Method and apparatus for realizing high availability

Abstract

The embodiment of the invention relates to the field of network security, and particularly relates to a method and apparatus for realizing high availability. The method and apparatus is used for realizing the high availability of a plurality of network security devices. The method comprises the following steps: a first monitoring unit acquires state change information of a first monitored object and receives the state change information of a second monitored object sent by a second monitoring unit, wherein the second monitored object is a master device or a slave device of the first monitored object; the first monitoring unit updates an active / standby state of the first monitored object when the state change information of the first monitored object and the state change information of the second monitored object satisfy a preset active / standby switching condition; a next generation firewall / intrusion prevention system and an ATCA distributed firewall and virtual firewall under the ''parallel forwarding engine'' architecture are compatible at the same time; and when the network security device needs to be changed, the device or the system of the device does not need to be changed or replaced, thereby reducing the operation cost and improving the working efficiency.

Description

technical field [0001] Embodiments of the present invention relate to the field of network security, and in particular, to a method and device for realizing high availability. Background technique [0002] With the wide application of computers and the continuous popularization of the network, the network traffic is also increasing, and it is becoming more and more important to improve the security of the network, and the requirements for the forwarding performance of the next generation firewall (NGFW / IPS) are also increasing. high. Because NGFW / IPS ​​adopts "forwarding engine parallelization" or ATCA distributed technology to improve forwarding performance, it leads to changes in hardware and software architecture. Under the new software and hardware architecture, a more powerful high-availability system is required to match it, so as to ensure the high availability of "parallel forwarding engine" or ATCA distribution. In addition, the development of virtual firewall tec...

AI Technical Summary

Problems solved by technology

[0003] The high-availability system in the existing high-availability (HA) technical solution can only support the next-generation firewall or ATCA distributed firewall or virtual firewall under the "forwarding engine parallelization" architecture alone; no compatible "forwarding engine parallelization" has been found at the same time NGFW / IPS, ATCA distributed firewall and virtual firewall all support the high availability system; if the NGFW / IPS ​​with "forwarding engine parallelization" is originally applied on the device, when it needs to be replaced with a virtual The system is changed or replaced, which increases the cost of operation and reduces work efficiency

Images