In the evolving landscape of network security, the necessity for robust firewall rule management is undeniable. The introduction of zero trust environments, expansion of network locations, integration of new applications, and the adoption of emerging technologies necessitate the continuous addition and modification of firewall rules. However, the challenge arises due to the lack of uniform configuration standards and clear definitions of what constitutes an effective firewall rule. This variability leads to inconsistencies and complexities, particularly in large organizations where the scale of rules and requests can be overwhelming.

During a recent webinar, Network to Code’s Ken Celenza, VP of Professional Services, and Jeremy White, Principal Developer Advocate, discussed how the new Nautobot Firewall data models application revolutionizes firewall automation by promoting quality and consistent data hygiene practices.

Read on to learn more about the current state of firewall rule management, the Nautobot firewall models app, generating multi-vendor configurations, and how to get started.

Understanding the Complexities of Firewall Rule Management

The management of firewall rules is fraught with challenges, particularly at scale. Large organizations often grapple with managing tens of thousands of rules and fielding thousands of modification requests annually. The presence of multiple vendors and diverse firewall configurations further complicates this landscape, making effective management a herculean task. Additionally, the lack of comprehensive documentation and traceability exacerbates the difficulty in maintaining and auditing these rules.

Introducing a Nautobot App for Streamlined Security Models

Nautobot serves as a comprehensive source of truth and network automation platform, offering a groundbreaking open source application tailored for designing multi-vendor firewall rules, objects, and policies. This facilitates the clear definition of security policies and intentions. The application aids users in populating the data model through guided data input steps, followed by a suite of management functions for enhanced policy creation and insights, including API interactions, data queries, and configuration generations.

Here’s how Nautobot addresses the challenges associated with legacy firewall rule management:

Using Nautobot to Attack the Issue of Scale

• Rule Reusability: Facilitates the reuse of security rules and groups to eliminate redundant engineering efforts.
• Duplicate Rule Identification: Allows for the querying of existing rules to prevent unnecessary duplications.
• Rule Compression: Employs logic to consolidate rules, simplifying firewall configurations.

Using Nautobot to Improve Workflow Issues

• Standard Configurations: Establishes intended state configs in the model and then enforces them across all devices, ensuring all new deployments meet standards and noting any noncompliant configurations discovered.
• Minimizing Errors: Streamlines the user interface to reduce manual input and associated errors.
• Programmatic Interactions: Enhances the ease and efficiency of managing firewall rules through structured data models.

Using Nautobot to Simplify Environmental Complexities

• Path Analysis: Offers insights into firewall paths and interactions, aiding in better management.
• Unified Multi-vendor or Multi-cloud Management: Maintains consistency across different vendors and cloud environments.
• Rule and Object Management: Enhances traceability and granularity in rule and object modifications.

Using Nautobot to Streamline Documentation and Audits

• Ownership: Assigns and tracks ownership of rules, objects, and groups for better governance.
• Metadata Use: Enhances querying and reporting capabilities through custom data application.
• Auditing: Facilitates audits through detailed metadata, providing traceability for each rule and streamlining the review process.

Looking to learn how you can get started with Nautobot? You’ve come to the right place.

During our monthly webinars in 2023, Tim Schreyack, Director of Sales Engineering at Network to Code, and Jeremy White, Principal Developer Advocate at Network to Code, came together to discuss why data is the key to unlocking successful enterprise network automation.

Their conversations covered the current state of network management, why an authoritative Network Source of Truth is necessary for a network automation framework, the importance of a validated and well-documented network intended state, and how Nautobot helps organizations take back control of their network with a data-driven approach to network automation.

Read on to learn more about how you can eliminate spreadsheets and efficiently manage everything from inventory and IPAM to BGP, firewall policies, and much more with Nautobot!

The State of Network Management

In the current state of network management, most organizations are leveraging tools, processes, and technologies developed over 20 years ago.

As companies grow, so do the scale and complexity of their networks. Eventually, this growth causes all manual CLI-driven methodologies of network management to become unviable. Commonly, what we see happening in organizations is a transition from all manual CLI to personal scripts, whether bash shell or Python scripts, that are deployed on individual computers to help maintain the network environment. Some organizations take the next step and collaborate on these power tools.

Despite the popularity of this approach to network management, the legacy management of the network ultimately succumbs to its numerous costs and inefficiencies. Not only does this approach leave engineers spending the majority of their time on monotonous tasks, but the operating costs of maintaining the environment are extremely high. Legacy management of the network also results in slow response times and excessive backlogs, limiting scalability.

As organizations continue down this journey of trying to evolve their legacy practices for network management, they discover the need for a Network Source of Truth (NSoT). This is because as the maturity of enterprise automation frameworks increases, an NSoT is necessary to increase the efficiency of network operations as well.

Companies cannot drive automation and change without an NSoT.

Introduction to NSoT

Change in network management begins with data.

“No enterprise should develop network automations on top of systemic uncertainty of the underlying in-service network data. Unfortunately, 74% of a typical enterprise’s network inventory data is partially, minimally, or not at all accurate. Network automations require a reliable NSoT,” says Gartner.

If all of an organization’s data is accessible from a Network Source of Truth (NSoT), there is the opportunity to not only drive network automation but also perform richer capacity planning, trending, and business impact analysis.

The key to understanding NSoT is that it is all about intentions and planning. Once we express our intent into the NSoT, that becomes the authoritative state for the environment against which as-is network behaviors are compared. The difference between the intended state and the as-is state identifies anomalies for investigation and correction, with the corrective action being centered on simply implementing any needed changes to the data. This is why Network to Code refers to our approach as data-driven network automation.

The more accurate the data is, the more insights we will gain.

The Power of Nautobot

For those that are unfamiliar with it, Nautobot is an extensible and flexible Network Source of Truth and Network Automation Platform that can power any network automation architecture. It is not just about the Source of Truth. It’s about how we use that Source of Truth to drive change and integrate tools into the environment.

Network to Code created Nautobot as an open source community project, purpose-built to automate network management.

One of the challenges we face as we move into an automated world is that it is very easy to go from making a change that might only impact one device to making a change that might impact a lot of devices. With this expanded impact of automation, we must ensure our data is accurate and driving the change we expect it to, because automation is only as good as the data behind it.

Nautobot supports two main ways of enforcing data validation and integrity: the Data Validation Application and User-Defined Jobs. The Data Validation Application API provides a way to express business logic into the data. Data Validation Application is a no-code solution that allows administrators to define rule-based data validation during the creation and modification of objects. User-Defined Jobs can leverage the Data Compliance feature of the Data Validation Engine to verify compliance across preexisting objects.

Nautobot Key Features for Network Source of Truth

At its core, we’ve discussed how Nautobot is a Network Source of Truth that defines the intended state of the network, but let’s dive into its key network management features.

Data Model Features: With NSoT, you can codify business rules to ensure there is nothing but high-quality data in Nautobot. NSoT enables you to create custom relationships between existing data models that replicate your network design. On top of that, you can augment existing data models through custom fields on any object, including interfaces.

Highly Extensible: Free purpose-built applications cater to your specific NSoT and network automation requirements.

Highly Available Data: NSoT allows you to easily fetch the exact data you desire across data models with a single API call. Additionally, Nautobot can make an outbound HTTP API calls based on create, update, and delete operations.

All of these key features help to support data-driven network automation.

Getting Started with Nautobot and NSoT

Now that we have identified Nautobot’s key features and several ways to load and validate data about the network, what’s next for network management with Nautobot?

Here are a few recommendations to start leveraging Nautobot:

1. Populate interface descriptions to describe what is connected and informed by the NSoT.
2. Leverage ChatOps to retrieve information via your favorite chat application.
3. Maintain a few simple configuration stanzas across your entire organization.
4. Begin tracking device lifecycles programmatically.