Lion Cipher Lab
Compare a firewall's effective zone reachability with the intended policy
- Cyber / Security Engineer
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Firewall designs are usually drawn as zones: the internet, a DMZ for public services, an application tier, a database tier, a management network, guest Wi-Fi, and a short list of which zone may reach which on which port. The rule set that implements that drawing grows over years, one change ticket at a time, and nobody re-checks that the two still agree. NIST SP 800-41 recommends a deny-by-default policy that permits only the traffic that is needed, and NIST SP 800-53 control SC-7 (Boundary Protection) expects connections between network segments to be controlled to match policy. The failure…
What you'll learn
- evaluating a first-match rule list the way the firewall does
- building the full zone-to-zone reachability matrix
- diffing reachability against the intended design
- spotting 'any' wildcards that open more than intended
- finding a legitimate flow blocked by rule order
- why reading rules one at a time misses interactions
Steps in this lab
- The design is a matrix; the rules have to produce it
- The rules and the intent
- Write the matrix evaluator
- Run it: nine unintended paths and one outage
- Fix, then keep the check running