A firewall device and method for treatment of secondary forwarding message

Abstract

The invention provides a method for a firewall to process layer two forwarding message, which comprises sending the received target message that needs layer two forwarding to a layer two forward-in array, executing outgoing interface inquiry, three-layer header information identification and firewall processing to the message in the layer two forward-in array according to a MAC address table, carrying out MAC address study by using the message processed by the firewall and still needs layer two forwarding, studying the MAC address and saving the studied MAC address information into the MAC address table, and forwarding the message that needs layer two forwarding according to the inquired outgoing interface. The invention further provides a firewall device. The adoption of the invention can improve the forwarding performance of the firewall to the layer two message.

Description

technical field [0001] The invention relates to a two-layer message forwarding technology, in particular to a firewall device and a method for processing two-layer forwarded messages. Background technique [0002] According to the needs of the network topology, in the actual environment, many firewalls only work in Layer 2 mode, which is called transparent firewall. In addition to completing Layer 2 forwarding similar to Layer 2 switches, transparent firewalls can also handle various security services, such as preventing various Dos / DDos attacks, packet filtering based on Layer 2 and Layer 3, and transport layer Protocol state detection and processing, etc. In some actual user environments, in addition to requiring complete and robust firewall functions, high-performance processing of firewall security services is also proposed. [0003] Based on this, after the firewall performs security processing or judgment on the received message, it performs Layer 2 forwarding on the...

AI Technical Summary

Problems solved by technology

[0021] 2. MAC drift phenomenon

[0030] It can be seen that for the outbound interface with the MAC address of 00e0-fc00-0001, E1 / 0 is changed to E1 / 1, which causes all data packets in the LAN to be sent to USER_A, thus causing interruption between the LAN network and the outside world

[0031] 3. The system overhead caused by the unreliability of MAC learning

[0032] Same as the above point 2, when the firewall is attacked by a large number of source MAC addresses that are constantly changing and illegal packets are intruded, the firewall will still learn its MAC address, resulting in unreliable and non-secure MAC addresses in the firewall MAC table.

At the same time, the firewall will continue to learn these untrusted MAC addresses, which will increase the overhead of the system to a certain extent.

Images