Deployment

Network Policy

Firewall rules and transport security

Audience: Network engineers, security architects. Use: Define firewall, routing, and endpoint exposure policy for cross-zone BSFG traffic.

Transport Security Principle

All BSFG boundary communication uses mutual TLS (mTLS) over Connect RPC. This provides:

There is no fallback to unencrypted or weakly authenticated communication. All inter-zone RPC calls require valid mTLS handshake.

RPC Operations and Ports

BSFG exposes four RPC operations. All operate over a single Connect RPC endpoint:

These RPC calls are HTTP/2 POST requests to the BSFG node's endpoint. Typical port: 9443 (customizable).

Firewall Rules Template

For a three-zone deployment (Enterprise, IDMZ, Plant A), firewall rules should allow:

Source Zone Source BSFG Node Dest Zone Dest BSFG Node Protocol Port Direction Purpose
Enterprise 10.0.1.10 IDMZ 10.1.1.10 TCP/HTTP2 9443 → AppendFact, FetchFacts, ConfirmReceipt, PutObject
IDMZ 10.1.1.10 Enterprise 10.0.1.10 TCP/HTTP2 9443 → AppendFact, FetchFacts, ConfirmReceipt, PutObject
IDMZ 10.1.1.10 Plant A 10.2.1.10 TCP/HTTP2 9443 → AppendFact, FetchFacts, ConfirmReceipt, PutObject
Plant A 10.2.1.10 IDMZ 10.1.1.10 TCP/HTTP2 9443 → AppendFact, FetchFacts, ConfirmReceipt, PutObject

Firewall Rules (iptables/pf syntax)

# Enterprise → IDMZ
allow tcp from 10.0.1.10 to 10.1.1.10 port 9443

# IDMZ → Enterprise
allow tcp from 10.1.1.10 to 10.0.1.10 port 9443

# IDMZ → Plant A
allow tcp from 10.1.1.10 to 10.2.1.10 port 9443

# Plant A → IDMZ
allow tcp from 10.2.1.10 to 10.1.1.10 port 9443

# Deny all others at boundary (implicit)

Certificate Requirements

Each BSFG node requires a TLS certificate with:

Certificate Validation

On connection, peer verification:

  1. Validate certificate signature against the CA root
  2. Check not expired
  3. Extract zone identity from Subject CN
  4. Verify zone is authorized for the operation (policy-dependent)

Example validation logic:

peer_cert = extract_peer_certificate()
zone_id = peer_cert.Subject.CN

if (zone_id == "enterprise-bsfg") {
  // Enterprise zone — allow AppendFact to IDMZ and Plant
  // Allow FetchFacts from IDMZ and Plant
}

if (zone_id == "idmz-bsfg") {
  // IDMZ zone — allow AppendFact to Enterprise and Plant
  // Allow FetchFacts from Enterprise and Plant
}

No Durable Middleware at Boundary

Forbidden at the boundary network:

Allowed at the boundary:

Monitoring and Alerting

Monitor network paths between BSFG nodes:

VPN and Encryption

If the network path crosses public internet or untrusted networks (e.g., enterprise VPN to cloud plant), consider adding an additional layer:

Note: mTLS is sufficient for encryption. VPN adds a second layer for defense-in-depth.

Deployment Checklist

← Back: Reference Deployment Topology Next: Identity Model →