Design Firewall Rules Engine - System Design | WinJob

Problem Statement & Perimeter Control Plane

Design a firewall rules engine for enterprise NGFW rules engine separating admin control plane from inline packet evaluation. Interviewers at Palo Alto, Cisco, Fortinet expect concrete numbers, not vague "we have ACLs."

Key points

Rules engine decides allow/deny/drop on L3-L7 tuples before traffic reaches workloads

Control plane edits versioned policy bundles; data plane evaluates compiled tries

Default-deny posture with explicit permit rules and audit on every decision

Deep dive

Sizing Problem Statement & Perimeter Control Plane: distinguish SYN-rate (new flows) from established throughput; state table memory dominates east-west. When challenged on Problem Statement & Perimeter Control Plane, explain first-match ordering, how compiled tries shrink eval cost, and why policy_version pins prevent stale permits after rollback.

Stateful inspection caches the first-packet decision in a flow table; subsequent packets on the same 5-tuple skip full trie walks—this is how appliances sustain tens of millions of flows without re-walking thousands of rules.

Implementation sketch

javaOne Dark Pro

1 public final class FirewallCtx1 {
2   private final String tenantId;
3   private final long policyVersion;
4   private final String srcZone;
5   private final String dstZone;
6   public boolean stale(long live) { return policyVersion < live; }
7   public String flowKey(String srcIp, int srcPort, String dstIp, int dstPort, int proto) {
8     return tenantId + "|" + policyVersion + "|" + srcZone + ">" + dstZone + "|" + proto + "|" + srcIp + ":" + srcPort + "->" + dstIp + ":" + dstPort;
9   }
10 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass(frozen=True)
4 class RuleDecision1:
5     tenant_id: str
6     policy_version: int
7     rule_id: str
8     action: str
9     matched: bool

typescriptOne Dark Pro

1 interface FirewallCtx1 {
2   tenantId: string;
3   policyVersion: number;
4   ruleId: string;
5   action: "allow" | "deny" | "drop";
6 }
7  
8 export function cacheKey(c: FirewallCtx1, tuple: string): string {
9   return [c.tenantId, c.policyVersion, tuple].join("|");
10 }

Operational notes

Note 1.1: Problem Statement & Perimeter Control Plane — hit counters operational check.

Note 1.2: Problem Statement & Perimeter Control Plane — zone matrix operational check.

Note 1.3: Problem Statement & Perimeter Control Plane — bundle signing operational check.

Note 1.4: Problem Statement & Perimeter Control Plane — canary operational check.

Note 1.5: Problem Statement & Perimeter Control Plane — CEF export operational check.

Note 1.6: Problem Statement & Perimeter Control Plane — DAG refresh operational check.

Note 1.7: Problem Statement & Perimeter Control Plane — fragment guard operational check.

Note 1.8: Problem Statement & Perimeter Control Plane — overlap graph operational check.

Note 1.9: Problem Statement & Perimeter Control Plane — tenant fair-queue operational check.

Note 1.10: Problem Statement & Perimeter Control Plane — rollback z-score operational check.

Note 1.11: Problem Statement & Perimeter Control Plane — ebpf hook operational check.

Note 1.12: Problem Statement & Perimeter Control Plane — quorum ACK operational check.

Close Problem Statement & Perimeter Control Plane with default deny, publish/canary/rollback, and shadow detection—three phrases interviewers reward.

Why interviewers care

Firewall Rules Engine interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & Perimeter Control Plane that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Rules engine decides allow/deny/drop on L3-L7 tuples before traffic reaches workloads
•Control plane edits versioned policy bundles; data plane evaluates compiled tries
•Default-deny posture with explicit permit rules and audit on every decision

1	public final class FirewallCtx1 {
2	private final String tenantId;
3	private final long policyVersion;
4	private final String srcZone;
5	private final String dstZone;
6	public boolean stale(long live) { return policyVersion < live; }
7	public String flowKey(String srcIp, int srcPort, String dstIp, int dstPort, int proto) {
8	return tenantId + "\|" + policyVersion + "\|" + srcZone + ">" + dstZone + "\|" + proto + "\|" + srcIp + ":" + srcPort + "->" + dstIp + ":" + dstPort;
9	}
10	}

1	from dataclasses import dataclass
2
3	@dataclass(frozen=True)
4	class RuleDecision1:
5	tenant_id: str
6	policy_version: int
7	rule_id: str
8	action: str
9	matched: bool

1	interface FirewallCtx1 {
2	tenantId: string;
3	policyVersion: number;
4	ruleId: string;
5	action: "allow" \| "deny" \| "drop";
6	}
7
8	export function cacheKey(c: FirewallCtx1, tuple: string): string {
9	return [c.tenantId, c.policyVersion, tuple].join("\|");
10	}