Abstract:

Compared with the traditional network architecture, the control and data planes are decoupled in software-defined networking, which provide a new solution for research on new network applications and future Internet technologies. However, according to the recent research and progress of SDN, security problem has not been addressed, which will be a significant issue. Traditional firewalls in the face of constantly updating a large number of network attacks are still loopholes, the urgent need for innovative mechanisms firewall in the face of danger situation. SDN is a new control and forwarding separation and direct programmable network architecture, the main idea is to decouple traditional tight coupling network equipment to get forwarding plane and control plane, network management staffissued can send the firewall policy to the switches in the network through a central controller. In this paper, after introducing the relevant knowledge of SDN firewall architecture, a stateful firewall policies be designed by a software-defined network programming language pyretic based on IP address recognition, and deployed in the control plane. In order to fully show the flexibility and control of fine-grained firewall policy in software-defined network environments, a stateful firewall policy is deployed and issued in the virtual network.

Key words: software-defined networking, controller, stateful firewall