System and method for redirected firewall discovery in a network environment

• US 9,356,909 B2
• Filed: 04/28/2014
• Issued: 05/31/2016
• Est. Priority Date: 10/17/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Cooper, Geoffrey, Green, Michael W., Guzik, John Richard
• Primary Examiner(s): LE, CHAU D
• Application Number:
  US14/263,164
• Publication Number:
  US 20140237584A1
• Time in Patent Office: 764 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30

Abstract

A method is provided in one example embodiment that includes receiving metadata from a host over a metadata channel. The metadata may be correlated with a network flow and a network policy may be applied to the connection. In other embodiments, a network flow may be received from a host without metadata associated with the flow, and a discovery redirect may be sent to the host. Metadata may then be received and correlated with the flow to identify a network policy action to apply to the flow.

Claims

1. One or more computer-readable non-transitory media comprising one or more instructions that, when executed on at least one processors, configure the processor to perform one or more operations for redirected firewall discovery, the one or more operations comprising:

transmitting a network flow from a source node to a first firewall;

transmitting, from the source node to a second firewall, metadata associated with the network flow;

receiving, from the first firewall at the source node, a discovery redirect comprising information identifying the first firewall; and

in response to receiving the discovery redirect, transmitting, from the source node to the first firewall, the metadata associated with the network flow, wherein the metadata is associated with a network policy applicable to the network flow at the first firewall.

2. The one or more computer-readable non-transitory media of claim 1, wherein the second firewall no longer manages a route associated with the network flow.

3. The one or more computer-readable non-transitory media of claim 1, wherein the operations further comprises:

in response to receiving the discovery redirect, updating a firewall cache at the source node to include the first firewall as a firewall corresponding to a route associated with the network flow.

4. The one or more computer-readable non-transitory media of claim 3, wherein updating the firewall cache comprises adding a subnet associated with the discovery redirect to the firewall cache, or generalizing one or more existing entries in the firewall cache if the discovery redirect overlaps with previously received discovery redirects.

5. The one or more computer-readable non-transitory media of claim 1, wherein the operations further comprises:

prior to transmitting the metadata associated with the network flow to the second firewall, determining that the second firewall corresponds to a route associated with the network flow in a firewall cache at the source node.

6. The one or more computer-readable non-transitory media of claim 1, wherein the operations further comprises:

prior to transmitting metadata associated with the network flow to the first firewall, identifying in a firewall cache at the source node that the first firewall corresponds to a route associated with the network flow.

7. The one or more computer-readable non-transitory media of claim 6, wherein the operations further comprises:

holding, using a firewall agent at the source node, a connection establishing packet of the network flow being transmitted to the first firewall until the metadata is transmitted to the first firewall; and

transmitting the connection establishing packet to the first firewall.

8. The one or more computer-readable non-transitory media of claim 1, wherein transmitting the metadata from the source node to the first firewall, further comprises:

opening a Datagram Transport Layer Security protocol connection between the source node and the first firewall; and

transmitting the metadata from the source node to the first firewall over the connection.

9. The one or more computer-readable non-transitory media of claim 1, wherein the operations further comprises:

in response to receiving the discovery redirect, authenticating the discovery redirect using a hash-based message authentication code (HMAC), wherein the HMAC includes a cryptographic hash function in combination with a secret shared between the first firewall and the source node.

10. The one or more computer-readable non-transitory media of claim 1, wherein the operations further comprises:

in response to receiving the discovery redirect, retransmitting a connection establishing packet of the network flow to the first firewall, wherein the connection establishing packet is cached at the source node.

11. One or more computer-readable non-transitory media comprising one or more instructions that, when executed on at least one processors, configure the processor to perform one or more operations for redirected firewall discovery, the one or more operations comprising:

intercepting, at a firewall, a connection establishing packet of a network flow being transmitted over a network environment from a source node;

determining whether the firewall has metadata associated with the network flow in a metadata cache of the firewall;

in response to determining that the firewall does not have metadata associated with the network flow, transmitting, from the firewall to the source node, a discovery redirect comprising information allowing the source node to identify the firewall; and

receiving, at the firewall from the source node, the metadata associated with the network flow after transmitting the discovery redirect to the source node.

12. The one or more computer-readable non-transitory media of claim 11, wherein the one or more operations further comprises:

retrieving, using a policy module at the firewall, one or more network policies applicable to the network flow based on the metadata; and

applying the network policy at the firewall to the network flow.

13. The one or more computer-readable non-transitory media of claim 11, wherein the one or more operations further comprises:

in response to determining that the firewall does not have metadata associated with the network flow;

releasing the network flow without having the metadata associated with the network flow; and

logging an event that the network flow is released without the metadata to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node.

14. The one or more computer-readable non-transitory media of claim 11, wherein the one or more operations further comprises:

in response to determining that the firewall does not have metadata associated with the network flow;

blocking the network flow without having the metadata associated with the network flow; and

logging an event that the network flow is blocked without the metadata to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node.

15. The one or more computer-readable non-transitory media of claim 14, wherein blocking the network flow without having the metadata associated with the network flow comprises:

dropping the connection establishing packet without attempting to reset a connection associated with the network flow.

16. The one or more computer-readable non-transitory media of claim 11, wherein the one or more operations further comprises:

storing the metadata in a metadata cache in the firewall after receiving the metadata from the source node.

17. The one or more computer-readable non-transitory media of claim 16, wherein the one or more operations further comprises:

providing, from a host manager at the firewall to the policy module at the firewall connection data associated with the network flow, wherein the connection data includes source internet protocol address and port, destination internet protocol address and port, and protocol; and

correlating, using a policy module at the firewall, the connection data with metadata in the metadata cache to apply a network policy to the network flow.

18. The one or more computer-readable non-transitory media of claim 11, wherein the metadata includes connection data for the network flow, the connection data having source internet protocol address and port, destination internet protocol address and port, and protocol.

19. The one or more computer-readable non-transitory media of claim 11, wherein the metadata associated with the network flow further includes session descriptor data, the session descriptor data having one or more of the following:

information about a user associated with an application transmitting the network flow, and information about the application.

20. The one or more computer-readable non-transitory media of claim 11, wherein the metadata associated with the network flow further includes session descriptor data, the session descriptor data having one or more of the following:

information about a state of the source node, information about a state of a firewall at the source node, information about antivirus software running on the source node, information about interfaces on the source node, information about an intrusion prevention system, information about routing information, and vendor information.