ROUTING DEVICE HAVING INTEGRATED MPLS-AWARE FIREWALL
First Claim
1. A network router comprising:
- a plurality of interfaces configured to send and receive packets;
a firewall integrated within the network router, the firewall configured to apply stateful firewall services to the packets;
a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network, wherein the control unit executes at least one protocol to establish virtual private network (VPN) tunnels for one or more customer VPNs;
a forwarding engine configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding engine comprising a switch fabric to forward the packets to the interfaces based on the selected next hops, wherein the forwarding engine includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the firewall for application of the stateful firewall services; and
a user interface by which a user specifies one or more zones to be recognized by the firewall when applying the stateful firewall services to the packets, each of the zones defined by a list of one or more of the interfaces, wherein the user interface supports a syntax that allows the user to define the zones by specifying the customer VPNs within lists of interfaces associated with the zones.
1 Assignment
0 Petitions
Accused Products
Abstract
An MPLS-aware firewall allows firewall security policies to be applied to MPLS traffic. The firewall, which may be integrated within a routing device, can be configured into multiple virtual security systems. The routing device provides a user interface by which a user specifies one or more zones to be recognized by the integrated firewall when applying stateful firewall services to the packets. The user interface allows the user to define different zones and policies for different ones of the virtual security systems. In addition, the user interface supports a syntax that allows the user to define the zones for the firewall by specifying the customer VPNs as interfaces associated with the zones. The routing device generates mapping information for the integrated firewall to map the customer VPNs to specific MPLS labels for the MPLS tunnels carrying the customer'"'"'s traffic.
-
Citations
24 Claims
-
1. A network router comprising:
-
a plurality of interfaces configured to send and receive packets; a firewall integrated within the network router, the firewall configured to apply stateful firewall services to the packets; a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network, wherein the control unit executes at least one protocol to establish virtual private network (VPN) tunnels for one or more customer VPNs; a forwarding engine configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding engine comprising a switch fabric to forward the packets to the interfaces based on the selected next hops, wherein the forwarding engine includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the firewall for application of the stateful firewall services; and a user interface by which a user specifies one or more zones to be recognized by the firewall when applying the stateful firewall services to the packets, each of the zones defined by a list of one or more of the interfaces, wherein the user interface supports a syntax that allows the user to define the zones by specifying the customer VPNs within lists of interfaces associated with the zones. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. A method comprising:
-
executing, with a routing engine of a router, at least one protocol to establish virtual private network (VPN) tunnels for one or more customer VPNs; presenting, with the router, a user interface by which a user specifies one or more zones to be recognized by a firewall integrated within the router, wherein the user interface supports a syntax that allows the user to define the zones by specifying one or more the customer VPNs as interfaces associated with the zones; receiving, from a network, packets at a plurality of interfaces of the router; directing, with a flow control module of a forwarding engine of the router, one or more of the received packets to the firewall for application of stateful firewall services; applying stateful firewall services to the packets with the firewall of the network router based on the zones specified by the user; after applying stateful firewall services, forwarding at least some of the packets from the firewall to the forwarding engine; selecting next hops for the packets within the network with the forwarding engine; and forwarding the packets to the interfaces in accordance with the selected next hops. - View Dependent Claims (15, 16, 17, 18, 19, 20, 21, 22, 23)
-
-
24. A computer-readable storage medium comprising program instructions to cause a processor to:
-
execute, with a routing engine of a router, at least one protocol to establish virtual private networks (VPN) tunnels to carry VPN communications for a plurality of customer VPNs; and present, with the router, a user interface by which a user specifies one or more zones to be recognized by a firewall integrated within the router, wherein the user interface supports a syntax that allows the user to define the zones by specifying one or more of the customer VPNs as interfaces associated with the zones.
-
Specification