TIMING MANAGEMENT IN A LARGE FIREWALL CLUSTER

• US 20130152191A1
• Filed: 12/13/2011
• Published: 06/13/2013
• Est. Priority Date: 12/13/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Silbersack, Michael James, Bright, David Andrew, Bucher, Aaron Christopher
• Granted Patent: US 8,955,097 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/30 Decision processes by autonomous network management units using voting and bidding
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A firewall cluster comprises three or more firewall processing nodes, which report primary node status based on the reporting node'"'"'s membership in a preexisting cluster. A controller uses the reported status to assign a primary node in the distributed firewall cluster. Reported primary node status includes reported primary node eligibility if the node is a member of a preexisting cluster, reported primary node status comprising reporting primary node ineligibility if the node is not a member of a preexisting cluster, reported primary node status if the node is a primary node in a preexisting cluster, and reported primary node eligibility in a node that has timed out

Claims

9. A firewall cluster, comprising:

three or more firewall processing nodes, each operable to report primary node status from at least one of the three or more firewall processing nodes based on the reporting node'"'"'s membership in a preexisting cluster; and

a controller operable to manage assignment of a primary node from among the three or more firewall processing nodes.

10. The firewall cluster of claim 9, wherein the controller comprises a firewall node.

11. The firewall cluster of claim 9, wherein reporting primary node status comprising reporting at least one of primary node eligibility in a node that is a member of a preexisting cluster, or primary node ineligibility in a node that is not a member of a preexisting cluster.

12. The firewall cluster of claim 9, wherein reporting primary node status comprising reporting primary node status in a node that is a primary node in a preexisting cluster.

13. The firewall cluster of claim 9, wherein reporting primary node status comprising reporting primary node eligibility in a node that has timed out.

14. The firewall cluster of claim 9, the controller further operable to provide primary node information to the other of the three or more firewall processing nodes.

15. The firewall cluster of claim 14, wherein the provided primary node information comprises primary node IP address and credential information.

16. A method of operating a distributed firewall processing node, comprising:

reporting primary node status based on the reporting node'"'"'s membership in a preexisting cluster.

17. The method of operating a distributed firewall processing node of claim 16, wherein reporting primary node status comprises at least one of reporting primary node eligibility if the node is a member of a preexisting cluster, reporting primary node status comprising reporting primary node ineligibility if the node is not a member of a preexisting cluster, reporting primary node status if the node is a primary node in a preexisting cluster, and reporting primary node eligibility in a node that has timed out.

18. A distributed firewall processing node comprising a processor, operable to report primary node status based on the node'"'"'s membership in a preexisting cluster.

19. The distributed firewall processing node of claim 18, wherein reporting primary node status comprises at least one of reporting primary node eligibility if the node is a member of a preexisting cluster, reporting primary node status comprising reporting primary node ineligibility if the node is not a member of a preexisting cluster, reporting primary node status if the node is a primary node in a preexisting cluster, and reporting primary node eligibility in a node that has timed out.

20. A method of operating a distributed firewall controller, comprising:

assigning one of three or more firewall processing nodes as a primary firewall cluster node based on the node'"'"'s reported primary node status based on the reporting node'"'"'s membership in a preexisting cluster.

21-1. The distributed firewall controller of claim 22, wherein reported primary node status comprises at least one of reported primary node eligibility if the node is a member of a preexisting cluster, reported primary node status comprising reporting primary node ineligibility if the node is not a member of a preexisting cluster, reported primary node status if the node is a primary node in a preexisting cluster, and reported primary node eligibility in a node that has timed out.

22. A distributed firewall controller comprising a processor, operable to assign one of three or more firewall processing nodes as a primary firewall cluster node based on the node'"'"'s reported primary node status based on the reporting node'"'"'s membership in a preexisting cluster.

1. A method of operating a firewall cluster, comprising:

starting a firewall cluster having three or more firewall processing nodes; and

reporting primary node status from at least one of the three or more firewall processing nodes based on the reporting node'"'"'s membership in a preexisting cluster.

2. The method of operating a firewall cluster of claim 1, wherein reporting primary node status comprising reporting primary node eligibility in a node that is a member of a preexisting cluster.

3. The method of operating a firewall cluster of claim 1, wherein reporting primary node status comprising reporting primary node ineligibility in a node that is not a member of a preexisting cluster.

4. The method of operating a firewall cluster of claim 1, wherein reporting primary node status comprising reporting primary node status in a node that is a primary node in a preexisting cluster.

5. The method of operating a firewall cluster of claim 1, wherein reporting primary node status comprising reporting primary node eligibility in a node that has timed out.

6. The method of operating a firewall cluster of claim 1, further comprising assigning an eligible one of the three or more firewall processing nodes as the primary node.

7. The method of operating a firewall cluster of claim 1, further comprising providing primary node information to the other of the three or more firewall processing nodes.

8. The method of operating a firewall cluster of claim 7, wherein the provided primary node information comprises primary node IP address and credential information.

21. The method of operating a distributed firewall controller of claim 20, wherein reported primary node status comprises at least one of reported primary node eligibility if the node is a member of a preexisting cluster, reported primary node status comprising reporting primary node ineligibility if the node is not a member of a preexisting cluster, reported primary node status if the node is a primary node in a preexisting cluster, and reported primary node eligibility in a node that has timed out.