Network safety allocating method and network safety device

Abstract

The invention discloses a network safety allocating method. The method comprises the following steps: a plurality of firewall cards are formed a cluster, one firewall card selected from the cluster isused as the main firewall card, and other firewall cards are used as auxiliary firewall cards; the main firewall card realizes synchronization of information configuration and synchronization of service situation information for all firewall cards in the cluster; service ports of the firewall cards in the cluster are polymerized into a polymerizing port group, a load sharing arithmetic is configured on the polymerizing port group, and the service flow entering the cluster realizes load sharing among the firewall cards of the cluster. The invention also discloses a network safety device. The invention can realize uniform load sharing among the firewall cards and has the advantages of flexible network connection and simple configuration.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security deployment method and a network security device. Background technique [0002] With the deepening of network applications, network security becomes more and more important. Integrating network security into network applications and network equipment is an inevitable trend of current and future network development. At present, various equipment manufacturers have launched firewall cards deployed on switches. [0003] Through the firewall plug-in card, users can flexibly and quickly integrate security functions such as firewall and virtual private network (VPN) in the Ethernet switch to achieve a high degree of integration of network and security protection. [0004] The current firewall plug-in card has fully realized the forwarding mechanism of the three-layer switch, which makes the firewall extremely flexible to be applied in the increasingly popul...

AI Technical Summary

Problems solved by technology

[0011] Existing methods can only simply realize the load sharing of traffic by configuring multiple gateways or through routing design. This load sharing needs to be artificially designed and can only be based on IP address segments. Strictly speaking, it is not a real load sharing , the resulting problems are inflexible business differentiation, large networking restrictions, uneven traffic sharing, complex configuration, etc.

The existing method can only realize the hot backup function of dual firewall cards, and lacks scalability, that is, when three or more firewall cards realize load sharing, the hot backup function cannot be realized

In addition, the way of deploying the firewall plug-in card as a server gateway is inflexible, and the way of implementing load sharing through routing design is complicated to configure in actual deployment.

Images