% firewall_anomalies

Firewall configuration is done manually by the network administrator, who usually has the support of some automatic tools with limited functionalities for the security management.\newline
Misconfiguration is not a rare scenario, because it is easy to introduce human errors and this has a no negligible impact on the effectiveness of security controls.

As we mentioned before a firewall has an ordered set of filtering rules, a default action, in case no rules are matched and a resolution strategy.
The latter is the element that solve some conflicts between the rules.

Firewall anomaly is defined as the presence of multiple rules in the filtering policy that match the same packet. 
This leads to have different types of anomaly as \textit{Shadowing anomaly},\break \textit{Correlation anomaly}, \textit{Generalization anomaly} and \textit{Redundancy anomaly}, some of these are\break considered warnings potential conflicts or errors for specific conflicts.

It is not enough to have no conflicts in a policy, because especially in large companies there are more than one policy and one firewall. Usually different policies are deployed in different firewalls.

This could leads to \textit{Inter-Firewall Anomaly} that is defined as the presence, on a network path, of two firewalls, the former called \textit{upstream firewall} and the latter is the \textit{downstream firewall}, that performed different actions on the same packet flows.
Inter-Firewall Anomaly could be classified with the same anomaly types mentioned before, plus a new one called \textit{Supriusness Anomaly}.