Agent Enforcement on the Solaris 10 Platform
On the Solaris 10 platform, the Secure Workload agent uses IPFilter utilities to enforce network policies. By default, after the agent is enabled on the host, the agent controls and programs the IPv4 filter table. Solaris 10 supports IPv6 enforcement.
IPFilter
The IPFilter package on Solaris 10 is used to provide firewall services and is available on Solaris 10 as a kernel expansion pack. It loads as a kernel extension module, /usr/lib/drivers/ipf. It includes ipf, ippool, ipfstat, ipmon, ipfs, and ipnat utilities that are used to program ipfilter rules and each of these rules specifies the match criteria for a packet.
When enforcement is enabled, the agent uses IPFilter to program the IPv4 filter table that contains rules for allowing or dropping of IPv4 packets. The agent groups these rules to categorize and manage the policies using the controller. These rules include Secure Workload rules that are derived from the policies and rules that are generated by the agent.
When an agent receives platform-independent rules, it parses and converts them into ipfilter or ippool rules and inserts these rules into the filter table. After programming the firewall, the enforcement agent monitors the firewall for any rule or policy deviation and if so, reprograms the firewall. The agent keeps track of the policies that are programmed in the firewall and reports their status periodically to the Enforcement FrontEnd (EFE).
A typical policy in a platform-independent network policy message consists of:
source set id: "test-set-1"
destination set id: "test-set-2"
source ports: 20-30
destination ports: 40-50
ip protocol: TCP
action: ALLOW
...
set_id: "test-set-1"
ip_addr: 1.2.0.0
prefix_length: 16
address_family: IPv4
set_id: "test-set-2"
ip_addr: 5.6.0.0
prefix_length: 16
address_family: IPv4
Along with other information, the agent processes the policy and converts it into platform-specific ippool and ipfilter rule:
table role = ipf type = tree number = 51400
{ 1.2.0.0/16; };
table role = ipf type = tree number = 75966
{ 5.6.0.0/16; };
pass in quick proto tcp from pool/51400 port 20:30 to pool/75966 port 40:50 flags S/SA group TA_INPUT
pass out quick proto tcp from pool/75966 port 40:50 to pool/51400 port 20:30 flags A/A group TA_OUTPUT
Caveats
Host Firewall Backup
When enforcement is enabled for the first time in an Agent Config Profile, the agents running on Solaris 10 hosts, before taking control of the host firewall, store the current content of ippool and ipfilter into /opt/cisco/tetration/backup. Successive disable or enable transitions of enforcement configuration do not generate backups. The directory is not removed upon agent uninstallation.