METHOD AND APPARATUS FOR IMPLEMENTING A LAYER 3/LAYER 7 FIREWALL IN AN L2 DEVICE

• US 20100281533A1
• Filed: 07/08/2010
• Published: 11/04/2010
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Cheung, Lee Chik, Lian, Roger Jia-Jyi, Huang, Guangsong, Mao, Yu Ming
• Granted Patent: US 8,291,114 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

Methods and apparatus for transferring packets in a packet switched communication system. A system is provided that includes an L2 device including a controller determining for each packet received whether the received packet is to be inspected, an inspection device operable to inspect and filter packets identified by the controller including using a zone specific policy and an L2 controller for transferring inspected packets in accordance with L2 header information using L2 protocols.

Claims

1. An L2 device in a packet switched communication system, the packet switched communication system having plural zones, each zone representing a distinct security domain and having an associated policy for use in inspecting packets entering/exiting an associated zone, the L2 device comprising:

at least one port coupled to a terminal unit included in a first security zone;

at least one port coupled to a terminal unit included in a second security zone;

a controller determining for each packet received whether the received packet is destined for another zone;

a firewall engine inspecting and filtering inter-zone packets using a zone specific policy; and

an L2 switching engine immediately transferring to a port all intra-zone packets passing through the L2 device using a table of MAC addresses and corresponding ports, and only transferring to a port inter-zone packets that are retained after the inspection by the firewall engine.

2-27. -27. (canceled)