Policy based network address translation

• US 20050013298A1
• Filed: 05/28/2004
• Published: 01/20/2005
• Est. Priority Date: 05/28/2003
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Murgia, Marco A., Srisuresh, Pyda, Gunuganti, Ramakanth
• Granted Patent: US 7,760,729 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system and method is described for providing policy-based Network Address Translation (NAT) configurations wherein each user/resource policy within a network protection device may use a different set of address translation mappings.

Claims

1. A method of performing policy-based network address translation in a system for protecting a network segment, the method comprising:

identifying an originating user of a first packet in a flow;

identifying a network resource that is a destination of the first packet in the flow;

selecting at least one predefined network address translation map based at least in part on the originating user and the network resource, wherein the map includes a plurality of user addresses corresponding to network resources; and

using the selected at least one predefined network address translation map to modify addresses in at least one packet in the flow.

2. The method of claim 1, wherein said identifying an originating user includes determining whether the user is inside or outside the protected network segment.

3. The method of claim 1, wherein said identifying a network resource includes determining whether the network resource is inside or outside the protected network segment.

4. The method of claim 1, further comprising using the selected at least one predefined network address translation map to modify addresses in at least one packet in the packet flow from the network resource to the originating user.

5. A device for performing policy-based network address translation in a system for protecting a network segment, the device comprising:

a flow identifier to identify a source and a destination of the first packet of a flow;

a map selector, connected to the flow identifier, to select a network address translation map based on a policy associated with the source and the destination of the first packet of the flow;

an address translator that uses the selected network address translation map to perform appropriate address translations.

6. A network protection system comprising:

a gateway connecting a private network to a public network, the gateway being in communication with at least one network resource in the private network and at least one user in the public network; and

a network address translation function, operating within the gateway, that translates addresses of packets from the at least one user to the at least one network resource and from the at least one network resource to the at least one user based on the identification of the at least one user and the at least one network resource.

7. A method of performing policy-based network address translation, the method comprising:

identifying flow identification data for a first packet flow, wherein the flow identification data includes an originating user; and

using a network address translation map to translate at least a portion of the flow identification data, wherein the map includes a plurality of user addresses that correspond to at least one common network resource, wherein the translation is based at least in part of the originating user.

8. The method of claim 7, wherein at least a portion of the flow identification data that is translated is an identification for destination of the first packet flow.

9. The method of claim 7, wherein said using a network address translation map includes translating an original destination address associated with the originating user to a new destination address.

10. The method of claim 7, wherein said using a network address translation map includes translating an original destination address associated with the originating user to a resource and the resource to a new destination address.

11. The method of claim 7, wherein the network translation map is referenced as part of a policy associated with the originating user.

12. The method of claim 7, wherein said identifying flow identification data includes determining whether the originating user is internal or external to a protected network segment.

13. The method of claim 7, wherein said identifying flow identification data includes determining whether a destination resource is internal or external to a protected network segment.

14. In a device for protecting a network segment, a method of performing policy-based network address translation, the method comprising:

receiving a first packet flow;

identifying flow identification data for the first packet flow, including data corresponding to an originating user and a destination resource;

selecting at least one network address translation map based at least in part on the originating user and the destination resource, wherein the map includes a plurality of user addresses that correspond to the destination resource;

using the selected at least one network address translation map to translate at least a part of the flow identification data for the first packet flow; and

forwarding the first packet flow having the translated flow identification data to the destination resource.

15. A device for performing policy-based network address translation in a system for protecting a network segment, the device comprising:

a flow identifier to identify a flow;

a map selector, connected to the flow identifier, to select a network address translation map based on a policy associated with the flow;

an address mapper that uses the selected network address translation map to find appropriate address translations; and

an address translator that uses the address translations from the address mapper to modify addresses in at least one packet in the flow.

16. A network protection system comprising:

a gateway connecting a private network to a public network, the gateway being in communication with at least one user in the private network and at least one network resource in the public network; and

a network address translation function, operating within the gateway, that translates addresses of packets from the at least one user to the at least one network resource and from the at least one network resource to the at least one user based on the identification of the at least one user and the at least one network resource.