[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF6GHF5JDSTS30ZY5NJ467":3,"skill-same:01M6AF6GHF5JDSTS30ZY5NJ467":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6AF6GHF5JDSTS30ZY5NJ467","implementing-ics-firewall-with-tofino",null,"Deploys and configures Tofino industrial firewalls (Belden\u002FHirschmann) to protect SCADA systems and PLCs, using deep packet inspection of OT protocols (Modbus, EtherNet\u002FIP, OPC, S7comm) to enforce access control between ICS zones. Use when deploying zone-level firewall protection in front of PLCs\u002FRTUs, enforcing IEC 62443 zone\u002Fconduit boundaries, or adding compensating controls for unpatchable legacy PLCs.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ics-firewall-with-tofino\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"implementing ics firewall with tofino","firewall","ics","scada","deep-packet-inspection","belden","tofino","conduit","t1059","t1078","modbus","security","ot-security","network-security","network","protocols","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-ics-firewall-with-tofino\ndescription: 'Deploys and configures Tofino industrial firewalls (Belden\u002FHirschmann)\n  to protect SCADA systems and PLCs, using deep packet inspection of OT protocols\n  (Modbus, EtherNet\u002FIP, OPC, S7comm) to enforce access control between ICS zones.\n  Use when deploying zone-level firewall protection in front of PLCs\u002FRTUs, enforcing\n  IEC 62443 zone\u002Fconduit boundaries, or adding compensating controls for unpatchable\n  legacy PLCs.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- firewall\n- tofino\n- belden\n- deep-packet-inspection\n- network-security\n- scada\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\n---\n\n# Implementing ICS Firewall with Tofino\n\n## When to Use\n\n- When deploying zone-level firewall protection directly in front of critical PLCs or RTUs\n- When requiring deep packet inspection of industrial protocols (Modbus, EtherNet\u002FIP, OPC, S7comm)\n- When implementing IEC 62443 zone and conduit boundaries with protocol-aware enforcement\n- When protecting legacy PLCs that cannot be patched and need compensating controls\n- When segmenting control network zones without disrupting existing industrial communications\n\n**Do not use** for enterprise IT firewall deployment, for perimeter firewall between IT and OT (use Palo Alto\u002FFortinet at the DMZ), or for environments using only IP-based protocols without OT-specific DPI needs.\n\n## Prerequisites\n\n- Tofino Xenon appliance or Tofino virtual appliance with appropriate license\n- Tofino Central Management Platform (CMP) for centralized policy management\n- Network topology map showing PLC\u002FRTU placement and communication requirements\n- Baseline of OT protocol communications (Modbus function codes, EtherNet\u002FIP CIP services)\n- Change management approval for inline deployment between network zones\n\n## Workflow\n\n### Step 1: Design Tofino Deployment Architecture\n\n```yaml\n# Tofino ICS Firewall Deployment Architecture\n# Zone-level protection using deep packet inspection\n\ndeployment_zones:\n  zone_1_reactor_control:\n    tofino_appliance: \"TOFINO-XN-001\"\n    deployment_mode: \"inline_bridge\"\n    protected_assets:\n      - name: \"PLC-REACTOR-01\"\n        ip: \"10.10.1.10\"\n        vendor: \"Siemens S7-1500\"\n        protocols: [\"S7comm\u002F102\", \"Profinet\"]\n      - name: \"PLC-REACTOR-02\"\n        ip: \"10.10.1.11\"\n        vendor: \"Siemens S7-1500\"\n        protocols: [\"S7comm\u002F102\", \"Profinet\"]\n    authorized_communications:\n      - source: \"10.10.2.50\"  # Engineering workstation\n        dest: \"10.10.1.0\u002F24\"\n        protocols: [\"S7comm\"]\n        access_type: \"engineering\"\n      - source: \"10.10.2.10\"  # HMI server\n        dest: \"10.10.1.0\u002F24\"\n        protocols: [\"S7comm\"]\n        access_type: \"operational\"\n\n  zone_2_packaging:\n    tofino_appliance: \"TOFINO-XN-002\"\n    deployment_mode: \"inline_bridge\"\n    protected_assets:\n      - name: \"PLC-PACK-01\"\n        ip: \"10.10.3.10\"\n        vendor: \"Rockwell ControlLogix\"\n        protocols: [\"EtherNet-IP\u002F44818\", \"CIP\"]\n    authorized_communications:\n      - source: \"10.10.2.20\"  # HMI\n        dest: \"10.10.3.0\u002F24\"\n        protocols: [\"EtherNet-IP\"]\n        access_type: \"operational\"\n\n  zone_3_utilities:\n    tofino_appliance: \"TOFINO-XN-003\"\n    deployment_mode: \"inline_bridge\"\n    protected_assets:\n      - name: \"RTU-BOILER-01\"\n        ip: \"10.10.4.10\"\n        vendor: \"Schneider M340\"\n        protocols: [\"Modbus-TCP\u002F502\"]\n    authorized_communications:\n      - source: \"10.10.2.30\"  # SCADA server\n        dest: \"10.10.4.0\u002F24\"\n        protocols: [\"Modbus-TCP\"]\n        allowed_function_codes: [1, 2, 3, 4]  # Read only from SCADA\n```\n\n### Step 2: Configure Deep Packet Inspection Rules\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Tofino ICS Firewall Rule Generator.\n\nGenerates Tofino firewall rules with deep packet inspection for\nindustrial protocols based on communication baseline analysis.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime\nfrom typing import Dict, List\n\n\nclass TofinoRuleGenerator:\n    \"\"\"Generates Tofino ICS firewall DPI rules.\"\"\"\n\n    def __init__(self):\n        self.rules = []\n        self.rule_id = 1000\n\n    def add_modbus_rule(self, src: str, dst: str, allowed_funcs: List[int],\n                        allowed_registers: List[dict] = None, description: str = \"\"):\n        \"\"\"Generate Modbus DPI rule.\"\"\"\n        func_names = {\n            1: \"read_coils\", 2: \"read_discrete_inputs\",\n            3: \"read_holding_registers\", 4: \"read_input_registers\",\n            5: \"write_single_coil\", 6: \"write_single_register\",\n            15: \"write_multiple_coils\", 16: \"write_multiple_registers\",\n        }\n\n        rule = {\n            \"rule_id\": self.rule_id,\n            \"protocol\": \"Modbus-TCP\",\n            \"action\": \"ALLOW\",\n            \"source\": src,\n            \"destination\": dst,\n            \"port\": 502,\n            \"dpi_policy\": {\n                \"allowed_function_codes\": [\n                    {\"code\": fc, \"name\": func_names.get(fc, f\"FC{fc}\")}\n                    for fc in allowed_funcs\n                ],\n                \"blocked_function_codes\": [\n                    fc for fc in range(1, 128) if fc not in allowed_funcs\n                ],\n            },\n            \"description\": description,\n            \"log\": True,\n        }\n\n        if allowed_registers:\n            rule[\"dpi_policy\"][\"allowed_register_ranges\"] = allowed_registers\n\n        self.rules.append(rule)\n        self.rule_id += 1\n        return rule\n\n    def add_s7comm_rule(self, src: str, dst: str, allowed_operations: List[str],\n                        description: str = \"\"):\n        \"\"\"Generate S7comm DPI rule.\"\"\"\n        operation_map = {\n            \"read\": {\"function\": 0x04, \"name\": \"Read Variable\"},\n            \"write\": {\"function\": 0x05, \"name\": \"Write Variable\"},\n            \"setup\": {\"function\": 0xF0, \"name\": \"Setup Communication\"},\n            \"download\": {\"function\": 0x1A, \"name\": \"Request Download\"},\n            \"upload\": {\"function\": 0x1D, \"name\": \"Start Upload\"},\n            \"cpu_stop\": {\"function\": 0x29, \"name\": \"PLC Stop\"},\n            \"cpu_start\": {\"function\": 0x28, \"name\": \"PI Service (Start)\"},\n        }\n\n        rule = {\n            \"rule_id\": self.rule_id,\n            \"protocol\": \"S7comm\",\n            \"action\": \"ALLOW\",\n            \"source\": src,\n            \"destination\": dst,\n            \"port\": 102,\n            \"dpi_policy\": {\n                \"allowed_operations\": [\n                    operation_map[op] for op in allowed_operations if op in operation_map\n                ],\n                \"block_cpu_stop\": \"cpu_stop\" not in allowed_operations,\n                \"block_program_download\": \"download\" not in allowed_operations,\n            },\n            \"description\": description,\n            \"log\": True,\n        }\n\n        self.rules.append(rule)\n        self.rule_id += 1\n        return rule\n\n    def add_ethernet_ip_rule(self, src: str, dst: str, allowed_services: List[str],\n                              description: str = \"\"):\n        \"\"\"Generate EtherNet\u002FIP CIP DPI rule.\"\"\"\n        rule = {\n            \"rule_id\": self.rule_id,\n            \"protocol\": \"EtherNet-IP\",\n            \"action\": \"ALLOW\",\n            \"source\": src,\n            \"destination\": dst,\n            \"port\": 44818,\n            \"dpi_policy\": {\n                \"allowed_cip_services\": allowed_services,\n                \"block_firmware_flash\": True,\n                \"block_program_download\": \"program_download\" not in allowed_services,\n            },\n            \"description\": description,\n            \"log\": True,\n        }\n\n        self.rules.append(rule)\n        self.rule_id += 1\n        return rule\n\n    def add_default_deny(self):\n        \"\"\"Add default deny rule at the end.\"\"\"\n        self.rules.append({\n            \"rule_id\": 9999,\n            \"protocol\": \"ANY\",\n            \"action\": \"DENY\",\n            \"source\": \"ANY\",\n            \"destination\": \"ANY\",\n            \"port\": \"ANY\",\n            \"description\": \"Default deny - block all unmatched traffic\",\n            \"log\": True,\n        })\n\n    def generate_config(self) -> str:\n        \"\"\"Generate complete Tofino firewall configuration.\"\"\"\n        config = {\n            \"tofino_configuration\": {\n                \"generated\": datetime.now().isoformat(),\n                \"appliance_model\": \"Tofino Xenon\",\n                \"firmware_version\": \"4.2\",\n                \"mode\": \"inline_bridge\",\n                \"failsafe\": \"fail_open\",\n                \"rules\": self.rules,\n            }\n        }\n        return json.dumps(config, indent=2)\n\n    def print_summary(self):\n        \"\"\"Print rule summary.\"\"\"\n        print(f\"\\n{'='*65}\")\n        print(\"TOFINO ICS FIREWALL RULE SUMMARY\")\n        print(f\"{'='*65}\")\n        print(f\"Generated: {datetime.now().isoformat()}\")\n        print(f\"Total Rules: {len(self.rules)}\")\n\n        for rule in self.rules:\n            action_icon = \"+\" if rule[\"action\"] == \"ALLOW\" else \"X\"\n            print(f\"\\n  [{action_icon}] Rule {rule['rule_id']}: {rule.get('description', '')}\")\n            print(f\"      {rule['source']} -> {rule['destination']}:{rule['port']}\")\n            print(f\"      Protocol: {rule['protocol']}\")\n            if \"dpi_policy\" in rule:\n                dpi = rule[\"dpi_policy\"]\n                if \"allowed_function_codes\" in dpi:\n                    funcs = [f[\"name\"] for f in dpi[\"allowed_function_codes\"]]\n                    print(f\"      DPI - Allowed Modbus FCs: {', '.join(funcs)}\")\n                if \"allowed_operations\" in dpi:\n                    ops = [o[\"name\"] for o in dpi[\"allowed_operations\"]]\n                    print(f\"      DPI - Allowed S7 Ops: {', '.join(ops)}\")\n\n\nif __name__ == \"__main__\":\n    gen = TofinoRuleGenerator()\n\n    # SCADA server to Modbus RTUs: read-only\n    gen.add_modbus_rule(\n        src=\"10.10.2.30\",\n        dst=\"10.10.4.0\u002F24\",\n        allowed_funcs=[1, 2, 3, 4],\n        description=\"SCADA to utilities RTUs - read only\",\n    )\n\n    # Engineering workstation to Siemens PLCs: full access\n    gen.add_s7comm_rule(\n        src=\"10.10.2.50\",\n        dst=\"10.10.1.0\u002F24\",\n        allowed_operations=[\"read\", \"write\", \"setup\", \"download\", \"upload\"],\n        description=\"Engineering WS to reactor PLCs - full engineering access\",\n    )\n\n    # HMI to Siemens PLCs: read + write only (no program download)\n    gen.add_s7comm_rule(\n        src=\"10.10.2.10\",\n        dst=\"10.10.1.0\u002F24\",\n        allowed_operations=[\"read\", \"write\", \"setup\"],\n        description=\"HMI to reactor PLCs - operational access only\",\n    )\n\n    # HMI to Rockwell PLCs: operational access\n    gen.add_ethernet_ip_rule(\n        src=\"10.10.2.20\",\n        dst=\"10.10.3.0\u002F24\",\n        allowed_services=[\"read_tag\", \"write_tag\", \"get_attribute\"],\n        description=\"HMI to packaging PLCs - operational access\",\n    )\n\n    gen.add_default_deny()\n    gen.print_summary()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Tofino Xenon | Belden\u002FHirschmann industrial firewall appliance with deep packet inspection for OT protocols |\n| Deep Packet Inspection (DPI) | Examining message payload content beyond headers to enforce fine-grained rules on industrial protocol operations |\n| Inline Bridge Mode | Transparent deployment mode where the firewall sits between network segments without requiring IP changes |\n| Fail-Open | Safety mode where firewall passes all traffic if the appliance fails, maintaining process availability |\n| Loadable Security Module (LSM) | Tofino plugin module providing protocol-specific DPI for Modbus, EtherNet\u002FIP, OPC, or other protocols |\n| Central Management Platform (CMP) | Tofino centralized management server for deploying and managing policies across multiple Tofino appliances |\n\n## Output Format\n\n```\nTOFINO DEPLOYMENT REPORT\n===========================\nDate: YYYY-MM-DD\nAppliances Deployed: [count]\n\nPER-APPLIANCE SUMMARY:\n  [Appliance ID]:\n    Mode: Inline Bridge\n    Failsafe: Fail-Open\n    Protected Assets: [count]\n    Rules: [count]\n    DPI Protocols: [list]\n\nRULE SUMMARY:\n  Allow Rules: [count]\n  Deny Rules: [count]\n  DPI-Enforced Rules: [count]\n\nMONITORING:\n  Blocked Packets (24h): [count]\n  DPI Violations (24h): [count]\n```\n","# Implementing ICS Firewall with Tofino\n\n## When to Use\n\n- When deploying zone-level firewall protection directly in front of critical PLCs or RTUs\n- When requiring deep packet inspection of industrial protocols (Modbus, EtherNet\u002FIP, OPC, S7comm)\n- When implementing IEC 62443 zone and conduit boundaries with protocol-aware enforcement\n- When protecting legacy PLCs that cannot be patched and need compensating controls\n- When segmenting control network zones without disrupting existing industrial communications\n\n**Do not use** for enterprise IT firewall deployment, for perimeter firewall between IT and OT (use Palo Alto\u002FFortinet at the DMZ), or for environments using only IP-based protocols without OT-specific DPI needs.\n\n## Prerequisites\n\n- Tofino Xenon appliance or Tofino virtual appliance with appropriate license\n- Tofino Central Management Platform (CMP) for centralized policy management\n- Network topology map showing PLC\u002FRTU placement and communication requirements\n- Baseline of OT protocol communications (Modbus function codes, EtherNet\u002FIP CIP services)\n- Change management approval for inline deployment between network zones\n\n## Workflow\n\n### Step 1: Design Tofino Deployment Architecture\n\n```yaml\n# Tofino ICS Firewall Deployment Architecture\n# Zone-level protection using deep packet inspection\n\ndeployment_zones:\n  zone_1_reactor_control:\n    tofino_appliance: \"TOFINO-XN-001\"\n    deployment_mode: \"inline_bridge\"\n    protected_assets:\n      - name: \"PLC-REACTOR-01\"\n        ip: \"10.10.1.10\"\n        vendor: \"Siemens S7-1500\"\n        protocols: [\"S7comm\u002F102\", \"Profinet\"]\n      - name: \"PLC-REACTOR-02\"\n        ip: \"10.10.1.11\"\n        vendor: \"Siemens S7-1500\"\n        protocols: [\"S7comm\u002F102\", \"Profinet\"]\n    authorized_communications:\n      - source: \"10.10.2.50\"  # Engineering workstation\n        dest: \"10.10.1.0\u002F24\"\n        protocols: [\"S7comm\"]\n        access_type: \"engineering\"\n      - source: \"10.10.2.10\"  # HMI server\n        dest: \"10.10.1.0\u002F24\"\n        protocols: [\"S7comm\"]\n        access_type: \"operational\"\n\n  zone_2_packaging:\n    tofino_appliance: \"TOFINO-XN-002\"\n    deployment_mode: \"inline_bridge\"\n    protected_assets:\n      - name: \"PLC-PACK-01\"\n        ip: \"10.10.3.10\"\n        vendor: \"Rockwell ControlLogix\"\n        protocols: [\"EtherNet-IP\u002F44818\", \"CIP\"]\n    authorized_communications:\n      - source: \"10.10.2.20\"  # HMI\n        dest: \"10.10.3.0\u002F24\"\n        protocols: [\"EtherNet-IP\"]\n        access_type: \"operational\"\n\n  zone_3_utilities:\n    tofino_appliance: \"TOFINO-XN-003\"\n    deployment_mode: \"inline_bridge\"\n    protected_assets:\n      - name: \"RTU-BOILER-01\"\n        ip: \"10.10.4.10\"\n        vendor: \"Schneider M340\"\n        protocols: [\"Modbus-TCP\u002F502\"]\n    authorized_communications:\n      - source: \"10.10.2.30\"  # SCADA server\n        dest: \"10.10.4.0\u002F24\"\n        protocols: [\"Modbus-TCP\"]\n        allowed_function_codes: [1, 2, 3, 4]  # Read only from SCADA\n```\n\n### Step 2: Configure Deep Packet Inspection Rules\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Tofino ICS Firewall Rule Generator.\n\nGenerates Tofino firewall rules with deep packet inspection for\nindustrial protocols based on communication baseline analysis.\n\"\"\"\n\nimport json\nimport sys\nfrom datetime import datetime\nfrom typing import Dict, List\n\n\nclass TofinoRuleGenerator:\n    \"\"\"Generates Tofino ICS firewall DPI rules.\"\"\"\n\n    def __init__(self):\n        self.rules = []\n        self.rule_id = 1000\n\n    def add_modbus_rule(self, src: str, dst: str, allowed_funcs: List[int],\n                        allowed_registers: List[dict] = None, description: str = \"\"):\n        \"\"\"Generate Modbus DPI rule.\"\"\"\n        func_names = {\n            1: \"read_coils\", 2: \"read_discrete_inputs\",\n            3: \"read_holding_registers\", 4: \"read_input_registers\",\n            5: \"write_single_coil\", 6: \"write_single_register\",\n            15: \"write_multiple_coils\", 16: \"write_multiple_registers\",\n        }\n\n        rule = {\n            \"rule_id\": self.rule_id,\n            \"protocol\": \"Modbus-TCP\",\n            \"action\": \"ALLOW\",\n            \"source\": src,\n            \"destination\": dst,\n            \"port\": 502,\n            \"dpi_policy\": {\n                \"allowed_function_codes\": [\n                    {\"code\": fc, \"name\": func_names.get(fc, f\"FC{fc}\")}\n                    for fc in allowed_funcs\n                ],\n                \"blocked_function_codes\": [\n                    fc for fc in range(1, 128) if fc not in allowed_funcs\n                ],\n            },\n            \"description\": description,\n            \"log\": True,\n        }\n\n        if allowed_registers:\n            rule[\"dpi_policy\"][\"allowed_register_ranges\"] = allowed_registers\n\n        self.rules.append(rule)\n        self.rule_id += 1\n        return rule\n\n    def add_s7comm_rule(self, src: str, dst: str, allowed_operations: List[str],\n                        description: str = \"\"):\n        \"\"\"Generate S7comm DPI rule.\"\"\"\n        operation_map = {\n            \"read\": {\"function\": 0x04, \"name\": \"Read Variable\"},\n            \"write\": {\"function\": 0x05, \"name\": \"Write Variable\"},\n            \"setup\": {\"function\": 0xF0, \"name\": \"Setup Communication\"},\n            \"download\": {\"function\": 0x1A, \"name\": \"Request Download\"},\n            \"upload\": {\"function\": 0x1D, \"name\": \"Start Upload\"},\n            \"cpu_stop\": {\"function\": 0x29, \"name\": \"PLC Stop\"},\n            \"cpu_start\": {\"function\": 0x28, \"name\": \"PI Service (Start)\"},\n        }\n\n        rule = {\n            \"rule_id\": self.rule_id,\n            \"protocol\": \"S7comm\",\n            \"action\": \"ALLOW\",\n            \"source\": src,\n            \"destination\": dst,\n            \"port\": 102,\n            \"dpi_policy\": {\n                \"allowed_operations\": [\n                    operation_map[op] for op in allowed_operations if op in operation_map\n                ],\n                \"block_cpu_stop\": \"cpu_stop\" not in allowed_operations,\n                \"block_program_download\": \"download\" not in allowed_operations,\n            },\n            \"description\": description,\n            \"log\": True,\n        }\n\n        self.rules.append(rule)\n        self.rule_id += 1\n        return rule\n\n    def add_ethernet_ip_rule(self, src: str, dst: str, allowed_services: List[str],\n                              description: str = \"\"):\n        \"\"\"Generate EtherNet\u002FIP CIP DPI rule.\"\"\"\n        rule = {\n            \"rule_id\": self.rule_id,\n            \"protocol\": \"EtherNet-IP\",\n            \"action\": \"ALLOW\",\n            \"source\": src,\n            \"destination\": dst,\n            \"port\": 44818,\n            \"dpi_policy\": {\n                \"allowed_cip_services\": allowed_services,\n                \"block_firmware_flash\": True,\n                \"block_program_download\": \"program_download\" not in allowed_services,\n            },\n            \"description\": description,\n            \"log\": True,\n        }\n\n        self.rules.append(rule)\n        self.rule_id += 1\n        return rule\n\n    def add_default_deny(self):\n        \"\"\"Add default deny rule at the end.\"\"\"\n        self.rules.append({\n            \"rule_id\": 9999,\n            \"protocol\": \"ANY\",\n            \"action\": \"DENY\",\n            \"source\": \"ANY\",\n            \"destination\": \"ANY\",\n            \"port\": \"ANY\",\n            \"description\": \"Default deny - block all unmatched traffic\",\n            \"log\": True,\n        })\n\n    def generate_config(self) -> str:\n        \"\"\"Generate complete Tofino firewall configuration.\"\"\"\n        config = {\n            \"tofino_configuration\": {\n                \"generated\": datetime.now().isoformat(),\n                \"appliance_model\": \"Tofino Xenon\",\n                \"firmware_version\": \"4.2\",\n                \"mode\": \"inline_bridge\",\n                \"failsafe\": \"fail_open\",\n                \"rules\": self.rules,\n            }\n        }\n        return json.dumps(config, indent=2)\n\n    def print_summary(self):\n        \"\"\"Print rule summary.\"\"\"\n        print(f\"\\n{'='*65}\")\n        print(\"TOFINO ICS FIREWALL RULE SUMMARY\")\n        print(f\"{'='*65}\")\n        print(f\"Generated: {datetime.now().isoformat()}\")\n        print(f\"Total Rules: {len(self.rules)}\")\n\n        for rule in self.rules:\n            action_icon = \"+\" if rule[\"action\"] == \"ALLOW\" else \"X\"\n            print(f\"\\n  [{action_icon}] Rule {rule['rule_id']}: {rule.get('description', '')}\")\n            print(f\"      {rule['source']} -> {rule['destination']}:{rule['port']}\")\n            print(f\"      Protocol: {rule['protocol']}\")\n            if \"dpi_policy\" in rule:\n                dpi = rule[\"dpi_policy\"]\n                if \"allowed_function_codes\" in dpi:\n                    funcs = [f[\"name\"] for f in dpi[\"allowed_function_codes\"]]\n                    print(f\"      DPI - Allowed Modbus FCs: {', '.join(funcs)}\")\n                if \"allowed_operations\" in dpi:\n                    ops = [o[\"name\"] for o in dpi[\"allowed_operations\"]]\n                    print(f\"      DPI - Allowed S7 Ops: {', '.join(ops)}\")\n\n\nif __name__ == \"__main__\":\n    gen = TofinoRuleGenerator()\n\n    # SCADA server to Modbus RTUs: read-only\n    gen.add_modbus_rule(\n        src=\"10.10.2.30\",\n        dst=\"10.10.4.0\u002F24\",\n        allowed_funcs=[1, 2, 3, 4],\n        description=\"SCADA to utilities RTUs - read only\",\n    )\n\n    # Engineering workstation to Siemens PLCs: full access\n    gen.add_s7comm_rule(\n        src=\"10.10.2.50\",\n        dst=\"10.10.1.0\u002F24\",\n        allowed_operations=[\"read\", \"write\", \"setup\", \"download\", \"upload\"],\n        description=\"Engineering WS to reactor PLCs - full engineering access\",\n    )\n\n    # HMI to Siemens PLCs: read + write only (no program download)\n    gen.add_s7comm_rule(\n        src=\"10.10.2.10\",\n        dst=\"10.10.1.0\u002F24\",\n        allowed_operations=[\"read\", \"write\", \"setup\"],\n        description=\"HMI to reactor PLCs - operational access only\",\n    )\n\n    # HMI to Rockwell PLCs: operational access\n    gen.add_ethernet_ip_rule(\n        src=\"10.10.2.20\",\n        dst=\"10.10.3.0\u002F24\",\n        allowed_services=[\"read_tag\", \"write_tag\", \"get_attribute\"],\n        description=\"HMI to packaging PLCs - operational access\",\n    )\n\n    gen.add_default_deny()\n    gen.print_summary()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Tofino Xenon | Belden\u002FHirschmann industrial firewall appliance with deep packet inspection for OT protocols |\n| Deep Packet Inspection (DPI) | Examining message payload content beyond headers to enforce fine-grained rules on industrial protocol operations |\n| Inline Bridge Mode | Transparent deployment mode where the firewall sits between network segments without requiring IP changes |\n| Fail-Open | Safety mode where firewall passes all traffic if the appliance fails, maintaining process availability |\n| Loadable Security Module (LSM) | Tofino plugin module providing protocol-specific DPI for Modbus, EtherNet\u002FIP, OPC, or other protocols |\n| Central Management Platform (CMP) | Tofino centralized management server for deploying and managing policies across multiple Tofino appliances |\n\n## Output Format\n\n```\nTOFINO DEPLOYMENT REPORT\n===========================\nDate: YYYY-MM-DD\nAppliances Deployed: [count]\n\nPER-APPLIANCE SUMMARY:\n  [Appliance ID]:\n    Mode: Inline Bridge\n    Failsafe: Fail-Open\n    Protected Assets: [count]\n    Rules: [count]\n    DPI Protocols: [list]\n\nRULE SUMMARY:\n  Allow Rules: [count]\n  Deny Rules: [count]\n  DPI-Enforced Rules: [count]\n\nMONITORING:\n  Blocked Packets (24h): [count]\n  DPI Violations (24h): [count]\n```\n",{"name":5,"tags":47,"author":48,"domain":41,"license":15,"version":49,"nist_csf":50,"subdomain":55,"description":56,"mitre_attack":57},[36,26,25,30,29,28,37,27],"mahipal","1.0",[51,52,53,54],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","Deploys and configures Tofino industrial firewalls (Belden\u002FHirschmann) to protect SCADA systems and PLCs, using deep packet inspection of OT protocols (Modbus, EtherNet\u002FIP, OPC, S7comm) to enforce access control between ICS zones. Use when deploying zone-level firewall protection in front of PLCs\u002FRTUs, enforcing IEC 62443 zone\u002Fconduit boundaries, or adding compensating controls for unpatchable legacy PLCs.\n",[58,59,60,61,62],"T1078","T1190","T1059","T0816","T0836","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-ics-firewall-with-tofino",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ics-firewall-with-tofino",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ics-firewall-with-tofino",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ics-firewall-with-tofino","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ics-firewall-with-tofino\u002FSKILL.md",true,[87,92,98],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ics-firewall-with-tofino\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",1565,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ics-firewall-with-tofino\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",8206,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ics-firewall-with-tofino\u002Fscripts\u002Fagent.py",[105,130,154,181,207,234],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[111],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,35,41,117,118,40,119,120,121,122,123,124,125,126,127,128,129],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[136],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,126,139,140,35,141,41,40,142,143,144,145,146,147,148,149,150,151,152,153],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,165,166,167,168,41,169,170,142,171,172,173,174,175,176,33,177,178,179,180],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,191,41,192,193,194,195,196,197,198,199,200,201,202,203,145,204,205,206],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[213],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,41,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[240],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,242,41,243,244,245,246,247,248,249,250,33,251,177,252,253,254,255,256,257],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]