Systems and Methods for Bridging a WAN Accelerator with a Security Gateway

• US 20090067440A1
• Filed: 09/07/2007
• Published: 03/12/2009
• Est. Priority Date: 09/07/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: ANKAM, Shiva, CHADDA, Sanjay, DITTIA, Zubin, DECASPER, Dan, SAMUELS, Allen
• Granted Patent: US 8,908,700 B2
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

The solution described herein provides systems and methods for the interoperability of network processing programs that process network packets at different levels of the network stack. This solution bridges the communications of a network packet between a first network processing program operating at a first level of a network stack in an intermediary and a second network processing program operating at a second level of the network stack of the intermediary. The first network processing program may modify an incoming network packet so that the packet may traverse the network stack to an upper level of the stack to the second network processing program. After processing the network packet at the upper layers of the stack or by the second network processing program, the first network processing program modifies the network pack in order to transmit the packet to the intended destination while traversing the intermediary.

Claims

1. A method of an intermediary for interfacing a network optimization engine accelerating network communications at a first network layer of a network stack with a security gateway applying policies at a second network layer above the first network layer, the method comprising the steps of:

(a) receiving, by a network optimization engine operating at a first network layer of a network stack of an intermediary, a network packet from a source, the network packet comprising a media access control address identifying a destination for the network packet;

(b) determining, by the network optimization engine, that a source media access control address of the network packet identifies a network interface card;

(c) modifying, by the network optimization engine in response to the determination, the destination media access control address of the network packet to identify a network interface of the intermediary;

(d) receiving, by a security gateway operating at a second network layer of the intermediary, the network packet communicated by the network optimization engine, the second network layer comprising a layer of the network stack above the first network layer;

(e) applying, by the security gateway, one or more policies to the network packet;

(f) receiving, by the network optimization engine, the network packet communicated by the security gateway via the network stack;

(g) modifying, by the network optimization engine, the destination media access control address of the network packet to identify the media access control address of the destination; and

(h) transmitting, by the intermediary, the network packet to the destination via a second network interface card.

2. The method of claim 1, wherein step (b) further comprises storing the media access control address of the destination from the received network packet to a storage element.

3. The method of claim 1, wherein step (b) further comprises storing a media access control address of the source from the received network packet to a storage element.

5. The method of claim 1, wherein step (g) further comprises retrieving, by the network optimization engine, the media access control address of the destination from a storage element.

6. The method of claim 1, determining by the network optimization engine that the first network interface card communicates network packets on a Local Area Network, and in response to the determination, not applying a WAN network optimization.

7. The method of claim 1, determining by the network optimization engine that the second network interface card communicates network packets on a Wide Area Network, and in response to the determination, applying a WAN network optimization to transmission of the network packet.

8. The method of claim 1, wherein the intermediary comprises an appliance deployed between the source and the destination.

9. The method of claim 1, wherein the intermediary comprises an agent of the source.

10. The method of claim 1, wherein the first network layer comprises one of a layer 2 or a data link layer of a TCP/IP network stack.

11. The method of claim 1, wherein the second network layer comprises a network layer above one of a layer 2 or a data link layer of a TCP/IP network stack.

4. The method of claim 4, wherein step (g) further comprises modifying, by the network optimization engine, a source media access control address of the network packet to include the media access control address of the source from the received network packet.

12. An intermediary for accelerating and applying security policies between a source and a destination, the intermediary comprising an interface between a network optimization engine that accelerates network communications at a first network layer of a network stack with a security gateway applying policies at a second network layer above the first network layer, the intermediary comprising:

a first network interface card receiving a network packet from a source, the network packet comprising a media access control address of the destination;

a network optimization engine operating at a first network layer of a network stack obtaining the network packet received by the first network interface card, determining that a source media control access address of the network packet identifies a network interface card, modifying a destination media access control address of the network packet to identify a network interface of the intermediary, and communicating the network packet via the network stack;

a security gateway operating at a second network layer of the network stack above the first network layer receiving the network packet communicated via the network stack, the security gateway applying one or more policies to the network packet and communicating the network packet via the network stack;

wherein the network optimization engine receives the network packet communicated by the security gateway, modifies the destination media access control address of the network packet to identify the media access control address of the destination, and transmits the network packet to the destination via a second network interface card.

13. The intermediary of claim 12, wherein the network optimization engine stores the media access control address of the destination received by the first network interface card to a storage element.

14. The intermediary of claim 12, wherein the network optimization engine stores the media access control address of the source received by the first network interface card to a storage element.

15. The intermediary of claim 12, wherein the network optimization engine modifies the network packet communicated from the security gateway to include the media access control address of the source.

16. The intermediary of claim 12, wherein the network optimization engine retrieves the media access control address of the destination from a storage element.

17. The intermediary of claim 12, wherein the network optimization engine determines that the first network interface card communicates network packets on a Local Area Network, and in response to the determination, does not apply a WAN network optimization.

18. The intermediary of claim 12, wherein the network optimization engine determines that the second network interface card communicates network packets on a Wide Area Network, and in response to the determination, applies a WAN network optimization to transmission of the network packet.

19. The intermediary of claim 12, wherein the intermediary is an appliance.

20. The intermediary of claim 12, wherein the intermediary is a client agent.

21. The intermediary of claim 12, wherein the network optimization engine operates at one of a layer 2 or a data link layer of a TCP/IP network stack.

22. The intermediary of claim 12, wherein the security gateway operates at one of a layer 2 or a data link layer of a TCP/IP network stack.