D.P. Zegzhda - Dr.Sc. (Eng.), Professor department IBKS, National Research University St. Petersburg State Polytechnical University. E-mail: zeg@ibks.ftk.spbstu.ru
A.V. Nikolskiy - Assistant department IBKS, National Research University St. Petersburg State Polytechnical University. E-mail: alexei.nikolsky@ibks.ftk.spbstu.ru

Today specialized packet filtering solutions (including software implementations in operating systems) are used to provide network access control - firewalls, Intrusion Prevention Systems, network antiviruses, application layer proxy servers (including WAF - web application firewalls). Because of enormous growth of Internet throughput their efficiency reduces, however the cost remains high. Firewalls are installed in one certain point of network topology, so the rules syntax should allow to accurately distinguish the flows originating from different applications and clients. For this reason, the logic of firewalls becomes more complex; they need to perform more operations with each packet header to resolve which action to perform. At the same time it is known that source based filtering performed closer to the source node and the destination based filtering closer to the destination node or application allows simplifying the policy rules and therefore making filtering logic cheaper. In terms of client devices mobility, network configuration is changing rapidly and the information about network topology changes could not be used directly for access control. That is why the problem of network access control based on the information about the expected behavior (flows) of network applications is becoming more and more important. New SDN concept allows not only to escape the necessity for dedicated hardware firewalls, but to maximize the overall L2 network throughput. We claim that any given firewall configuration which specifies access control policy between applications in the network may be implemented as an SDN Flow Policy which preserves the reachability matrix on a network graph and maximizes the throughput of the L2 networking infrastructure. In this paper we formally show how to solve the problem of migration from traditional network with dedicated firewalls to SDN while preserving the nodes reachability (the connection matrix). The proposed approach was implemented as application for the POX SDN controller. The input of application is the existing network topology and a rule set for each firewall in Extended Cisco ACL format; the result is SDN access control policy of rule sets for every OpenFlow switch in SDN topology. The experimental evaluation with physical SDN testbed built upon 5 NEC Programmable Flow series switches was performed and obtained quantitative results confirm assumption of the applicability of the proposed method. The themes for further research are presented in the conclusion. They are based on records optimization in Flow Tables of OF switches.