APPARATUS FOR DEFINING A SET OF RULES FOR A PACKET FORWARDING DEVICE

• US 20100088742A1
• Filed: 08/31/2009
• Published: 04/08/2010
• Est. Priority Date: 03/03/2006
• Status: Active Grant

• Current Assignee: Barracuda Networks Incorporated
• Original Assignee: Barracuda Networks Incorporated
• Inventors: WIRYAMAN, SANTA, SRIDHAR, MANICKAM R.
• Granted Patent: US 7,987,267 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

There are methods and apparatus, including computer program products, for defining a policy including a set of rules for a packet forwarding device by receiving information sufficient to enable a first rule related to one of security or traffic management to be defined, and based on the received information, enabling a corresponding second rule related to the other one of security or traffic management to be defined.

Claims

1. An apparatus comprising:

management logic

to receive information sufficient to enable a first rule related to one of security or traffic management to be defined,

enable a corresponding second rule related to the other one of security or traffic management to be defined based on the received information, and

store attributes of the first rule and attributes of the second rule in a configuration database; and

coordination logic

to send a first signal to a first engine of a packet forwarding device to notify the first engine of the newly-stored attributes of the first rule, and

send a second signal to a second engine of the packet forwarding device to notify the second engine of the newly-stored attributes of the second rule.

2. The apparatus of claim 1, wherein the information sufficient to enable the first rule related to one of security or traffic management to be defined is provided by a user using a graphical user interface.

3. The apparatus of claim 2, wherein the second rule related to the other one of security or traffic management is automatically defined without requiring any further input to be received from the user.

4. The apparatus of claim 1, wherein the second rule related to the other one of security or traffic management is defined without requiring any further information to be received by the management logic.

5. The apparatus of claim 1, wherein the first rule is related to security and the first engine is a security engine;

and the second rule is related to traffic management and the second engine is a quality of service engine.

6. The apparatus of claim 1, wherein the first rule is related to traffic management and the first engine is a quality of service engine;

and the second rule is related to security and the second engine is a security engine.

7. The apparatus of claim 1, wherein the coordination logic is to configure a first engine and a second engine of a packet forwarding device that is capable of processing data packets passing between a local area network and a wide area network.

8. An apparatus comprising a computer having a display device comprising a processor adapted by a program product to receive user selections and information, wherein the information includes attributes of IP address matching parameters, operation parameters, and service parameters.

9. The apparatus of claim 8 further comprising user selections to define a coupling of source and destination traffic by specifying “

Source IP address” and

“

Destination IP address”

attributes as a condition to apply the security rule, upon a match made between IP addresses.

10. The apparatus of claim 9 further comprising user specification of an action to be taken using operation parameters wherein the action is one of

“

drop”

(i.e., deny access to packets that match the source and destination IP address),

“

reject”

(i.e., deny access to packets that match the source and destination IP address and send a response to the node(s) originating the packet(s)), and

“

accept”

(i.e., allow access to packets that match the source and destination IP address).

11. The apparatus of claim 10 further comprising

user selection of one or more services to which a security rule is to be applied from a list of services that are generally categorized by type comprising:

under the “

Basic Web Utilities”

service type;

FTP—

File Transfer, HTTP—

Web Server, IMAP—

Messaging Server, NNTP—

News Server, SNMP—

Simple Network Management Protocol, and TELNET—

Remote Connection;

under the “

Chat and VoIP Applications”

service type;

SIP, Net2Phone, H.323 Call Signaling, and MGCP; and

under the “

Gaming”

service type;

Delta Force, Quake III, and Warbirds 2.

12. The apparatus of claim 11 further comprising user selection of a traffic management class to which a security rule is to be linked, wherein “

Default”

traffic management class is a standard class of service in which no special processing is performed by the traffic management engine other than limiting the total bandwidth of all packets used by all services in the standard class of service to be within the bandwidth of the connection.

13. The apparatus of claim 12 further comprising

a traffic management settings screen which allows the user to enter various pieces of information to customize a traffic management rule;

the entered information comprising;

a total amount of bandwidth that is guaranteed to this class of data flows,

whether rate shaping applies to a class of data flows,

burst bandwidth,

priority, and

type of service.

14. The apparatus of claim 13 further comprising,

wherein type of service is a voice service,

user selection of a maximum number of calls to be simultaneously permitted per codec for the premium class of service associated with the voice service.

15. An apparatus comprising a computer having a display device comprising a processor adapted by a program product to store attributes of a rule in the configuration database, and automatically create and store linking information between a security rule and a traffic management class.

16. The apparatus of claim 15 wherein attributes of a rule comprises information that categorizes services comprising SIP, Net2Phone, and H.323 as being voice services that are sensitive to both delay and delay variations, and linking information that data flows associated with SIP, Net2Phone, and H.323 are a premium traffic management class of data flows.

17. The apparatus of claim 16 wherein attributes of a rule comprises information that categorizes services comprising Citrix, PPTP, and TELNET as being time-sensitive data services, and linking information that data flows associated with Citrix, PPTP, and TELNET are a critical traffic management class of data flows.

18. The apparatus of claim 17 wherein said processor, adapted by a program product,

identifies the classes of data flows associated with the services selected by the user in the security settings screen, and generates class-based traffic management rules based on the respective defaults, when a user clicks on an “

OK”

button on a security settings screen.

19. The apparatus of claim 18 wherein said processor, adapted by a program product

automatically generates two traffic management rules:

(1) a traffic management rule for the premium class of data flows based on the user selection of SIP; and

(2) a traffic management rule for the critical class of data flows based on the user selection of Citrix;

stores the attributes of the security rule in the configuration database and automatically creates and stores the linking information between the security rule and the traffic management class(es)

when a user selects SIP and Citrix as being the services to which the security rule is applied.

20. The apparatus of claim 19 wherein a processor, adapted by a program product sends notification signals to a security engine and a traffic management engine indicating that the configuration database has been updated;

retrieves the attributes associated with the security rules from the configuration database, loads the retrieved attributes,

retrieves the attributes associated with the traffic management rules from the configuration database,

loads the retrieved attributes, and

restarts itself when a user selects an “

Apply”

button.