System and method for redirected firewall discovery in a network environment

• US 9,882,876 B2
• Filed: 05/28/2016
• Issued: 01/30/2018
• Est. Priority Date: 10/17/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Cooper, Geoffrey, Green, Michael W., Guzik, John Richard
• Primary Examiner(s): LE, CHAU D
• Application Number:
  US15/168,004
• Publication Number:
  US 20160352683A1
• Time in Patent Office: 612 Days
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30

Abstract

A method is provided in one example embodiment that includes receiving metadata from a host over a metadata channel. The metadata may be correlated with a network flow and a network policy may be applied to the connection. In other embodiments, a network flow may be received from a host without metadata associated with the flow, and a discovery redirect may be sent to the host. Metadata may then be received and correlated with the flow to identify a network policy action to apply to the flow.

Claims

1. A method for redirected firewall discovery, the method comprising:

transmitting a network flow from a source node to a first firewall;

transmitting, from the source node to a second firewall, metadata associated with the network flow;

receiving, from the first firewall at the source node, a discovery redirect including information identifying the first firewall; and

in response to receiving the discovery redirect, transmitting the metadata from the source node to the first firewall, the metadata associated with a network policy applicable to the network flow at the first firewall.

2. The method of claim 1, further comprising:

in response to receiving the discovery redirect, updating a firewall cache at the source node to include the first firewall as a firewall corresponding to a route associated with the network flow, the updating the firewall cache including adding a subnet associated with the discovery redirect to the firewall cache, or generalizing one or more existing entries in the firewall cache if the discovery redirect overlaps with previously received discovery redirects.

3. The method of claim 1, further comprising:

holding, using a firewall agent at the source node, a connection establishing packet of the network flow until the metadata is transmitted to the first firewall; and

transmitting the connection establishing packet to the first firewall.

4. The method of claim 1, further comprising:

in response to receiving the discovery redirect, authenticating the discovery redirect using a hash-based message authentication code (HMAC), the HMAC including a cryptographic hash function in combination with a secret shared between the first firewall and the source node.

5. The method of claim 1, further comprising:

in response to receiving the discovery redirect, retransmitting a connection establishing packet of the network flow to the first firewall, the connection establishing packet being cached at the source node.

6. A source node for redirected firewall discovery, the source node comprising:

an interface that transmits a network flow to a first firewall and transmits, to a second firewall, metadata associated with the network flow, wherein

the interface receives, from the first firewall, a discovery redirect including information identifying the first firewall, and

the interface is configured to transmit, in response to receiving the discovery redirect, the metadata to the first firewall, the metadata associated with a network policy applicable to the network flow at the first firewall.

7. The source node of claim 6, further comprising:

a processor that performs, in response to a reception of the discovery redirect, an update of a firewall cache at the source node to include the first firewall as a firewall corresponding to a route associated with the network flow, the update including adding a subnet associated with the discovery redirect to the firewall cache, or generalizing one or more existing entries in the firewall cache if the discovery redirect overlaps with previously received discovery redirects.

8. The source node of claim 6, further comprising:

a memory that holds a connection establishing packet of the network flow until the metadata is transmitted to the first firewall, wherein the interface transmits the connection establishing packet to the first firewall.

9. The source node of claim 6, further comprising:

a processor configured to authenticate, in response to a reception of the discovery redirect, the discovery redirect using a hash-based message authentication code (HMAC), the HMAC including a cryptographic hash function in combination with a secret shared between the first firewall and the source node.

10. The source node of claim 6, wherein the interface retransmits, in response to receiving the discovery redirect, a connection establishing packet of the network flow to the first firewall, the connection establishing packet being cached at the source node.

11. A method implemented by a firewall, the method comprising:

intercepting, at the firewall, a connection establishing packet of a network flow received over a network environment from a source node;

determining whether the firewall has metadata associated with the network flow in a metadata cache of the firewall;

in response to determining that the firewall does not have the metadata, transmitting, from the firewall to the source node, a discovery redirect including information to allow the source node to identify the firewall; and

receiving, at the firewall from the source node, the metadata, after the transmitting the discovery redirect to the source node.

12. The method of claim 11, further comprising:

in response to determining that the firewall does not have the metadata;

releasing the network flow without the metadata; and

logging an event that the network flow is released to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node.

13. The method of claim 11, further comprising:

in response to determining that the firewall does not have the metadata;

blocking the network flow without the metadata; and

logging an event that the network flow is blocked to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node.

14. The method of claim 13, wherein the blocking the network flow includes:

dropping the connection establishing packet without attempting to reset a connection associated with the network flow.

15. The method of claim 11, further comprising:

providing, from a host manager at the firewall to a policy module at the firewall, connection data associated with the network flow, the connection data including a source internet protocol address and port, a destination internet protocol address and port, and a protocol; and

correlating, using the policy module at the firewall, the connection data with metadata in the metadata cache to apply a network policy to the network flow.

16. An apparatus that implements a firewall, the apparatus comprising:

an interface that intercepts a connection establishing packet of a network flow received over a network environment from a source node; and

a processor that determines whether the firewall has metadata associated with the network flow in a metadata cache of the firewall, wherein

the interface transmits, in response to a determination that the firewall does not have the metadata, a discovery redirect to the source node, the discovery redirect including information to allow the source node to identify the firewall, and

the interface receives, from the source node, the metadata, after transmitting the discovery redirect to the source node.

17. The apparatus of claim 16, wherein the processor, in response to the determination that the firewall does not have the metadata, both releases the network flow without the metadata and logs an event that the network flow is released to indicate to a host manager that the discovery redirect is to be sent to the source node.

18. The apparatus of claim 16, wherein the network flow is blocked, in response to the determination that the firewall does not have the metadata, and

the processor logs an event that the network flow is blocked to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node, in response to the determination that the firewall does not have the metadata.

19. The apparatus of claim 18, wherein the network flow is blocked by a dropping of the connection establishing packet without an attempt to reset a connection associated with the network flow.

20. The apparatus of claim 16, wherein connection data associated with the network flow is provided from a host manager at the firewall to a policy module at the firewall, the connection data including a source internet protocol address and port, a destination internet protocol address and port, and a protocol, and

the processor correlates, using the policy module at the firewall, the connection data with metadata in the metadata cache to apply a network policy to the network flow.