules' module to decide on the compliance of the packet with the firewall rules. 6. A 'Check firewall rules' module, designed using the Verilog HDL. This module checks if the packet parameters comply with the firewall rules stored in the 'Firewall rules memory' and sends its decision to the 'RX control' module with the 2-bit data FW_RESULT[1:0] (that indicate if the packet can be considered safe or not) and the 3-bit data FW_PCK_TYPE[2:0] (that indicate the protocol of the processed packet). Both FW_RESULT[1:0] and FW_PCK_TYPE[2:0] are valid when the signal FW_COMPLETED is set. 7. A 'Firewall rules memory' module that instantiates a dual-port SRAM using the block memory inside the FPGA, i.e., with the Xilinx IP module 'Block memory generator' [46]. This memory has a size of 7 kB and features 256 words of 224 bits each. Each 224-bit word stores a single firewall rule. Each port of the memory features an address bus (8-bit), a data bus (224-bit) and a write enable (WE) signal that is set during a write operation. The firewall rules are written in the memory during the initialization by the 'UART controller' module and are read by the 'Check firewall rules' module during the packet processing step. 8. A 'TX control' module, designed using the Verilog HDL. This module is interfaced with the Data memory and Control memory and checks the status of the packet before a decision is made if the packet must be transmitted to the output port or must be blocked. The packets that are allowed to pass the firewall are sent to the 'AXI 1G/2.5G Ethernet Subsystem' module using the same 8-bit AXI communication protocol of the 'RX control' module. The operations of the packet processing in the firewall are presented in the flow-chart of Figure 3, while the waveforms of the signals obtained with a simulation in the Vivado design suite are presented in Figure 4. The packet processing steps in Figure 3 are not carried out sequentially, but the operations are pipelined to minimize the firewall latency (i.e., the delay between the packet reception at the input port and the packet transmission at the output port) and maximize the data throughput. The packet reception is carried out as long as the Data memory occupation (MEM\({}_{\text{used}}\) in Figure 3) is lower than 12 kB, i.e., after the processing of one packet is completed the value of MEM\({}_{\text{used}}\) is checked (step R7 in Figure 3). When Data memory occupation exceeds 12 kB, the firewall stops receiving packets until the Data memory occupation falls below 5 kB (step R8 in Figure 3). The operations of packet reception and subsequent analysis, as presented in Figure 3, can be summarized as follows:  
1. When the Xilinx IP module 'AXI 1G/2.5G Ethernet Subsystem' receives an Ethernet frame from the fiber optic cable connected to the SFP/SFP+ connector, it handles the physical layer of the Ethernet frame, checks the correctness of the frame check sequence (FCS) field and transmits the packet (of length n bytes) to the FPGA logic using AXI bus protocol. The latency associated with this operation (Step R1 in Figure 3) can be estimated from the module datasheet as \(T_{SFP_{1}\_{AXI}}=200\) ns [45]. 2. When the module 'RX control' receives the packet, it stores the packet data in the Data memory from address i to address i + n - 1 (Step R2 in Figure 3) and updates the content of Control memory, by setting the control word at address j with STATUS BYTE = 0 h, PACKET START ADDRESS = i and PACKET LENGTH = n (Step R3 in Figure 3). The value of Data memory occupation is then increased (Step R4 in Figure 3) and the address of the Data memory and Control memory is updated (Step R5 in Figure 3). Concurrently, it sends the packet data to the 'Packet analysis' module.