Firewall clustering for multiple network servers

• US 6,880,089 B1
• Filed: 03/31/2000
• Issued: 04/12/2005
• Est. Priority Date: 03/31/2000
• Status: Expired due to Term

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Avaya Technology Corporation Miami Lakes FLA US
• Inventors: Chaganty, Srinivas, Kale, Makarand, Bommareddy, Satish
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): TRUONG, THANHNGA B
• Application Number:
  US09/540,297
• Time in Patent Office: 1,838 Days
• Field of Search: 713/201, 709/200
• US Class Current: 726/11
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 based on network conditions
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1017 based on a round robin mechanism
• CPC Class Codes: H04L 67/1034 Reaction to server failures by a load balancer
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers

Abstract

A firewall clustering system connects two or more firewalls between an internal network and an external network. The plurality of two or more firewalls are combined to supply high-availability and scaling of processing capacity. Firewalls maintain client-server state information. Flow controllers are connected to the firewalls and placed on both the internal “trusted” side and the external “untrusted” side of the firewalls. Flow controllers are placed on both sides of the firewalls to ensure that traffic for a given client-server session flows through the same firewall in both inbound and outbound directions. The firewalls perform filtering operations and/or network address translation (NAT) services. In both cases, the flow controllers supply high availability, scalability, and traffic distribution for the firewalls in the firewall cluster.

Claims

1. A method of managing message traffic between an interior network and an exterior network in conjunction with a plurality of firewalls securing the interior network from intrusion from the exterior network, the method comprising:

creating a firewall cluster containing a plurality of the firewalls, the firewall cluster being addressed by a logical Internet protocol (IP) address that is distinct from unique IP addresses of firewalls contained within the firewall cluster, and further being addressed by an associated media access control (MAC) address that is distinct from unique MAC addresses of the firewalls contained within the firewall cluster;

in response to a packet addressed to the logical IP address or the associated MAC address, a flow controller that is distinct from the firewalls contained in the firewall cluster selecting a firewall from among the firewalls contained in the firewall cluster on a basis of information in a header of the packet;

in response to the selecting, the flow controller addressing the packet to the MAC address of the selected firewall; and

in response to the addressing, the flow controller sending the packet to the selected firewall for transferring the packet between the interior network and the exterior network via the selected firewall.

2. A method according to claim 1 wherein the creating operation further comprises:

configuring peer flow controllers one for controlling the firewalls in the interior network and another for controlling the firewalls in the exterior network from across an interior-exterior network boundary; and

probing the peer controllers through the firewalls in the interior network and the firewalls in the exterior network across the interior-exterior network boundary.

3. A method according to claim 2 further comprising:

monitoring health of the firewalls via the probing.

4. A method according to claim 1 wherein the creating operation further comprises:

configuring peer flow controllers one for controlling the firewalls in the interior network and another for controlling the firewalls in the exterior network from across an interior-exterior network boundary; and

probing the peer controllers across the interior-exterior network boundary using Ping packets.

5. A method according to claim 1 wherein:

selecting the firewall comprises

identifying a client-server flow based on a source and a destination IP address of the packet and a port; and

selecting the firewall based on the identified client-server flow to transfer all of the packets of the identified client-server flow via same said selected firewall.

6. A method according to claim 1 wherein:

selecting the firewall comprises

when the firewalls perform packet filtering and do not perform network address translation (NAT), selecting the firewall based on a source and a destination IP address and a port.

7. A method according to claim 1 wherein:

selecting the firewall comprises

when the firewalls perform network address translation (NAT), using a packet source IP address to select the firewall for packets of traffic inbound to the interior network, and using a packet destination IP address to select the firewall for packets of traffic outbound to the exterior network.

8. A method according to claim 1 further comprising:

monitoring health of the firewalls by sending Ping packets through individual said firewalls; and

testing operational state of the individual firewalls and internal and external links.

9. The method of claim 1 further comprising:

in response to an address resolution protocol (ARP) request, the flow controller responding with the MAC address associated with the firewall cluster, wherein;

the associated MAC address comprises a MAC address of the flow controller.

10. The method of claim 9 wherein:

the flow controller has its own unique IP address distinct from the logical IP address and the unique IP addresses of the firewalls.

11. The method of claim 1 wherein:

each firewall comprises a different interface of one or more firewall routers.

24. At least one computer-readable storage medium containing instructions which, when executed on at least one computer, cause the computer to function in the fashion of one of the claims 1, 2, 4, 5, 6, 7, 3, 8, 13, 14, 17 or 9, 10, 11, 12, 15, 16, 18, 19, 20, 21, 23, 22.

12. A method of managing message traffic between an interior network and an exterior network in conjunction with a plurality of firewalls securing the interior network from intrusion from the exterior network, comprising:

creating an internal firewall cluster containing a plurality of the firewalls which are in the interior network, the internal firewall cluster being addressed by a first logical Internet Protocol (IP) address that is distinct from unique IP addresses of the firewalls contained within the internal firewall cluster, and further being addressed by a first associated media access control (MAC) address that is distinct from MAC addresses of the firewalls contained within the internal firewall cluster;

creating an external firewall cluster containing a plurality of the firewalls that are in the exterior network, the external firewall cluster being addressed by a second logical IP address that is distinct from unique IP addresses of the firewalls contained within the external firewall cluster, and further being addressed by a second associated MAC address that is distinct from MAC addresses of the firewalls contained within the external firewall cluster;

in response to a first packet outbound to the exterior network and addressed to the first logical IP address or the first associated MAC address, a first flow controller that is associated with the internal firewall cluster and that is distinct from the firewalls contained within the internal firewall cluster selecting a first firewall from among the internal firewall cluster on a basis of information in a header of the first packet;

in response to the selecting of the first firewall, the first flow controller addressing the first packet to the MAC address of the first firewall;

in response to the addressing of the first packet, the first flow controller sending the first packet to the first firewall for transferring the first packet from the interior network via the first firewall;

in response to a second packet inbound to the interior network and addressed to the second logical IP address or the second associated MAC address, a second flow controller that is associated with the external firewall cluster and that is distinct from the firewalls contained within the external firewall cluster selecting a second firewall from among the external firewall cluster on a basis of information in a header of the second packet;

in response to selecting of the second firewall, the second flow controller addressing the second packet to the MAC address of the second firewall; and

in response to the addressing of the second packet, the second flow controller sending the second packet to the second firewall for transferring the second packet from the exterior network via the second firewall.

13. A method according to claim 12 further comprising:

configuring the first logical IP address as a default gateway; and

configuring the second logical external firewall IP address as a next-hop gateway.

14. A method according to claim 12 further comprising:

detecting an address resolution protocol (ARP) request;

the first flow controller responding to the ARP request with the MAC address associated with the internal firewall cluster; and

the second flow controller responding to the ARP request with the MAC address associated with the external firewall cluster.

15. The method of claim 12 wherein:

transferring the first packet comprises

transferring the first packet from the interior network to the exterior network via the first firewall and a corresponding firewall in the external firewall cluster; and

transferring the second packet comprises

transferring the second packet from the exterior network to the interior network via the second firewall and a corresponding firewall in the internal firewall cluster.

16. The method of claim 15 wherein:

each client-server flow is transferred between the interior and the exterior network by a single firewall pair comprising a firewall in the external firewall cluster and a corresponding firewall in the internal firewall cluster.

17. A method according to claim 16 further comprising:

maintaining a list of operational said client-server flows.

18. The method of claim 16 wherein:

each selecting is based on a source IP address and a destination IP address in the header of corresponding said packet.

19. The method of claim 16 wherein:

selecting of the first firewall is based on a source IP address in the header of the first packet, and

selecting of the second firewall is based on a destination IP address in the header of the second packet.

20. The method of claim 12 further comprising:

in response to an address resolution protocol (ARP) request, the first flow controller responding with the first MAC address and the second flow controller responding with the second MAC address, wherein;

the first MAC address comprises a MAC address of the first flow controller, and

the second MAC address comprises a MAC address of the second flow controller.

21. The method of claim 20 wherein:

each flow controller has its own unique IP address distinct from the logical IP addresses and the unique IP addresses of the firewalls.

22. The method of claim 21 further comprising:

the flow controllers sending Ping packets to each other through the firewalls of both of the clusters to monitor health of the firewalls.

23. The method of claim 12 wherein:

each firewall comprises a different interface of one or more firewall routers.

25. An apparatus for managing message traffic between an interior network and an exterior network in conjunction with a plurality of firewalls securing the interior network from intrusion from the exterior network, comprising:

a flow controller defining a firewall cluster containing a plurality of the firewalls, the firewall cluster being addressed by a logical Internet Protocol (IP) address that is distinct from unique IP addresses of firewalls contained within the firewall cluster, and further being addressed by an associated media access control (MAC) address that is distinct from unique MAC addresses of the firewalls contained within the firewall cluster, the flow controller being distinct from the firewalls contained within the firewall cluster and being responsive to a packet addressed to the logical IP address or to the associated MAC address by selecting a firewall from among the firewalls contained in the firewall cluster on a basis of information in a header of the packet, addressing the packet to the MAC address of the selected firewall, and sending the packet to the selected firewall for transfer of the packet by the selected firewall between the interior network and the exterior network.

26. The apparatus of claim 25 wherein:

the flow controller includes a state machine for distributing the traffic among the firewalls in the firewall cluster the state machine comprising

an initial state within which elements of the firewall cluster are assigned a MAC address, the initial state being responsive to an ARP probe;

a bring-up state that is activated on a response to an ARP probe in the initial state; and

an active state that is activated upon receipt of consecutive responses of the ARP probe.

27. The apparatus of claim 26 wherein:

the state machine further comprises;

a take-down state that is activated upon a user-specification while in the active state and transitioning to the initial state on a time-out signal.

28. The apparatus of claim 26 wherein:

the bring-up state transitions to the initial state upon lack of response to ARP probes.

29. The apparatus of claim 26 wherein:

the active state transitions to the initial state upon lack of response to ARP probes or a link-down condition.

30. The apparatus of claim 25 wherein:

the flow controller selects the firewall based on a source IP address and a destination IP address of the packet header.

31. The apparatus of claim 25 wherein:

the flow controller selects the firewall based on either a source IP address of the packet which is inbound to the interior network or a destination IP address of the packet which is outbound to the exterior network.

32. The apparatus of claim 25 wherein:

the flow controller identifies a client-server flow based on the information in the header of the packet and selects the firewall based on the identified client-server flow to transfer all of the packets of the identified client-server flow via same said selected firewall.

33. The apparatus of claim 32 wherein:

the flow controller monitors health of the firewalls by sending Ping packets through individual said firewalls, and selects another firewall of the firewall cluster to transfer the packets of the client-server flow when it detects failure of the selected firewall.

34. The apparatus of claim 25 wherein:

the flow controller has its own unique IP address distinct from the logical IP address and the unique IP addresses of the firewalls.

35. The apparatus of claim 25 wherein:

each firewall comprises a different interface of one or more firewall routers.

36. An apparatus for managing message traffic between an interior network and an exterior network in conjunction with a plurality of firewalls securing the interior network from intrusion from the exterior network, comprising:

a first flow controller defining an internal firewall cluster containing a plurality of the firewalls which are in the interior network, the internal firewall cluster being addressed by a first logical Internet Protocol (IP) address that is distinct from unique IP addresses of the firewalls contained within the internal firewall cluster, and further being addressed by a first associated media access control (MAC) address that is distinct from unique MAC addresses of the firewalls contained within the internal firewall cluster, the first flow controller being associated with the internal firewall cluster, being distinct from the firewalls contained within the internal firewall cluster, and being responsive to a first packet outbound to the exterior network and addressed to the first logical IP address or the first associated MAC address by selecting a first firewall from among the internal firewall cluster on a basis of information in a header of the first packet, addressing the first packet to the MAC address of the first firewall, and sending the first packet to the first firewall for transfer of the packet by the first firewall between the interior network and the exterior network; and

a second flow controller defining an external firewall cluster containing a plurality of the firewalls which are in the exterior network, the external firewall cluster being addressed by a second logical IP address that is distinct from unique IP addresses of the firewalls contained within the external firewall cluster, and further being addressed by a second associated MAC address that is distinct from MAC addresses of the firewalls contained within the external firewall cluster, the second flow controller being associated with the external firewall cluster, being distinct from the firewalls contained within the external firewall cluster, and being responsive to a second packet inbound to the interior network and addressed to the second logical IP address or the second associated MAC address by selecting a second firewall from among the external firewall cluster on a basis of information in a header of the second packet, addressing the second packet to the MAC address of the second firewall, and sending the second packet to the second firewall for transfer of the packet by the second firewall between the exterior network and the interior network.

37. The apparatus of claim 36 wherein:

the first flow controller causes the first packet to be transferred from the interior network to the exterior network via the first firewall and a corresponding firewall in the external firewall cluster; and

the second flow controller causes the second packet to be transferred from the exterior network to the interior network via the second firewall and a corresponding firewall in the internal firewall cluster.

38. The apparatus of claim 37 wherein:

the flow controllers cause each client-server flow to be transferred between the interior and the exterior network by a single firewall pair comprising a firewall in the external firewall cluster and a corresponding firewall in the internal firewall cluster.

39. The apparatus of claim 38 wherein:

each flow controller selects corresponding said firewall based on a source IP address and a destination IP address in the header of corresponding said packet.

40. The apparatus of claim 38 wherein:

the first flow controller selects the first firewall based on a source IP address in the header of the first packet, and

the second flow controller selects the second firewall based on a destination IP address in the header of the second packet.

41. The apparatus of claim 36 wherein:

each flow controller has its own unique IP address distinct from the logical IP addresses and the IP addresses of the firewalls.

42. The apparatus of claim 41 wherein:

the flow controllers send Ping packets to each other through the firewalls of both of the clusters to monitor health of the firewalls.