Defense in Depth, Layering using OCI Network Firewall

As customer adoption of cloud continues to accelerate, so does the demand for advanced capabilities to address cloud security and compliance concerns.  Vulnerabilities such as Log4j, cryptojacking malware, ransomware and supply chain attacks are on the rise.  Oracle Cloud Infrastructure (OCI) was built with a security-first approach, helping to reduce risks and provide continuous protections, allowing our customers to sleep better at night.

"As a cloud service provider, Oracle is committed to being a partner in security and helping defend against emerging threats"

- Yogesh Kaushik, Vice President of Virtual Network and Security Products

We recently announced the latest addition to our identity and security portfolio, the Oracle Cloud Infrastructure Network Firewall (OCI Network Firewall) to all commercial regions with government regions soon to follow.  OCI Network Firewall introduces a new easily consumable next-generation managed firewall service that gives customers advanced security controls beyond just IP addresses, transport protocols, and ports.  Learn more about the announcement by reading the blog Announcing Oracle Cloud Infrastructure Network Firewall authored by my colleague Gopi Gopalakrishnan.

Benefits

Simplified management and configuration

The OCI Network Firewall service offers OCI customers managed next generation firewalls without the operational and management complexities associated with 3rd party virtual firewall appliances.  For example, when deploying an OCI Network Firewall, scale and high availability are built-in capabilities.  There are no additional requirements for customers to deploy, configure and manage additional virtual network constructs.

Flexible deployment models

Customers can deploy the OCI Network Firewall in several ways depending on their use case.  The most common deployment models are: centralized, distributed, or combined.  These models offer the flexibility to secure traffic flows for the following complex routing scenarios:

• North-South inbound/outbound - internet traffic flow via Internet Gateway (IGW) or NAT Gateway (NATGW) through an OCI Network Firewall protecting traffic to a secured VCN.
• North-South inbound/outbound - on-premises traffic flow via Dynamic Routing Gateway (DRG) through an OCI Network Firewall protecting traffic to a secured VCN.
• East-West subnet-A to subnet-B - traffic flow through an OCI Network Firewall protecting traffic between VCNs.
• East-West/North-South subnet-A - on-premises traffic flow through an OCI Network Firewall and Services Gateway (SGW) to OCI Services in the Oracle Services Network.

Read more about each of these routing deployment models, topologies and best practices in the Secure your workloads using Oracle Cloud Infrastructure Network Firewall Service Reference Architecture document authored by Arun Poonia.  

High availability

The OCI Network Firewall is a highly available, horizontally scalable and fault tolerate service.  Customers are not required to add additional infrastructure or complex configuration.

Key security features

Enhanced stateful security lists

With the OCI Network Firewall, customers can strengthen their security posture with stateful network filtering with increased scale.  The OCI Networking service offers Security Lists (SLs) and Network Security Groups (NSGs) for VCNs which customers can use to secure their workloads.  SLs and NSGs leverage a whitelist model whereby security rules permit traffic flows based on protocol and port.  Non-matching traffic is implicitly denied.  Customers demand scale and flexibility to simultaneously leverage not only denylists, but also allowlists when creating policies.  With OCI Network Firewall, customers now have the capability to create stateful network filtering rules that allow or deny network traffic based on IPv4 and IPv6, port and protocol.  These rule sets can be combined into denylists or allowlists at greater scale than SLs and NSGs.  To learn more about the OCI Network Firewall scale limits, visit our documentation.

Custom URL and FQDN filtering

Restrict ingress and egress HTTP/S traffic to a specified list of fully qualified domain names (FQDNs), including wild cards and custom URLs.  You can use Custom URL filtering to inhibit users from accessing websites that are prohibited or not work-related.  This kind of filtering can increase network security and enforce an organization’s policy on acceptable use of network resources.  To enforce Custom URL filtering of HTPPS traffic, the OCI Network Firewall decrypts and inspects TLS-encrypted traffic flows.

Intrusion detection and prevention system (IDPS)

Actively or passively monitor your network for malicious activity.  The OCI Network Firewall leverages threat intelligence to discover cybersecurity attacks.  As an exploit is discovered by its signature, the OCI Network Firewall can be configured to take the action to log information or block the activity.  The intrusion detection and prevention capabilities can be implemented separately or together.

SSL forward proxy and inbound inspection 

SSL forward proxy and inbound inspection allows the OCI Network Firewall inserted between a client and a target server to decrypt and inspect traffic.  SSL inbound inspection can be implemented together with IDPS to inspect and block suspicious or noncompliant traffic.

Key customer scenarios

Defense in depth

A common security framework to defend against sophisticated cyber threats is an architecture built upon a philosophy commonly referred to as "Defense in Depth".  OCI Network Firewall can be deployed harmoniously alongside other OCI networking security services as part of an overall architecture.  The remainder of this blog focuses on the Network Security layer of a defense in depth framework and specifically the OCI Network Firewall use cases.  To learn more about OCI Cloud Security services, visit our documentation.

Specifically, there are two objectives:

• Highlight common customer scenarios in which the OCI Network Firewall will be inserted to add protections for inbound/outbound north-south/east-west) traffic.

• Describe the console workflow for creating a Network Firewall with a Network Firewall Policy that describes user intentions and then enforces them.

To learn more about the OCI Network Firewall configuration, requirements, dos, and don'ts visit our documentation.

Scenario 1:  Perimeter stateful network filtering

Customers can now create stateful filtering based on allow or deny access control entries using either IP addresses, ports, protocols or both and combine them into any combination of white/black/grey lists for greater flexibility to help meet business compliance or regulatory goals.  In the example below the OCI Network Firewall is performing perimeter stateful network filtering and can be composed with either an IGW or NAT gateway for internet access.  The OCI Network Firewall can deploy either an allow/deny list model, allowing Remote Desktop Protocol (RDP) requests destined to a server IP CIDR located within a VCN.  All non-matching traffic is set to be implicitly denied.

Scenario 2:  Selective services access to Oracle Services Network (OSN)

Customers can leverage the OCI Network Firewall composed with a Service Gateway (SGW) to enforce permissive rules that "trusts but verifies" by inspecting traffic based on specific URLs and granting access ONLY if threats are not detected.  Oracle Cloud customers can connect to Oracle services privately via a gateway model called SGW.  The service gateway uses the concept of a service CIDR label, which is a string that represents all the regional public IP address ranges for the service or group of services of interest. Customers use the service CIDR label when configuring the SGW and related route rules to control traffic to the service. The two options for service CIDR are <OCI Object Storage> or <ALL Services in Oracle Services Network>.  Customers that require a more granular method to deploy selective services access can leverage the OCI Network Firewall and its URL Filtering capability to further restrict which Oracle Services endpoints are reachable via the Services Gateway for granular control to the OSN.

In the example below, the Service Gateway is deployed for private access to the Oracle Services Network.  Typically the SGW is configured to access all Oracle Services.  The OCI Network Firewall has been deployed with a selective services access policy.  HTTP/s traffic is decrypted and inspected using mapped secrets (SSL keys) which are loaded as part of the policy configuration.  Traffic destined to the streaming service URL endpoint is allowed - all other traffic destined to the Oracle Services Network is blocked.  Custom URL and FQDN Filtering also permits the use of wildcards to further allow for scale and granularity when defining rules.

Scenario 3:  Intrusion detection and prevention

Additionally, customers can choose to inspect the traffic for threats and either detect or prevent the traffic flow.  In the example below, an ecommerce website is hosted on the Internet.  The OCI Network Firewall has been deployed with an intrusion prevention policy that looks for signature based malware and other vulnerabilities.  A client unsuspectingly clicks on a link within the site that contains malware.  As the traffic returns to the firewall it is inspected.  The malware is detected and prevented from reaching and infecting the client.  A threat log record is generated that contains a detailed record of the event.

Scenario 4:  Application segmentation and zero trust

Customers can leverage the OCI Network Firewall to implement a secure, east/west zero-trust model between trust domains within a single VCN.  In the example below, the OCI Network Firewall is enforcing a zero-trust segmentation policy for a 3-tier'd application that contains a web, app and database.  The firewall policy is configured to allow communication from web to app and from app to database but blocks web to database communication.

Getting started with OCI Network Firewall

This section describes the customer workflow to create an OCI Network Firewall with the policies.  For a more detailed guide on configuration of the OCI Network Firewall, read the Secure your workloads using Oracle Cloud Infrastructure Network Firewall Service Reference Architecture document authored by my colleague Arun Poonia.

Before you get started, verify that your tenancy has the required permissions mentioned in our documentation to create an OCI Network Firewall and Network Firewall Policy.

The workflow is broken down into two high level sections: 

• Network Firewall Policy creation

• OCI Network Firewall

Network Firewall Policy creation

Network Firewall Policy consists of the following steps:

1. Create policy 
2. Add an Application list
3. Add an IP address list
4. Add an URL list
5. Create a mapped secret
6. Create a decryption profile
7. Create decryption rules
8. Create security rules

These steps describe the workflow for creating a network firewall policy.  To simplify the workflow the steps and example images below describe the policy creation for ALL three key scenarios combined into a single policy:

• Scenario 1: Perimeter stateful network filtering

• Scenario 2: Selective services access to Oracle Services Network

• Scenario 3: Intrusion detection and prevention

Step 1:  Start from Identity & Security→Firewalls→Network Firewall Policies within the OCI Console

1. Click "Create policy"
   

2. Name - Give the policy a flexible "Name"

3. Create in compartment - Select the compartment

4. Click "Next" (located at the lower left corner of screen)
   

Step 2:  Add an Application list

The following steps describe the workflow for creating an Application list that classifies traffic based on application protocol and port.  The steps and example images below describe the policy creation for "Scenario 1:  Perimeter stateful network filtering".  RDP traffic is defined within an Application list.  To learn more about Application lists, visit our documentation.

1. Click on "Add application list"
   

2. Name - Give the RDP application list a flexible "Name"

3. Application list protocol setting - Select "UDP/TCP" as the "Application list protocol setting"

4. Protocol - Select the "TCP" as the "Protocol" from the drop down list

5. Port range - Enter the application "Port range" "3389-3389" for RDP

6. Click on "Add IP application list"
   

Step 3:  Add an IP address list

The following steps describe the workflow for creating an IP address list which classify traffic based on IP addresses.  The steps and example images below describe the policy creation for "Scenario 1:  Perimeter stateful network filtering".  The VCN server subnet IP address is defined within an IP address list.  To learn more about IP address lists, visit our documentation.

1. Click on "Add IP address list"
   

2. Name - Give the server subnet IP address list a flexible "Name"

3. IP address - Add the "IP address" for the VCN server subnet
   

Step 4:  Add an URL list

The following steps describe the workflow for creating a URL address list that classifes traffic based on URLs.  The steps and example images below describe the policy creation for "Scenario 2:  Selective service access to Oracle Services Network (OSN)".  The Oracle Streaming service URL endpoint defined within URL list.  To learn more about URL lists, visit our documentation.

1. Click on "Add URL list"
   

2. Name - Give the Oracle Streaming service URL list a flexible "Name"

3. URLs - Enter the "URL" endpoint for Oracle Streaming service

4. Click "Next" (located at the lower left corner of screen)
   

Step 5:  Create a mapped secret

Decrypting and inspecting SSL forward proxy encrypted traffic requires the policy to use mapped secrets.  The OCI Network Firewall is integrated with Oracle Cloud Infrastructure Vault.  Mapped secrets were added to Oracle Cloud Infrastructure Vault as a prerequisite prior to this step.  To read about how to setup Certificate Authentication for the OCI Network Firewall and integration with Oracle Cloud Infrastructure Vault, visit our OCI Network Firewall documentation.

These steps describe the workflow for mapped secrets.

1. Click on "Add mapped secret"
   

2. Mapped secret name - Give the mapped secret a flexible "Name"

3. Mapped secret type - Select "SSL forward proxy" from the drop down list

4. Vault - Select the OCI "Vault" that contains your already created mapped secret from the drop down list

5. Secret - Select the "Secret" from the drop down list

6. Version number - Select the "Version number" from the drop down list

7. Click "Add mapped secret"
   

Step 6:  Create a decryption profile

Decrypting and inspecting SSL forward proxy encrypted traffic requires the policy to use a decryption profile.  The decryption profile controls how SSL inspection performs session mode checks, server checks, and failure checks.  To read more about decryption profiles for the OCI Network Firewall, visit our OCI Network Firewall documentation.

These steps describe the workflow for decryption profiles.

1. Click on "Add decryption profile"
   

2. Decryption profile name - Give the decryption profile a flexible "Name"

3. Decryption profile type - Select "SSL forward proxy" as the "Decryption profile type" (Leave the default settings for the remaining options)

4. Click "Add decryption profile"

5. Click "Next" (located at the lower left corner of screen)
   

Step 7:  Create decryption rules

The following steps describe the workflow for creating decryption rules that define actions the firewall should take for encrypted traffic flows for all three scenarios.  To learn more about decryption rules, visit our documentation.

1. Click on "Add decryption rule"
   

2. Match condition - Select "Any IP address" as the "Source IP address" from the drop down list

3. Match condition - Select "Any Destination" as the "Destination IP address" from the drop down list

4. Rule Action - Select "Decrypt traffic with SSL forward proxy"  from the Action drop down list

5. Decryption profile - Select the "Decryption profile" created in Step 6: Create a decryption profile, #2

6. Mapped secret - Select the "Mapped secret" created in Step 5: Create a mapped secret, #2

7. Click "Save Changes"
   

Step 8: Security rules

The OCI Network Firewalls use security rules to determine what actions are taken on traffic flows.

The following steps and example images below describe the security rules creation for ALL three key scenarios:

• Scenario 1: Perimeter stateful network filtering

• Scenario 2: Selective services access to Oracle Services Network

• Scenario 3: Intrusion detection and prevention

To learn more about security rules, visit our documentation.

Scenario 1: Perimeter stateful network filtering

This step will create a security rule for "Scenario 1: Perimeter stateful network filtering" for the RDP application list created in "Step 2:  Add an Application list".  The rule action will be to allow RDP traffic through the firewall.

1. Click "Add security rule"
   

2. Name - Give the security rule a flexible "Name"

3. Match condition - Select "Any IP address" as the "Source IP address" from the drop down list

4. Match condition -Select "Server subnet IP address list" created in Step 3: Add an IP address list, #3 as the "Destination IP address"

5. Applications - Select "UDP/TCP" for "Applications" and select the RDP application used in Step 2:  Add an Application list, #2 as the "application list"

6. URLs - Select "Any URL" from the drop down list

7. Rule Action - Select Allow traffic as the Rule Action

8. Click "save changes"
   

Scenario 2: Selective services access to Oracle Services Network and Scenario 3: Intrusion detection and prevention

This step will create a security rule for "Scenario 2: Selective services access to Oracle Services Network" and "Scenario 3: Intrusion detection and prevention".  The rule action will be to perform Intrusion prevention for traffic through the firewall.

1.  Click "Add security rule"
   

2. Name - Give the security rule a flexible "Name"

3. Match condition - Select "Any IP address" as the "Source IP address" from the drop down list

4. Match condition -Select "Server subnet IP address list" created in Step 3: Add an IP address list, #3 as the "Destination IP address"

5. Applications - Select "Any protocol" for "Applications"

6. URLs - Select the "Oracle Streaming service URL" used in Step 4:  Add an URLs list, #2 as the "URLs" from the drop down list

7. Rule Action - Select Intrusion prevention as the Rule Action

8. Click "save changes"
   

Network Firewall creation

Now that you have created a Network Firewall Policy, you can create a Network Firewall and attach the policy to it.

These steps describe the workflow for creating a network firewall.  The steps and examples images below describe the Network Firewall creation for three of the key scenarios mentioned above:

• Scenario 1: Perimeter stateful network filtering

• Scenario 2: Selective services access to Oracle Services Network

• Scenario 3: Intrusion detection and prevention

Step 1:  Start from Identity & Security→Firewalls→ Network Firewalls within the OCI Console.
 

1. Click "Create network firewall"
   

2. Name - Give the firewall a flexible "Name"

3. Create in compartment - Select the compartment

4. Network firewall policy - select the policy created in the previous step above

5. Virtual cloud network - select a VCN

6. Subnet - select a subnet

7. Network firewall availability domain - select an AD

8. Click "Create network firewall"
   

That’s it! Congratulations, the firewall creation process will take several minutes and then become available.

Next steps

On behalf of the Virtual Networking product team, we thank you for your interest and believe the OCI Network Firewall can help enhance and simplify how you secure your cloud infrastructure.  We look forward to hearing about how this feature improves your network design and solution development.  For more information, visit these links:

• OCI Network Firewall Cloud Security Services

• OCI Network Firewall Online Documentation

• OCI Network Firewall Reference Architecture

• Get Ready for Best-in-Class Security Built for Oracle Cloud Workloads

We encourage you to explore these new features and all the enterprise-grade capabilities that Oracle Cloud Infrastructure offers. You can share any product feedback that you have through email to the Virtual Networking group or submit a note in the comments.