LOAD BALANCING AMONG A CLUSTER OF FIREWALL SECURITY DEVICES

• US 20140143854A1
• Filed: 12/27/2013
• Published: 05/22/2014
• Est. Priority Date: 02/16/2011
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Mihelich, Joe, Lopez, Edward, Hepburn, Matthew F.
• Granted Patent: US 9,270,639 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

A method for balancing load among firewall security devices in a network is disclosed. Firewall security devices are arranged in multiple clusters. A switching device is configured with the firewall security devices by communicating control messages and heartbeat signals. Information regarding the configured firewall security devices is then included in a load balancing table. A load balancing function is configured for enabling the distribution of data traffic received by the switching device. A received data packet by the switching device is forwarded to one of the firewall security devices in a cluster based on the load balancing function, the load balancing table and the address contained in the data packet.

Claims

1. A method for balancing load among firewall security devices in a network, the method comprising:

causing, by a switching device on the network, a plurality of firewall security devices arranged in one or more clusters on the network to enter into a load balancing mode by sending one or more control messages to the plurality of firewall security devices;

receiving, by the switching device, heartbeat signals from the plurality of firewall security devices;

including, by the switching device, information regarding the plurality of firewall security devices into a load balancing table;

configuring a load balancing function in the switching device, wherein the load balancing function enables the switching device to manage more than eight firewall security devices in a cluster;

receiving, by the switching device, a data packet from one or more client devices; and

forwarding, by the switching device, the data packet to a firewall security device of the plurality of firewall security devices based on the load balancing function.

2. The method of claim 1, wherein the load balancing function comprises a hash function.

3. The method of claim 1, wherein configuring the load balancing function further comprises configuring a number of bits from data packets to be used by the load balancing function.

4. The method of claim 3, further comprising configuring one or more rules to generate one or more outcomes, wherein the one or more outcomes are generated based on the number of bits.

5. The method of claim 4, further comprising specifying one or more ports corresponding to the one or more outcomes on the switching device.

6. The method of claim 5, further comprising directing the data packet to the one or more ports.

7. The method of claim 1, further comprising extracting one or more bits from one or both of a source address and a destination address of the data packet.

8. The method of claim 7, further comprising determining a port of the switching device based on the one or more bits and the load balancing table.

9. The method of claim 1, further comprising assigning a Virtual Local Area Network (VLAN) tag to the data packet.

10. A non-transitory computer-readable storage medium readable by one or more processors of a switching device, the computer-readable storage medium tangibly embodying a set of instructions executable by the one or more processors to perform a method for balancing load among firewall security devices, the method comprising:

directing a plurality of firewall security devices arranged in one or more clusters on a network to enter into a load balancing mode by sending one or more control messages to the plurality of firewall security devices;

receiving heartbeat signals from the plurality of firewall security devices;

including information regarding the plurality of firewall security devices into a load balancing table;

configuring a load balancing function that enables the switching device to manage more than eight firewall security devices in a cluster;

receiving a data packet from one or more client devices; and

forwarding the data packet to a firewall security device of the plurality of firewall security devices based on the load balancing function.

11. The non-transitory computer-readable storage medium of claim 10, wherein the load balancing function comprises a hash function.

12. The non-transitory computer-readable storage medium of claim 10, wherein configuring the load balancing function further comprises configuring a number of bits from data packets to be used by the load balancing function.

13. The non-transitory computer-readable storage medium of claim 12, wherein the method further comprises configuring one or more rules to generate one or more outcomes, wherein the one or more outcomes are generated based on the number of bits.

14. The non-transitory computer-readable storage medium of claim 13, wherein the method further comprises specifying one or more ports corresponding to the one or more outcomes on the switching device.

15. The non-transitory computer-readable storage medium of claim 14, wherein the method further comprises directing the data packet to the one or more ports.

16. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises extracting one or more bits from one or both of a source address and a destination address of the data packet.

17. The non-transitory computer-readable storage medium of claim 16, wherein the method further comprises determining a port of the switching device based on the one or more bits and the load balancing table.

18. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises assigning a Virtual Local Area Network (VLAN) tag to the data packet.