Skip to main content

Firewall Mode

In Firewall Mode, the Corsha Gatekeeper operates at layer 2 for connection control while performing deep-packet inspection to identify protocols and analyze application-layer traffic. This provides protocol-agnostic security for all machine-to-machine communications with microsecond-level latency.

How Firewall Mode Works​

Passive Discovery: Gatekeepers observe network traffic and passively discover machines without requiring agents, configuration changes, or instrumentation. As machines communicate, Gatekeepers identify them and build an inventory of active machines.

Connection Rule Enforcement: Gatekeepers evaluate connections against connection rules synchronized from the Corsha mIDP. Rules define how machines can communicate. Gatekeepers enforce rules locally — blocking or allowing traffic based on the configured enforcement mode.

Continuous Rule Synchronization: Gatekeepers continually sync connection rules from the Corsha mIDP. Rule updates propagate to all Gatekeepers automatically, enabling dynamic policy updates without redeployment.

Enforcement Modes​

Firewall mode supports three enforcement modes for progressive security hardening: Observe-Only, Allow by Default, and Block by Default. These modes enable gradual deployment—starting with discovery and observation, transitioning to incremental blocking, and ultimately achieving zero-trust security.

  • Observe-Only Mode: Discover machines and connections without blocking traffic
  • Allow by Default Mode: Permit traffic by default, block specific unwanted connections
  • Block by Default Mode: Block all traffic except explicitly permitted connections (zero-trust)

See Deployment Lifecycle for detailed guidance on progressive security hardening, enforcement mode behavior, and when to transition between phases.

Performance Characteristics​

  • Latency Impact: Microseconds (layer 2 operation)
  • Protocol Support: All protocols—IP, TCP, UDP, HTTP, industrial, proprietary
  • Throughput: Wire-speed forwarding with minimal overhead

Protocol Support​

Deep Protocol Inspection​

The Corsha Gatekeeper provides application-layer inspection and logging for a wide range of industrial and IT protocols. Examples of supported protocols include:

  • HTTP/HTTPS: Web traffic analysis with request/response logging
  • EtherNet/IP: Industrial Ethernet protocol used in manufacturing and automation
  • OPC UA: Unified Architecture protocol for industrial communication
  • Modbus TCP: Industrial protocol for supervisory control and data acquisition (SCADA)
  • BACnet/IP: Building automation and control networks protocol

Deep protocol inspection provides visibility into application-layer details such as commands, data transfers, and protocol-specific operations. Access logs for these protocols are captured and can be forwarded to centralized logging systems.

Generic Protocol Support​

For protocols without specific deep inspection modules, the Gatekeeper provides connection-based access control through network traffic analysis. This enables the Gatekeeper to:

  • Discover machines communicating over any protocol
  • Monitor connection patterns between machines regardless of protocol
  • Enforce connection rules based on connection endpoints (layer 2) without requiring protocol-specific knowledge
  • Log traffic metadata including source/destination IP addresses, MAC addresses, ports, and protocols

This protocol-agnostic approach allows the Gatekeeper to secure communications using:

  • Standard protocols (FTP, SSH, Telnet, SMTP, etc.)
  • Proprietary industrial protocols
  • Custom application protocols
  • Encrypted traffic (enforcement based on connection endpoints, not payload inspection)

The Gatekeeper's ability to enforce connection rules at layer 2 ensures that all network traffic passing through it can be controlled, providing comprehensive security even for unknown or custom protocols. Deep-packet inspection provides additional protocol visibility where supported.

When to Use Firewall Mode​

  • All Protocol Types: When you need to secure non-HTTP protocols (industrial protocols like EtherNet/IP, OPC UA, Modbus, BACnet, or proprietary protocols)
  • Microsecond Latency Requirements: Real-time systems, SCADA, industrial control systems, PLCs where millisecond delays are unacceptable
  • Passive Discovery: When machines cannot be modified or instrumented (legacy systems, embedded devices, appliances)
  • Protocol-Agnostic Security: Mixed environments with diverse protocols requiring unified control
  • Zero-Trust Network Segmentation: Micro-segmentation without deploying agents on endpoints
  • Connection-Based Control: When you need to control which machines can communicate regardless of application-layer protocols