Scalable security services for multicast in a router having integrated zone-based firewall

• US 8,713,627 B2
• Filed: 04/29/2009
• Issued: 04/29/2014
• Est. Priority Date: 08/14/2008
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Frailong, Jean-Marc, Venkatramani, Anjan, Varadhan, Kannan
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): LEUNG, ROBERT B
• Application Number:
  US12/432,366
• Publication Number:
  US 20100043067A1
• Time in Patent Office: 1,826 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 45/30 Routing of multiclass traffic
• CPC Class Codes: H04L 45/645 Splitting route computation layer and forwarding layer, e.g. routing according to path computational element [PCE] or based on OpenFlow functionality
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A multicast-capable firewall allows firewall security policies to be applied to multicast traffic. The multicast-capable firewall may be integrated within a routing device, thus allowing a single device to provide both routing functionality, including multicast support, as well as firewall services. The routing device provides a user interface by which a user specifies one or more zones to be recognized by the integrated firewall when applying stateful firewall services to multicast packets. The user interface supports a syntax that allows the user to define subsets of the plurality of interfaces associated with the zones, and define a single multicast policy to be applied to multicast sessions associated with a multicast group. The multicast policy identifies common services to be applied pre-replication, and exceptions specifying additional services to be applied post-replication to copies of the multicast packets for the one or more zones.

Claims

1. A network router comprising:

a plurality of interfaces configured to send and receive multicast packets;

a firewall integrated within the network router, the firewall configured to apply stateful firewall services to the multicast packets;

a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network, wherein the control unit executes at least one multicast protocol to establish a multicast group for communicating the multicast packets from a multicast source to a plurality of multicast receivers;

a forwarding engine configured by the routing engine to select next hops for the multicast packets in accordance with the routing information, the forwarding engine comprising a switch fabric to forward the multicast packets to the interfaces based on the selected next hops, wherein the forwarding engine includes a flow control module that, upon receiving multicast packets from the network, directs one or more of the multicast packets to the firewall for application of the stateful firewall services; and

a user interface by which a user specifies one or more zones to be recognized by the firewall when applying the stateful firewall services to the multicast packets, wherein the user interface supports a syntax that;

(i) allows the user to define subsets of the plurality of interfaces associated with the zones, and

(ii) allows the user to define a single multicast policy to be applied to multicast sessions associated with a multicast group, wherein the multicast policy specifies actions to be applied to multicast sessions for the specified zones,

wherein the syntax allows the user to define the single multicast policy to specify one or more common stateful firewall services of the stateful firewall services to be applied by the firewall to copies of the multicast packets destined for one or more of the zones, and to specify one or more exceptions specifying one or more of the zones and one or more additional services of the stateful firewall services to be applied by the firewall to copies of the multicast packets for the one or more zones; and

a services component executing on the firewall, wherein the services component is configured to determine, based on the single multicast policy, which of the common stateful firewall services are to be applied by the firewall pre-replication to copies of the multicast packets destined for two or more particular interfaces in the one or more of the zones,

wherein the services component is configured to determine, based on the single multicast policy, which of the additional services of the stateful firewall services are to be applied by the firewall post-replication to copies of the multicast packets destined for one or more particular interfaces associated with the one or more zones,

wherein the firewall is configured to apply the stateful firewall services to the multicast packets as determined by the services component.

2. The network router of claim 1, wherein the syntax allows the user to define the single multicast policy with a single command.

3. The network router of claim 1, wherein the routing engine is configured to create multicast replication trees that specify a manner in which multicast packets are to be replicated for transmission to the multicast receivers, and installs the multicast replication trees to a multicast forwarding information base (FIB) associated with the forwarding engine.

4. The network router of claim 3, wherein the routing engine is configured to create a multicast replication tree for a multicast group and install the multicast replication tree to the multicast FIB upon the network router receiving a first multicast packet of a multicast session associated with the multicast group.

5. The network router of claim 3,

wherein, prior to creating the multicast replication tree, the routing engine is configured to provide an outgoing interface (OIF) list to the services component, wherein the services component modifies the OIF list based on the defined multicast policy, and provides the modified OIF to the routing engine as a plurality of separate OIF sub-lists that represent those OIFs for which the one or more common stateful firewall services are to be applied and those OIFs corresponding to exceptions specifying the one or more additional stateful firewall services to be applied, and wherein the routing engine creates and installs to the multicast FIB a multicast replication tree for each of the OIF sub-lists.

6. The network router of claim 5, wherein upon receiving a multicast action request from one of the multicast receivers indicating a change in membership status relative to a multicast group, the services component is configured to provide the routing engine with updated OIF sub-lists based on the change.

7. The network router of claim 1, wherein when the firewall is configured with a default policy that permits forwarding of those packets for which no matching policy exists, the routing engine creates a forwarding OIF list that separately specifies those OIFs for which firewall need provide no stateful firewall services.

8. The network router of claim 1, wherein the firewall maintains a multicast session table that includes an entry that specifies the:

(a) one or more common stateful firewall services to be applied to copies of the multicast packets destined for two or more outgoing interfaces of the network router, and (b) one or more exceptions specifying one or more outgoing interfaces and additional services of the stateful firewall services to be applied to copies of the multicast packets for the one or more outgoing interfaces.

9. The network router of claim 8, wherein upon receiving a multicast action request from one of the multicast receivers indicating a change in membership status relative to a multicast group, the firewall is configured to update the multicast session table to reflect the change in membership status.

10. The network router of claim 1, wherein the firewall stores configuration data that specifies the zones and the multicast policy defined by the user.

11. The network router of claim 1,

wherein the firewall determines an input zone and one or more output zones for each of the multicast packets based on the zones defined by the user, and

wherein the firewall applies one or more of the stateful firewall services to each of the multicast packets based on the input zone determined for the multicast packet in accordance with the defined multicast policy.

12. The network router of claim 1,

wherein, based on the routing information, the routing engine programs the forwarding engine with forwarding information that associates network destinations with specific next hops and corresponding interface ports of interface cards of the router and a specific next hop that points to the firewall,

wherein the routing engine programs the firewall with at least a portion of the forwarding information, and

wherein the routing engine programs the forwarding engine with multiple specific next hops and corresponding interface ports of interface cards of the router, wherein each of the multiple specific next hops corresponds to one of a plurality of stateful firewall services applied by the firewall.

13. The network router of claim 12, wherein the routing engine programs the firewall with the plurality of stateful firewall services to be applied by the firewall.

14. The network router of claim 1, wherein the user interface is a text-based interface that supports a command syntax that allows the user to specify the zones.

15. The network router of claim 1, wherein the stateful firewall services include virus scanning of application-layer data carried by the multicast packets.

16. The network router of claim 1, wherein the network router comprises one of a provider edge router, a Broadband Remote Access Server (BRAS), a Broadband Network Gateway (BNG), Cable Modem Termination System (CMTS), a Multi-Service Edge router (MSE), a Gateway GPRS (General Packet Radio Services) Support Node (GGSN), a Packet Data Serving Node (PDSN), or a Public Data Network Gateway (PDN-GW), a data center device that provides routing and security functions for packets flowing in or out of a data center, a peering router that serves as a point of interconnection between network service providers.

17. A method comprising:

executing, with a routing engine of a router, at least one multicast protocol to establish a multicast group for communicating multicast packets from a multicast source to a plurality of multicast receivers;

presenting, with the router, a user interface by which a user specifies one or more zones to be recognized by a firewall integrated within the router, wherein the user interface supports a syntax that;

(i) allows the user to define subsets of the plurality of interfaces associated with the zones, wherein the plurality of interfaces is configured to send and receive multicast packets, and (ii) allows the user to define a single multicast policy to be applied to multicast sessions associated with a multicast group, wherein the multicast policy specifies actions to be applied to multicast sessions for the specified zones,

wherein the syntax allows the user to define the single multicast policy to specify one or more common stateful firewall services to be applied by the firewall to copies of the multicast packets destined for one or more of the zones, and to specify one or more exceptions specifying one or more of the zones one or more additional stateful firewall services to be applied by the firewall to copies of the multicast packets for the one or more zones,

determining, by a services component executing on the firewall and based on the single multicast policy, which of the common stateful firewall services are to be applied by the firewall pre-replication to copies of the multicast s packets destined for two or more s particular interfaces in the one or more of the zones,

determining, by the services component executing on the firewall and based on the single multicast policy, which of the additional services of the stateful firewall services are to be applied by the firewall post-replication to copies of the multicast packets destined for one or more particular interfaces associated with the one or more zones,

receiving, from a network, multicast packets at a plurality of interfaces of the router;

directing, with a flow control module of a forwarding engine of the router, one or more of the received multicast packets to the firewall for application of stateful firewall services;

applying the one or more common stateful firewall services and the one or more additional stateful firewall services to the multicast packets with the firewall of the router as determined by the services component;

after applying the stateful firewall services, forwarding at least some of the multicast packets from the firewall to the forwarding engine;

selecting next hops for the multicast packets within the network with the forwarding engine; and

forwarding the multicast packets to the interfaces in accordance with the selected next hops.

18. The method of claim 17, further comprising:

for a received multicast packet, determining an input zone for the received multicast packet based on an input interface on which the multicast packet is received; and

applying one or more of the stateful firewall services to the multicast packet based on the input zone determined for the multicast packet.

19. The method of claim 17, further comprising storing within the router configuration data that specifies the zones and the multicast policy defined by the user.

20. The method of claim 17, further comprising:

receiving a first multicast packet of a multicast session associated with a multicast group;

upon receiving the first multicast packet, creating, with the routing engine, a multicast replication tree for the multicast group; and

installing the multicast replication tree to a multicast forwarding information base (FIB) associated with the forwarding engine.

21. The method of claim 20, further comprising:

prior to creating the multicast replication tree, the routing engine providing an outgoing interface (OIF) list to a services component executing on the firewall;

modifying, by the services component, the OIF list based on the defined multicast policy;

providing the modified OIF to the routing engine as a plurality of separate OIF sub-lists that represent those OIFs for which the one or more common stateful firewall services are to be applied and those OIFs corresponding to the exceptions specifying the one or more additional stateful firewall services to be applied;

creating, with the routing engine, a multicast replication tree for each of the OIF sub-lists; and

installing the multicast replication trees to the multicast FIB.

22. A non-transitory computer-readable storage medium comprising program instructions to cause a processor to:

execute, with a routing engine of a router, at least one multicast protocol to establish a multicast group for communicating multicast packets from a multicast source to a plurality of multicast receivers;

present, with the router, a user interface by which a user specifies one or more zones to be recognized by a firewall integrated within the router, wherein the user interface supports a syntax that;

(i) allows the user to define subsets of the plurality of interfaces associated with the zones, wherein the plurality of interfaces is configured to send and receive multicast packets, and

(ii) allows the user to define a single multicast policy to be applied to multicast sessions associated with a multicast group, wherein the syntax allows the user to define the single multicast policy to specify;

(a) one or more common stateful firewall services to be applied by the firewall to copies of the multicast packets destined for one or more of the zones, and

(b) one or more exceptions specifying one or more of the zones and one or more additional stateful firewall services to be applied by the firewall to copies of the multicast packets for the one or more zones,

determine, based on the single multicast policy, which of the common stateful firewall services are to be applied by the firewall pre-replication to copies of the multicast packets destined for two or more particular interfaces in the one or more of the zones; and

determine, based on the single multicast policy, which of the additional services of the stateful firewall services are to be applied by the firewall post-replication to copies of the multicast packets destined for one or more particular interfaces associated with the one or more zones.