Parallelizing Automated Firewall Configuration via Traffic-Aware Decomposition

Automating the configuration of distributed firewalls by refining high-level security requirements is a well-established approach to improve correctness and manageability in modern computer networks. However, existing solutions formulate this task as a single monolithic constraint-solving problem, whose scalability suffers as network size and policy complexity increase. To overcome this limitation, this paper proposes a traffic-aware decomposition approach for the automated, parallel configuration of distributed firewalls. The method decomposes the global refinement problem into cluster-scoped subproblems using a flow-weighted network representation and solves them concurrently before merging the results into a single deployable configuration. The approach is implemented on top of a constraint-based framework and evaluated on representative topologies. The results show substantial runtime reductions, with gains increasing with problem size and reaching up to ~98% on larger instances, while maintaining satisfactory optimization quality. Moreover, the approach enables the resolution of firewall configuration problems beyond the limits of monolithic formulations.