Policy based network address translation

• US 8,194,673 B2
• Filed: 06/07/2010
• Issued: 06/05/2012
• Est. Priority Date: 05/28/2003
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Srisuresh, Pyda, Murgia, Marco A., Gunuganti, Ramakanth
• Primary Examiner(s): CHO, HONG SOL
• Application Number:
  US12/795,496
• Publication Number:
  US 20100251335A1
• Time in Patent Office: 729 Days
• Field of Search: None
• US Class Current: 370/392
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system and method is described for providing policy-based Network Address Translation (NAT) configurations wherein each user/resource policy within a network protection device may use a different set of address translation mappings.

Claims

1. A method for applying an access rule to select a user based network address translation maps for accessing an internal network from an external network, the method comprising:

(a) authenticating, by an access management system executing on a device deployed between an external network and an in internal network, a first external user of a plurality of external users;

(b) selecting, by the access management system based on an access rule associated with one or more parameters of the first external user, a first network address translation map from a plurality of different network address translation maps of the plurality of external users; and

(c) determining, by the access management system from the first network address translation map selected for the first external user, an internal internet protocol (IP) address of a resource to be accessed by the first external user.

2. The method of claim 1, wherein step (a) further comprises authenticating, by the access management system, the first external user prior to the first external user accessing resources on the internal network.

3. The method of claim 1, wherein step (b) further comprises selecting the first network address translation map from the plurality of different network address translation maps, based on the access rule associated with an external network address of the first external user.

4. The method of claim 1, wherein step (b) further comprises selecting the first network address translation map from the plurality of different network address translation maps, based on the access rule associated with a time of day of access by the first external user.

5. The method of claim 1, wherein step (b) further comprises selecting the first network address translation map from the plurality of different network address translation maps, based on the access rule associated with a location of the first external user.

6. The method of claim 1, wherein step (b) further comprises selecting the first network address translation map from the plurality of different network address translation maps, based on the access rule associated with a level of authorization.

7. The method of claim 1, wherein step (c) further comprises selecting the first network address translation map comprising a user address map and a resource address map.

8. The method of claim 1, wherein step (c) further comprises determining from the first network address translation map selected for the first external user an internal IP address on the internal network for the first external user.

9. The method of claim 1, further comprising translating, by the device using the first network address translation map selected for the first external user, an external source IP address of a packet received from the external user to an internal user IP address and an external destination IP address of the packet to the internal internet protocol (IP) address of the resource.

10. The method of claim 1, wherein step (c) further comprises determining the internal internet protocol (IP) address of the resource to be accessed by the first external user, the internal IP address of the resource for the first external user is different than a second internal IP address for the same resource for a second external user.

11. A method for using policies to apply a user specific address bind for accessing an internal network from an external network, the method comprising:

(a) determining, by a processor deployed between an external network and an internal network, a flow identifier from a packet received by the processor from an external user;

(b) determining, by the processor via the flow identifier, that the packet is part of a new flow of network traffic between the external user and a resource of the internal network; and

(c) applying, by the processor one or more policies pertaining to the external user and the resource being accessed, to identify a user specific address bind to apply to the new flow of network traffic, the user specific address bind comprising a first mapping of a user internal internet protocol (IP) address to an external source IP address of the packet and a second mapping of an internal IP address of the resource to an external destination IP address of the packet.

12. The method of claim 11, further comprising translating, by an address translator, the received packet using the user specific address bind to generate an outgoing packet to be transmitted on the internal network.

13. The method of claim 11, wherein step (a) further comprises determining, by the processor, the flow identifier from a source IP address and a destination IP address of the packet.

14. The method of claim 11, wherein step (a) further comprises determining, by the device, the external user from a source IP address of the packet.

15. The method of claim 11, wherein step (c) further comprises determining, by the processor, a network address translation map selector from the flow identifier.

16. The method of claim 11, further comprising determining, by the processor, via a second flow identifier for a second packet, that the second packet is part of an existing flow of network traffic of the external user.

17. The method of claim 16, further comprising looking up, by a bind selector, a plurality of active address binds against the second flow identifier.

18. The method of claim 17, further comprising determining, by the bind selector based on the one or more policies, an appropriate address bind from the plurality of active address binds.

19. The method of claim 11, further comprising utilizing, by the processor, a first policy based network address translation table for flows originating from the internal network that is different from a second policy based network address translation table utilized for flows originating from the external network.

20. The method of claim 11, forming, by the processor, the user specific address bind from a network address translation map selected for the external user from a plurality of different network address translation maps of a plurality of external users based on an access rule associated with one or more parameters of the external user.