search

napalm-automation / napalm-base

Apache License 2.0
32 stars 48 forks source link

Proposal: Add firewall-management functionality to NAPALM #66

Open alejandrosalinas opened 8 years ago

alejandrosalinas commented 8 years ago

Hi guys, in many occasions network teams are not only responsible for switches/routers operation but also for other devices such as firewalls (or at least the way they connect/integrate with the network). I'd like to know what you guys think of adding firewall support to NAPALM. I envision this in two possible flavors:

Looking forward to your comments

Best Alejandro

dbarrosop commented 8 years ago

Hello @alejandrosalinas , thanks for your proposal. Comments below:

Regular network-device calls applied to firewalls such as show route/interface or the like

We already have support for Palo Alto devices and SRXs (as those are just regular JunOS). What I mean with that is that if you want to implement, let's say ASA, feel free to do it. We have nothing against adding support for firewalls. napalm-base contains the methods that are already decided so you can implement a driver with those methods. We can help/guide you in the process of adding a new driver.

If this is what you are planning, uou can start by checking this repo: https://github.com/napalm-automation/napalm-skeleton

Firewall specific functions involving objects, zones, rules, policies, etc

Nothing against this either. The normal procedure is to raise an issue or open a PR with the proposal. For example:

https://github.com/napalm-automation/napalm-base/pull/69/files https://github.com/napalm-automation/napalm-base/issues/56

Usually that leads to some discussion on how we want the API to look like and then some implementation.

Hope this helps : )

lubon commented 8 years ago

I actually was contemplating about this topic, but the work to get this done is quite extensive.. Just to represent the data for the changes would be a hard nut to crack. You have to consider how the firewall is deployed (L2/L3/bump-in-wire/context/..) as well as what is to be filtered or translated or inspected (mac/ipv4/ipv6/NAT/IPS/..) and how it is to be defined (IPs/objects/group of objects/group of groups/..)

And besides vendor differences, you have syntax differences between versions or even patches.

But one day, when I have a lab with various firewalls at my disposal, I would try to tackle it :+1: