## 3 The Proposed Firewall on an FPGA
The latency of the firewall, i.e., the delay introduced between the time an Ethernet frame is received at the input port and the time the same Ethernet frame is transmitted at the output port, can be estimated as follows: \[T_{FIREWALL}=T_{SFP\ to\ AXI}+T_{RX\ to\ FW\_OUT}+T_{FW\_OUT\ to\ FW\_COMPLETED}+T_{CW\_UPDATE}+T_{TX\_DECISION}+T_{AXI\ to\ SSP}\] (1) where \(T_{SFP\_{P\_{P\_{\_}{\{\}{\}{\}{\}{\}{\}{\}{\}{\}{\}{\}{\}{\}{\}{\}{\{\}{\}{\}{\}{\}{\}{\}{\{\}{\}{\}{\}{\}{\{\}{\}{\}{\}{\}{\}{\{\}{\}{\}{\}{\}{\{\}{\}{\}{\}{\}{\}{\{\}{\}{\}{\}{{\}{\}{\}{\}{\}{\{\}{\}{\}{\}{\{\}{\}{\}{the delay introduced by the operation to check the compliance of a packet with the firewall rules is of 18 clock cycles), \(T_{\text{C}NU\text{ }UPDATE}=8\) ns (since the delay introduced by the update of the Control memory by the 'RX control' module is of 1 clock cycle), \(T_{\text{TX }Decision}=56\) ns (since the delay introduced by the 'TX control' module to check the packet STATUS BYTE and to send the packet to in the 'AXI 1G/2.5G Ethernet Subsystem' module is of 7 clock cycles) and \(T_{\text{AXI }to\text{ }SPP}=211\) ns (as reported in the 'AXI 1G/2.5G Ethernet Subsystem' product guide [45]). Thus, \(T_{\text{F}IREWALL}=627\) ns. Figure 3: Flow chart of the steps for the packet processing in the firewall. The steps carried out by the ‘RX control’ module are presented in blue. The steps carried out by the ‘Packet analysis’ module are presented in red. The steps carried out by the ‘Check firewall rules’ module are presented in yellow. The steps carried out by the ‘TX control’ module are presented in green. The waveforms of the signals obtained with a simulation of the designed firewall hardware are shown in Figure 4. In particular, in the considered time period, two Ethernet frames are received at Port A, which include a TCP packet and a UDP packet. The packet data (PORT_A_RX_DATA[7:0]) are received when the enable signal (PORT_A_RX_DV) is set, and the last byte of the packet is transferred in the clock cycle when PORT_A_RX_LAST is set. The two packets are stored in the Data memory at the addresses (DADDR_IN[13:0]) between 0 and 59 for the first packet, and at the addresses between 60 and 119 for the second packet. The control word for the first packet is stored in the Control memory at the address (CADDR_IN[9:0]) 0, while the second packet control word is stored at Control memory Address 1. The received packets are analyzed and their most important identification fields are determined: the MAC destination address (MAC_DEST[47:0]), the MAC source address (MAC_SOURCE[47:0]), the network layer protocol (LEV3_PROTOCOL[15:0]), the IP source address (IP_SOURCE[31:0]), the IP destination address (IP_DEST[31:0]), the transport layer protocol (LEV4_PROTOCOL[7:0]), the source port (SOURCE_PORT[15:0]) and the destination port (DEST_PORT[15:0]). In particular, the first received packet can be identified as a TCP packet since it is characterized by a network layer protocol of 0800h and a transport layer protocol of 6, while the second received packet can be identified as a UDP packet since it is characterized by a network layer protocol of 0800h and a transport layer protocol of 17. Both received packets are checked against the firewall rules that are loaded in the 'Firewall rules memory' during the device initialization. The results of the rules verification steps are valid when the signal FW_COMPLETED is set. In particular, for both packets, FW_RESULT[1:0] = 3, and this means that the packets comply with the firewall rules and can be transmitted to Port B. For both packets, it is also TX_PCK_LENGTH[15:0] = 60 and this indicates that the packet size is 60 bytes. Figure 4 also shows the waveforms of the signals during the transmission of the first packet at Port B.