/AWS1/CL_NWFANALYSISRESULT

The analysis result for Network Firewall's stateless rule group analyzer. Every time you call CreateRuleGroup, UpdateRuleGroup, or DescribeRuleGroup on a stateless rule group, Network Firewall analyzes the stateless rule groups in your account and identifies the rules that might adversely effect your firewall's functionality. For example, if Network Firewall detects a rule that's routing traffic asymmetrically, which impacts the service's ability to properly process traffic, the service includes the rule in a list of analysis results.

The AnalysisResult data type is not related to traffic analysis reports you generate using StartAnalysisReport. For information on traffic analysis report results, see AnalysisTypeReportResult.

CONSTRUCTOR

IMPORTING

Optional arguments:

it_identifiedruleids TYPE /AWS1/CL_NWFRULEIDLIST_W=>TT_RULEIDLIST TT_RULEIDLIST

The priority number of the stateless rules identified in the analysis.

iv_identifiedtype TYPE /AWS1/NWFIDENTIFIEDTYPE /AWS1/NWFIDENTIFIEDTYPE

The types of rule configurations that Network Firewall analyzes your rule groups for. Network Firewall analyzes stateless rule groups for the following types of rule configurations:

• STATELESS_RULE_FORWARDING_ASYMMETRICALLY

  Cause: One or more stateless rules with the action pass or forward are forwarding traffic asymmetrically. Specifically, the rule's set of source IP addresses or their associated port numbers, don't match the set of destination IP addresses or their associated port numbers.

  To mitigate: Make sure that there's an existing return path. For example, if the rule allows traffic from source 10.1.0.0/24 to destination 20.1.0.0/24, you should allow return traffic from source 20.1.0.0/24 to destination 10.1.0.0/24.

• STATELESS_RULE_CONTAINS_TCP_FLAGS

  Cause: At least one stateless rule with the action pass orforward contains TCP flags that are inconsistent in the forward and return directions.

  To mitigate: Prevent asymmetric routing issues caused by TCP flags by following these actions:

  • Remove unnecessary TCP flag inspections from the rules.

  • If you need to inspect TCP flags, check that the rules correctly account for changes in TCP flags throughout the TCP connection cycle, for example SYN and ACK flags used in a 3-way TCP handshake.

iv_analysisdetail TYPE /AWS1/NWFCOLLMEMBER_STRING /AWS1/NWFCOLLMEMBER_STRING

Provides analysis details for the identified rule.

---

Queryable Attributes

IdentifiedRuleIds

The priority number of the stateless rules identified in the analysis.

Accessible with the following methods

Method	Description
GET_IDENTIFIEDRULEIDS()	Getter for IDENTIFIEDRULEIDS, with configurable default
ASK_IDENTIFIEDRULEIDS()	Getter for IDENTIFIEDRULEIDS w/ exceptions if field has no v
HAS_IDENTIFIEDRULEIDS()	Determine if IDENTIFIEDRULEIDS has a value

IdentifiedType

The types of rule configurations that Network Firewall analyzes your rule groups for. Network Firewall analyzes stateless rule groups for the following types of rule configurations:

• STATELESS_RULE_FORWARDING_ASYMMETRICALLY

  Cause: One or more stateless rules with the action pass or forward are forwarding traffic asymmetrically. Specifically, the rule's set of source IP addresses or their associated port numbers, don't match the set of destination IP addresses or their associated port numbers.

  To mitigate: Make sure that there's an existing return path. For example, if the rule allows traffic from source 10.1.0.0/24 to destination 20.1.0.0/24, you should allow return traffic from source 20.1.0.0/24 to destination 10.1.0.0/24.

• STATELESS_RULE_CONTAINS_TCP_FLAGS

  Cause: At least one stateless rule with the action pass orforward contains TCP flags that are inconsistent in the forward and return directions.

  To mitigate: Prevent asymmetric routing issues caused by TCP flags by following these actions:

  • Remove unnecessary TCP flag inspections from the rules.

  • If you need to inspect TCP flags, check that the rules correctly account for changes in TCP flags throughout the TCP connection cycle, for example SYN and ACK flags used in a 3-way TCP handshake.

Accessible with the following methods

Method	Description
GET_IDENTIFIEDTYPE()	Getter for IDENTIFIEDTYPE, with configurable default
ASK_IDENTIFIEDTYPE()	Getter for IDENTIFIEDTYPE w/ exceptions if field has no valu
HAS_IDENTIFIEDTYPE()	Determine if IDENTIFIEDTYPE has a value

AnalysisDetail

Provides analysis details for the identified rule.

Accessible with the following methods

Method	Description
GET_ANALYSISDETAIL()	Getter for ANALYSISDETAIL, with configurable default
ASK_ANALYSISDETAIL()	Getter for ANALYSISDETAIL w/ exceptions if field has no valu
HAS_ANALYSISDETAIL()	Determine if ANALYSISDETAIL has a value

Public Local Types In This Class

Internal table types, representing arrays and maps of this class, are defined as local types:

TT_ANALYSISRESULTLIST

TYPES TT_ANALYSISRESULTLIST TYPE STANDARD TABLE OF REF TO /AWS1/CL_NWFANALYSISRESULT WITH DEFAULT KEY
.