1. SAT Applications Tutorial plus a pinch of Margrave Tim Nelson Shriram Krishnamurthi Brown University 1

2. hostname simple interface outside ip address 10.1.1.1 255.255.255.0 interface inside ip access-group 102 in ip address 192.168.1.1 255.255.0.0 access-list 102 permit tcp any any eq 80 access-list 102 deny ip 192.168.4.0 0.0.0.255 any any access-list 102 permit tcp any host 10.1.1.3 access-list 102 deny any ip route 0.0.0.0 0.0.0.0 10.1.1.2 2 simple outside inside 192.168.1.1/2410.1.1.1/24

3. access-list 102 permit tcp any any eq 80 access-list 102 deny ip 192.168.4.0 0.0.0.255 any any access-list 102 permit tcp any host 10.1.1.3 access-list 102 deny any 3 simple outside inside 192.168.1.1/2410.1.1.1/24 allow(p) ↔ (p.proto = tcp and p.tcpDst = 80) or (p.proto = tcp and p.ipDst = 10.1.1.3 and not (p.ipSrc in 192.168.4.0/24))

4. interface outside ip address 10.1.1.1 255.255.255.0 interface inside ip access-group 102 in ip address 192.168.1.1 255.255.0.0 4 simple outside inside 192.168.1.1/2410.1.1.1/24 output(nexthop,o) ↔ (nexthop in 10.1.1.0/24 and o = outside) or (nexthop in 192.168.0.0/16 and o = inside)

5. ip route 0.0.0.0 0.0.0.0 10.1.1.2 5 simple outside inside 192.168.1.1/2410.1.1.1/24 route(p,nexthop) ↔ (nexthop = p.ipDst and (p.dlDst IN 10.1.1.0/24 or p.dlDst IN 192.168.0.0/16)) or (nexthop = 10.1.1.2 and not (p.dlDst IN 10.1.1.0/24 or p.dlDst IN 192.168.0.0/16))

6. 6 output(nexthop,o) route(p,nexthop) allow(p) …

7. 7 output(nexthop,o) route(p,nexthop) allow(p) nat(p, p’) router-pass(p, p’)

8. 8 “Reasonable facts” as variables p.ipSrc in 10.1.1.0/24 p.tcpsrc in 10.1.1.0/24 Constraints (p.ipSrc in 10.1.1.0/24 → p.ipSrc in 10.1.0.0/16)

9. 9 x (not x) or y y or (not x) or z (not q) and Clause ::= ( ± x 1 or … or ± x n ) (not y)

10. 10 What about state?

11. access-list 102 permit tcp any any eq 80 access-list 102 deny ip 192.168.4.0 0.0.0.255 any any access-list 102 permit tcp any host 10.1.1.3 access-list 102 deny any 11 simple outside inside 192.168.1.1/2410.1.1.1/24 allow(p) ↔ (p.proto = tcp and p.tcpDst = 80) or (p.proto = tcp and p.ipDst = 10.1.1.3 and not (p.ipSrc in 192.168.4.0/24)) or reflexiveReturn(p.ipSrc, p.ipDst, “web”) reflect web Stateful Firewall

12. access-list 102 permit tcp any any eq 80 access-list 102 deny ip 192.168.4.0 0.0.0.255 any any access-list 102 permit tcp any host 10.1.1.3 access-list 102 deny any 12 simple outside inside 192.168.1.1/2410.1.1.1/24 plus_reflexiveReturn(p.ipSrc, p.ipDst) ↔ (p.proto = tcp and p.tcpDst = 80) reflect web

13. 13 plus_nat(p.ipSrc, p.tcpSrc, next) ↔ p.proto = tcp and not nat(p.ipsrc, p.tcpSrc, ANY) Is the translation reversed at outside gateway? all p | p.locPt = outside and p.ipdst = gateway_addr and nat(oldip, oldpt, p.tcpDst) and forward(p, p’) → (p’.tcpDst = oldpt and p’.ipdst = oldip)