You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The firewall model plugin provides the ability to integrate with Capirca for configuration generation. The authors have applied a very light opinion onto the translation from the firewall models to generate valid policy (`.pol`), network (`.net`), and service (`.svc`) files that are consumed by Capirca.
3
+
The firewall model plugin provides the ability to integrate with Aerleon for configuration generation. The authors have applied a very light opinion onto the translation from the firewall models to generate valid policy (`.pol`), network (`.net`), and service (`.svc`) files that are consumed by Aerleon.
4
4
5
-
FW Model | Capirca
5
+
FW Model | Aerleon
6
6
--------------------------- | -------
7
7
Name (as applicable) | Header - Filter Name
8
8
Zone (as applicable) | Header - to-zone/from-zone
@@ -18,46 +18,46 @@ Service - tcp/udp | *.svc
18
18
Service Group | *.svc
19
19
20
20
!!! note
21
-
If this terminology is not familiar, please review the documentation at [Capirca](https://github.com/google/capirca).
21
+
If this terminology is not familiar, please review the documentation at [Aerleon](https://github.com/aerleon/aerleon).
22
22
23
23
## Special Considerations
24
24
25
-
*Capirca does not allow special characters in a majority of the named objects, as such named objects are modified to the ouput used when processed via a modified (to allow for capital letters) [Django slugify](https://docs.djangoproject.com/en/4.0/ref/utils/#django.utils.text.slugify), this includes:
25
+
*Aerleon does not allow special characters in a majority of the named objects, as such named objects are modified to the ouput used when processed via a modified (to allow for capital letters) [Django slugify](https://docs.djangoproject.com/en/4.0/ref/utils/#django.utils.text.slugify), this includes:
26
26
* Policy name, policy rule name, address, address group, zone, service, service group
27
27
* e.g. Policy called "Allow to Internet" will be called "Allow-to-Internet"
28
-
* Note: This **will not change** barring a major update from Capirca
29
-
* FQDN and IP Range are not supported by Capirca and will fail if attempting to use those features
30
-
* The zone is only used where Capirca supports it, at the time of this writing is only Palo Alto and Juniper SRX
28
+
* Note: This **will not change** barring a major update from Aerleon
29
+
* FQDN and IP Range are not supported by Aerleon and will fail if attempting to use those features
30
+
* The zone is only used where Aerleon supports it, at the time of this writing is only Palo Alto and Juniper SRX
31
31
* Zone based firewalls have headers on every rule
32
32
* Both Juniper SRX and Palo Alto support using the named zone "all" to represent all zones, but in all cases a zone must be set
33
33
* The "Filter Name" is a concatenation of the Policies applied to a given firewall
34
34
* Not all firewalls get a filter name, such as zone or direction based firewalls, which require a `chd_` custom field (more details below)
35
35
* An object (policy, policy rule, src-addr, dst-addr, etc.) is put into and out of use based on whether or not the status is `active` or as defined in your plugin configuration
36
36
* Anything other than active or defined in plugin setting `allowed_status` is ignored
37
37
* Removing the last active object in an source-address, destination-address, or service will fail the process to avoid your policy failing open
38
-
* The Platform `network_driver` must match the Capirca generator name
39
-
* You can optionally provide a mapping in the settings `capirca_os_map` to map from the current platform name, to the Capirca generator name
40
-
* The action of "remark" on a rule is not conidered, you can set the setting `capirca_remark_pass=False` if you want it to fail by default rather than silently skipping
38
+
* The Platform `network_driver` must match the Aerleon generator name
39
+
* You can optionally provide a mapping in the settings `aerleon_os_map` to map from the current platform name, to the Aerleon generator name
40
+
* The action of "remark" on a rule is not conidered, you can set the setting `aerleon_remark_pass=False` if you want it to fail by default rather than silently skipping
41
41
42
42
In addition to the above, you can add to any header or term by creating specific custom fields on the `PolicyRule` data model. They must start with:
43
43
44
-
*`chd_` - Capirca Header Data - will be applied to the `header` for any given rule.
45
-
*`ctd_` - Capirca Term Data - will be applied to the `term` for any given rule.
44
+
*`chd_` - Aerleon Header Data - will be applied to the `header` for any given rule (`chd_` name comes from previous versions of this app using Capirca, kept for compatibility).
45
+
*`ctd_` - Aerleon Term Data - will be applied to the `term` for any given rule (same comment than before).
46
46
47
-
The process is to create a custom field, such as `ctd_pan-application`, this will be applied to the PolicyRule as you describe. This can become problematic if you share the model for multiple firewall OSs. This can be conditionally applied via a custom field to the `Platform` model. This custom field **must** be named `capirca_allow` and be of type JSON and be a single list. For each OS defined by the platform, you can allow that custom field to populate. This allows you to use the same model, and not let the custom fields for one OS conflict with another OS.
47
+
The process is to create a custom field, such as `ctd_pan-application`, this will be applied to the PolicyRule as you describe. This can become problematic if you share the model for multiple firewall OSs. This can be conditionally applied via a custom field to the `Platform` model. This custom field **must** be named `aerleon_allow` and be of type JSON and be a single list. For each OS defined by the platform, you can allow that custom field to populate. This allows you to use the same model, and not let the custom fields for one OS conflict with another OS.
> Note: This is pseudo-code and is technically the custom_field called `capirca_allow` that has the data `["ctd_pan-application", "ctd_expiration"]` in this example.
53
+
> Note: This is pseudo-code and is technically the custom_field called `aerleon_allow` that has the data `["ctd_pan-application", "ctd_expiration"]` in this example.
54
54
55
-
As previously mentioned, there is only a small opinion that is applied from the translation between the model and Capirca. That being said, Capirca has an opinion on how rules and objects are deployed, and within this project there is no consideration for how that may not align with anyone's intention on how Capirca should work. All such considerations should be referred to the Capirca project. There is no intention to modify the output that Capirca creates **in any situation** within this plugin.
55
+
As previously mentioned, there is only a small opinion that is applied from the translation between the model and Aerleon. That being said, Aerleon has an opinion on how rules and objects are deployed, and within this project there is no consideration for how that may not align with anyone's intention on how Aerleon should work. All such considerations should be referred to the Aerleon project. There is no intention to modify the output that Aerleon creates **in any situation** within this plugin.
56
56
57
-
That being said, in an effort to provide flexibility, you can override the translation process. However, you would be responsible for that implementation. You can provide within your setting, a dotted path [import_string](https://docs.djangoproject.com/en/4.0/ref/utils/#django.utils.module_loading.import_string) to your own function. This is provided in the `custom_capirca` setting within your Plugin Configurations. The signature takes a `Device` object instance and must return a tuple of `(pol, svc, net, cfg)`, none of which are required to have data.
57
+
That being said, in an effort to provide flexibility, you can override the translation process. However, you would be responsible for that implementation. You can provide within your setting, a dotted path [import_string](https://docs.djangoproject.com/en/4.0/ref/utils/#django.utils.module_loading.import_string) to your own function. This is provided in the `custom_aerleon` setting within your Plugin Configurations. The signature takes a `Device` object instance and must return a tuple of `(pol, svc, net, cfg)`, none of which are required to have data.
0 commit comments