The design and management of firewall ACLs is a
very hard and error-prone task. Part of this complexity comes
from the fact that each firewall platform has its own low-level
language with a different functionality, syntax, and development
environment. Although high-level languages have been proposed
to model firewall ACLs, none of them has been widely adopted by
the industry due to a combination of factors: high complexity, no
support of important features of firewalls, etc. In this paper the
most important access control policy languages are reviewed,
with special focus on the development of firewall ACLs. Based on
this analysis, a new domain specific language for firewall ACLs
(AFPL2) is proposed, supporting more features that other
languages do not cover (e.g. NAT). As the result of our design
methodology, AFPL2 is very lightweight and easy to use. AFPL2
can be translated to existing low-level firewall languages, or be
directly interpreted by firewall platforms, and is an extension to a
previously developed language.Ministerio de Eduación y Ciencia DPI2006-15476-C02-0
