Firewall for gateway network elements between IP based networks

• US 7,694,021 B1
• Filed: 10/21/2003
• Issued: 04/06/2010
• Est. Priority Date: 05/28/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Friedman, David, James, Stephen, Shombert, Lee, Carle, Jennifer
• Primary Examiner(s): DONAGHUE, LARRY D
• Application Number:
  US10/690,182
• Time in Patent Office: 2,359 Days
• Field of Search: 709/249, 709/227
• US Class Current: 709/249
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL

Abstract

Techniques for implementing a firewall in a gateway network element between two IP based networks is provided. Packets can be filtered out that specify the gateway network element as the source, where the packet comes from the network that is not visible to the other network. For example, if a packet on DCC going to the gateway network element specifies the gateway network element as the source, the packet can be discarded.

Claims

1. A gateway network element that provides access to network elements that are not directly reachable, comprising:

a processor that is directed by code;

code that receives and sends packets over a first IP based interface to a first network;

code that receives and sends packets over a second IP based interface to a second network, wherein IP addresses of network elements in the second network are not visible to network elements in the first network;

code for categorizing the received packets based on the interface over which the packet was received, type of packet, and whether the destination address specifies the gateway network element; and

code that selects and applies a set of filtering rules to the categorized packets based on a category of the received packet, wherein each set of said filtering rules differ from said other sets of filtering rules and comprises rules specifying which of said packets are accepted and which of said packets are rejected;

wherein the first network is a Data Communications Network (DCN) and the second network is a Data Communication Channel (DCC) and the code that applies said filtering rules provides separation between the DCN network and the DCC network.

2. The gateway network element of claim 1, further comprising code that sends packets over the first IP based interface only when the packets specify the gateway network element as the source.

3. The gateway network element of claim 1, further comprising code that accepts all packets received over the first IP based interface in which the destination address specifies the gateway network element, a subnet broadcast address, or a multicast address and rejects all other packets.

4. The gateway network element of claim 1, further comprising code that implements a proxy server that provides forwarding between IP address of the first and second networks.

11. The gateway network element of claim 1 further comprising:

code that accepts packets received over the first IP based interface comprising a destination address which specifies the gateway network element, a subnet broadcast address, or a multicast address; and

code that accepts packets received over the second IP based interface comprising a destination address which specifies the gateway network element, a network element in the second network or a multicast address;

code that drops all other packets received over the first or second IP based interface.

12. The gateway network element of claim 1 wherein one set of filtering rules filters packets received over the first IP based interface with a destination address of the gateway network element and another set of filtering rules filters packets received at the second IP based interface with a destination address of the gateway network element.

13. The gateway network element of claim 1 further comprising code that tunnels connections between a client node and a DCC-connected network element.

14. The gateway network element of claim 1 wherein the first network comprises to a Wide Area Network (WAN) and the second network comprises a Local Area Network (LAN).

18. The gateway network element of claim 1 wherein one of said categories comprises packets received from the first network and another of said categories comprises packets received from the second network.

19. The gateway network element of claim 18 wherein one of said categories comprises packets addressed to the gateway network element.

5. A gateway network element that provides access to network elements that are not directly reachable, comprising:

a processor that is directed by code;

means for receiving and sending packets over a first IP based interface to a first network;

means for receiving and sending packets over a second IP based interface to a second network, wherein IP addresses of network elements in the second network are not visible to network elements in the first network;

means for categorizing the received packets based on the interface over which the packet was received, type of packet, and whether the destination address specifies the gateway network element; and

means for selecting and applying a set of filtering rules to the categorized packets based on a category of the received packet, wherein each set of said filtering rules differ from said other sets of filtering rules and comprises rules specifying which of said packets are accepted and which of said packets are rejected;

wherein the first network is a Data Communications Network (DCN) and the second network is a Data Communication Channel (DCC) and the code that applies said filtering rules provides separation between the DCN network and the DCC network.

15. The gateway network element of claim 5 further comprising means for forwarding filtered packets for analysis by the processor.

16. The gateway network element of claim 5 wherein one set of filtering rules filters packets received over the first IP based interface with a destination address of the gateway network element and another set of filtering rules filters packets received at the second IP based interface with a destination address of the gateway network element.

17. The gateway network element of claim 5, further comprising means for implementing a proxy server that provides forwarding between IP addresses of the first and second networks.

6. A method for providing access to network elements that are not directly reachable, comprising:

receiving and sending packets over a first IP based interface to a first network;

receiving and sending packets over a second IP based interface to a second network, wherein IP addresses of network elements in the second network are not visible to network elements in the first network;

categorizing the received packets based on the interface over which the packet was received, type of packet, and whether the destination address specifies the gateway network element; and

selecting and applying a set of filtering rules to the categorized packets based on a category of the received packet, wherein each set of said filtering rules differ from said other sets of filtering rules and comprises rules specifying which of said packets are accepted and which are rejected;

wherein the first network is a Data Communications Network (DCN) and the second network is a Data Communication Channel (DCC) and applying said filtering rules provides separation between the DCN network and the DCC network.

7. The method of claim 6, further comprising sending packets over the first IP based interface that specify the gateway network element as the source.

8. The method of claim 6, further comprising accepting all packets received over the first IP based interface in which the destination address specifies the gateway network element, a subnet broadcast address, or a multicast address and rejecting all other packets.

9. The method of claim 6, further comprising accepting all packets received over the second IP based interface in which a destination address specifies the gateway network element, a network element in the second network or a multicast address and rejecting all other packets.

10. The method of claim 6, further comprising implementing a proxy server that provides forwarding between IP address of the first and second networks.