Implementation method and device of cloud firewall high availability cluster

Abstract

This invention discloses a method and apparatus for implementing a high-availability cloud firewall cluster, relating to the field of cloud firewall technology. The method includes session-based traffic splitting of data packets using a Session Flow Table (SLB); simplified processing of data streams for ALG-related protocols; and real-time monitoring of the health status and concurrent session count of each firewall node via SLB to achieve dynamic scaling of firewall nodes. This invention supports automatic elastic scaling of cloud firewalls, as well as multi-active high-availability clusters for NAT and ALG scenarios, while avoiding hot session standby between cluster nodes.

Description

Technical Field

[0001] This invention relates to the field of cloud firewall technology, specifically to a method and apparatus for implementing a high-availability cloud firewall cluster. Background Technology

[0002] Like traditional firewalls, cloud firewalls should have stateful inspection and session management mechanisms, meaning that configured policies only apply to the first packet. The first packet refers to the first data packet in the data protocol. When processing a packet, the firewall first checks if it is the first packet. If it is, and the security policy allows it, a session entry is created for that traffic. Subsequent packets can then be forwarded based on the session entry, not the security policy. Stateful inspection and session management mechanisms require that bidirectional data packets from the same flow be sent to the same cloud firewall node for processing; this is called symmetrical routing. Due to the constraints of symmetrical routing, high availability of cloud firewalls generally requires a primary / backup dual-machine deployment, making multi-active clusters difficult to implement. Without NAT and ALG, a symmetrical hash algorithm, hash(source, dest) = hash(dest, source), can be used to symmetrically hash bidirectional data packets from a flow to the same cloud firewall node, achieving symmetrical routing. Otherwise,

[0003] 1. If the cloud firewall supports NAT, the five-tuple of bidirectional data packets in the same flow may not be symmetrical. In this case, the bidirectional data packets may be hashed to different cloud firewall nodes, causing the stateful inspection mechanism to fail.

[0004] 2. If the cloud firewall supports ALG, such as FTP and SIP protocols, these protocols include control channels and data channels. If the Layer 4 port numbers of the sessions corresponding to the two channels are different, the control channel and data channel may hash to different nodes, causing ALG to fail. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and apparatus for implementing a high-availability cloud firewall cluster. It solves the problems of existing cloud firewalls having difficulty in automatic elastic scaling and the existence of hot standby sessions between cluster nodes. This invention improves upon existing high-availability solutions and enables automatic elastic scaling.

[0006] To achieve the above objectives, the present invention provides a method for implementing a high-availability cloud firewall cluster, comprising the following steps:

[0007] Session-based traffic splitting of data packets is performed based on the SLB session traffic splitting table;

[0008] Simplify the data stream of ALG-related protocols;

[0009] By using SLB to monitor the health status and concurrent session count of each FW node in real time, dynamic scaling of FW nodes can be achieved.

[0010] Furthermore, the process of performing session-based traffic splitting on data packets based on the SLB session splitting table specifically includes the following steps:

[0011] The first step is for the SLB to receive data packets and look up the session routing table based on the 5-tuple;

[0012] The second step is to process the first packet if the session routing table is found; otherwise, process subsequent packets.

[0013] Furthermore, the first package processing in the second step specifically includes the following steps:

[0014] S1. Select the target server via SLB;

[0015] S2. After receiving the first packet, the destination FW performs a slow-walk process and sends the response message to the SLB.

[0016] After receiving the response message, S3 and SLB determine the FW's processing result of the data packet.

[0017] Furthermore, S1 specifically includes the following steps:

[0018] S11. Determine if the data packet involves the ALG protocol. If yes, execute S12; otherwise, execute S13.

[0019] S12 and SLB are fixed to select a specific FW as the target FW;

[0020] S13 and SLB use a load balancing algorithm to select the FW with the lowest current load based on the total number of packets received by each FW and the total number of currently active sessions.

[0021] S14. Create an SLB_SESSION_TABLE entry, set the destination FW, set the status of this entry to INIT, and set the aging time to 1 second.

[0022] Furthermore, S2 specifically includes the following steps:

[0023] S21. Check the data packet;

[0024] S22. Determine the inspection result. If the packet is allowed, create a new session. Otherwise, create a new session and discard the packet.

[0025] S23. Encapsulate the processing result in a response message and send it to the SLB.

[0026] Furthermore, S3 specifically includes the following steps:

[0027] S31. If the request is approved, set the status of the corresponding SLB_SESSION_TABLE entry to ACCEPT, set the aging time to 0, update the total number of packets received and the number of active sessions for the destination FW, and queue the pending data packets for this entry.

[0028] S32. If the request is not approved, set the status of the corresponding SLB_SESSION_TABLE entry to DENY, set the aging time to 180 seconds, update the total number of packets received by the destination FW, discard the pending packets in the pending packet queue SLB_SESSION_TABLE_PENDING_Q for this entry, and clear the queue.

[0029] Furthermore, the subsequent packet processing in the second step specifically involves determining the current state of the SLB_SESSION_TABLE entry:

[0030] When the status is DENY, the data packet is discarded;

[0031] When the status is ACCEPT, the data packet is sent to the destination server specified in the entry.

[0032] When the status is IN IT, the data packet is cached in the pending data packet queue SLB_SESSION_TABLE_PENDING_Q of the entry, and will be processed after the entry status changes to DENY or ACCEPT or the entry ages.

[0033] Furthermore, the simplification of the data stream for ALG-related protocols specifically includes the following steps:

[0034] S1 and SLB monitor the total number of packets received and the number of currently active sessions across all servers.

[0035] S2. Determine if the number of FTP or SIP-related sessions has increased. If so, reduce the number of other sessions that SLB distributes to a specific FW.

[0036] Furthermore, the implementation of dynamic scaling of FW nodes specifically includes the following:

[0037] S1. Determine whether the FW node or link is faulty. If so, SLB removes it from the list of available FW nodes and selects a new destination FW node according to the load balancing algorithm.

[0038] S2. Update all entries in the session routing table SLB_SESSION_TABLE whose destination is the faulty FW node, and set the destination FW to the newly selected FW node;

[0039] S3. When the average number of concurrent sessions across all FW nodes exceeds 4 / 5 of the maximum number of concurrent sessions per node, add more FW nodes.

[0040] S4. When the average number of concurrent sessions across all FW nodes is less than half the maximum number of concurrent sessions per node, reduce the number of FW nodes.

[0041] An implementation device for a high-availability cloud firewall cluster includes a traffic offloading module, a simplified processing module, and a dynamic node scaling module, wherein:

[0042] The traffic splitting module is used to perform session traffic splitting on data packets based on the SLB session traffic splitting table.

[0043] The simplified processing module is used to simplify the data stream of ALG-related protocols.

[0044] The node dynamic scaling module is used to monitor the health status and concurrent session count of each FW node in real time through SLB, thereby enabling dynamic scaling of FW nodes.

[0045] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0046] By using the SLB session routing table to perform session routing processing on data packets, the data streams of ALG-related protocols are simplified. The health status and concurrent session count of each FW node are monitored in real time through SLB, enabling dynamic scaling of FW nodes. This not only supports automatic elastic scaling of cloud firewalls, but also supports multi-active high-availability clusters in NAT and ALG scenarios, and avoids hot session standby between cluster nodes. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating a method for implementing a high-availability cloud firewall cluster according to the present invention.

[0048] Figure 2 This is a flowchart of the first packet processing in the implementation method of a cloud firewall high availability cluster of the present invention;

[0049] Figure 3 The flowchart of the first packet processing for selecting the destination FW in the implementation method of a cloud firewall high availability cluster of the present invention is shown below.

[0050] Figure 4 This invention provides a flowchart of the first packet processing and slow-moving processing steps in the implementation method of a cloud firewall high-availability cluster.

[0051] Figure 5 This invention provides a method for implementing a high-availability cloud firewall cluster, which includes a flowchart of the firewall's (FW) data packet processing during the initial packet processing stage.

[0052] Figure 6 This invention provides a simplified flowchart of the data flow processing method for ALG-related protocols in the implementation of a cloud firewall high-availability cluster.

[0053] Figure 7 This invention provides a method for implementing a high-availability cloud firewall cluster, including a flowchart of the dynamic scaling of FW nodes.

[0054] Figure 8 This is a structural diagram of a cloud firewall high-availability cluster implementation device according to the present invention. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] This invention proposes a method and apparatus for implementing a high-availability cloud firewall cluster, which solves the problems of existing cloud firewalls being difficult to automatically and elastically scale and having hot standby sessions between cluster nodes. It improves existing high-availability solutions and enables automatic elastic scaling.

[0057] The technical solution in this application embodiment is to solve the problem that the existing technology is unable to meet the high-concurrency requests of both large and small files. The overall idea is as follows:

[0058] The session routing table based on SLB enables a multi-active high-availability cluster. Special handling is done for ALG-related protocols (such as FTP and SIP) to simplify the solution and improve performance. SLB monitors the health status and concurrent session count of each FW node in real time, enabling horizontal dynamic scaling. It improves existing high-availability solutions and can achieve automatic elastic scaling, while avoiding hot session standby between cluster nodes.

[0059] To better understand the above content, such as Figure 1 The diagram illustrates a method for implementing a high-availability cloud firewall cluster according to an embodiment of this application. This method is applied to an apparatus for implementing a high-availability cloud firewall cluster and includes the following steps: Figure 1 As shown:

[0060] Session-based traffic splitting of data packets is performed based on the SLB session traffic splitting table;

[0061] Simplify the data stream of ALG-related protocols;

[0062] By using SLB to monitor the health status and concurrent session count of each FW node in real time, dynamic scaling of FW nodes can be achieved.

[0063] Specifically, the process of performing session-based traffic splitting on data packets based on the SLB session splitting table includes the following steps:

[0064] The first step is for the SLB to receive data packets and look up the session routing table based on the 5-tuple;

[0065] The second step is to process the first packet if the session routing table is found; otherwise, process subsequent packets.

[0066] In this implementation scheme, the SLB (Session Load Balancer) is a traffic distribution device independent of each firewall node. Traffic first arrives at the SLB and then is distributed to each firewall node. The SLB maintains a session distribution table (SLB_SESSION_TABLE) and a list of available firewall nodes. The SLB itself can be deployed with a primary and backup dual-machine configuration to prevent single points of failure. The SLB_SESSION_TABLE should at least contain the following fields:

[0067] Source IP Destination IP Source port Destination port Protocol Number Purpose FW state Aging time

[0068] The list of available FW nodes is maintained through real-time health checks of each FW node. Communication between the SLB and FW should use a reliable connection, which can be TCP or a proprietary protocol.

[0069] Specifically, the first package processing in the second step includes the following steps, such as... Figure 2 As shown:

[0070] S1. Select the target server via SLB;

[0071] S2. After receiving the first packet, the destination FW performs a slow-walk process and sends the response message to the SLB.

[0072] After receiving the response message, S3 and SLB determine the FW's processing result of the data packet.

[0073] Specifically, S1 includes the following steps, such as Figure 3 As shown:

[0074] S11. Determine if the data packet involves the ALG protocol. If yes, execute S12; otherwise, execute S13.

[0075] S12 and SLB are fixed to select a specific FW as the target FW;

[0076] S13 and SLB use a load balancing algorithm to select the FW with the lowest current load based on the total number of packets received by each FW and the total number of currently active sessions.

[0077] S14. Create an SLB_SESSION_TABLE entry, set the destination FW, set the status of this entry to INIT, and set the aging time to 1 second.

[0078] In this implementation scheme, if it is a protocol involving ALG such as FTP or SIP, SLB will always select a specific server as the destination server. If it does not involve ALG, SLB will use a load balancing algorithm to select the server with the lowest current load based on the total number of packets received by each server and the total number of currently active sessions. It will then create an SLB_SESSION_TABLE entry, set the destination server, set the status of this entry to INIT, and set the aging time to 1 second.

[0079] Specifically, S2 includes the following steps, such as Figure 4 As shown:

[0080] S21. Check the data packet;

[0081] S22. Determine the inspection result. If the packet is allowed, create a new session. Otherwise, create a new session and discard the packet.

[0082] S23. Encapsulate the processing result in a response message and send it to the SLB.

[0083] In this implementation, after the destination FW receives the first packet, it follows a slow transfer process to check the data packet, including checks for malformed packets, attack prevention, access control, and IP addresses. If the packet is allowed, a new session (FW_SESSION_TABLE) is created; otherwise, no session is created and the data packet is discarded. Finally, the processing result is encapsulated in a response message and sent to the SLB.

[0084] Furthermore, S3 specifically includes the following steps, such as... Figure 5 As shown:

[0085] S31. If the request is approved, set the status of the corresponding SLB_SESSION_TABLE entry to ACCEPT, set the aging time to 0, update the total number of packets received and the number of active sessions for the destination FW, and queue the pending data packets for this entry.

[0086] S32. If the request is not approved, set the status of the corresponding SLB_SESSION_TABLE entry to DENY, set the aging time to 180 seconds, update the total number of packets received by the destination FW, discard the pending packets in the pending packet queue SLB_SESSION_TABLE_PENDING_Q for this entry, and clear the queue.

[0087] Specifically, the subsequent packet processing in the second step involves determining the current state of the SLB_SESSION_TABLE entries:

[0088] When the status is DENY, the data packet is discarded;

[0089] When the status is ACCEPT, the data packet is sent to the destination server specified in the entry.

[0090] When the status is IN IT, the data packet is cached in the pending data packet queue SLB_SESSION_TABLE_PENDING_Q of the entry, and will be processed after the entry status changes to DENY or ACCEPT or the entry ages.

[0091] In this implementation plan, the following three situations will trigger the session aging process on SLB:

[0092] 1) When the FW_SESSION_TABLE session on the FW ages, notify the SLB to delete the corresponding entry in the SLB_SESSION_TABLE.

[0093] 2) If the session timer on the SLB with the SLB_SESSION_TABLE status set to DENY times out, delete the table entry.

[0094] 3) When the session timer of SLB_SESSION_TABLE with state INI T on the SLB times out, delete the table entry and clear the pending data packets in the queue of that table entry, SLB_SESSION_TABLE_PENDING_Q.

[0095] Specifically, the simplification of the data stream of ALG-related protocols includes the following steps, such as... Figure 6 As shown:

[0096] S1 and SLB monitor the total number of packets received and the number of currently active sessions across all servers.

[0097] S2. Determine if the number of FTP or SIP-related sessions has increased. If so, reduce the number of other sessions that SLB distributes to a specific FW.

[0098] In this implementation, the SLB consistently sends data streams from ALG-related protocols such as FTP and SIP to a specific server (FW), rather than selecting the lowest-loaded FW based on a load balancing algorithm. This simplifies the SLB's processing logic and improves processing performance.

[0099] The special handling of ALG-related protocols will not cause the load on a specific server (FW) to be higher than that on other FWs, because SLB monitors the total number of packets received and the number of currently active sessions across all FWs, and performs load balancing among FWs based on these statistics. If the number of FTP or SIP-related sessions increases, the number of other sessions distributed by SLB to that specific FW will decrease accordingly.

[0100] Specifically, the implementation of dynamic scaling of FW nodes includes the following: Figure 7 As shown:

[0101] S1. Determine whether the FW node or link is faulty. If so, SLB removes it from the list of available FW nodes and selects a new destination FW node according to the load balancing algorithm.

[0102] S2. Update all entries in the session routing table SLB_SESSION_TABLE whose destination is the faulty FW node, and set the destination FW to the newly selected FW node;

[0103] S3. When the average number of concurrent sessions across all FW nodes exceeds 4 / 5 of the maximum number of concurrent sessions per node, add more FW nodes.

[0104] S4. When the average number of concurrent sessions across all FW nodes is less than half the maximum number of concurrent sessions per node, reduce the number of FW nodes.

[0105] In this implementation, if a certain FW node fails or a link fails, the SLB removes it from the list of available FW nodes, selects a new destination FW node according to the load balancing algorithm, updates all entries in the session routing table SLB_SESSION_TABLE whose destination is the failed FW node, and sets the destination FW to the newly selected FW node.

[0106] Add more FW nodes when the average number of concurrent sessions across all FW nodes exceeds 4 / 5 of the maximum number of concurrent sessions per node.

[0107] When the average number of concurrent sessions across all FW nodes is less than half the maximum number of concurrent sessions per node, reduce the number of FW nodes.

[0108] The embodiments of this application provide an implementation apparatus for a cloud firewall high-availability cluster, such as... Figure 8 As shown, it includes a traffic splitting module, a simplified processing module, and a node dynamic scaling module, wherein:

[0109] The traffic splitting module is used to perform session traffic splitting on data packets based on the SLB session traffic splitting table.

[0110] The simplified processing module is used to simplify the data stream of ALG-related protocols.

[0111] The node dynamic scaling module is used to monitor the health status and concurrent session count of each FW node in real time through SLB, thereby enabling dynamic scaling of FW nodes.

[0112] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages:

[0113] By using the SLB session routing table to perform session routing processing on data packets, the data streams of ALG-related protocols are simplified. The health status and concurrent session count of each FW node are monitored in real time through SLB, enabling dynamic scaling of FW nodes. This not only supports automatic elastic scaling of cloud firewalls, but also supports multi-active high-availability clusters in NAT and ALG scenarios, and avoids hot session standby between cluster nodes.

[0114] A computer-readable storage medium for storing a program that, when executed by a processor, implements the method for implementing a cloud firewall high-availability cluster.

[0115] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0117] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0118] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0119] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0120] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for implementing a high-availability cloud firewall cluster, characterized in that, Includes the following steps: Session-based traffic splitting of data packets is performed based on the SLB session splitting table; Simplify the data packets related to ALG protocols; By using SLB to monitor the health status and concurrent session count of each FW node in real time, dynamic scaling of FW nodes can be achieved. The process of performing session-based traffic splitting on data packets based on the SLB session traffic splitting table specifically includes the following steps: The first step is for the SLB to receive data packets and look up the session routing table based on the 5-tuple; The second step is to process the first packet if the session routing table is found; otherwise, process the subsequent packets. The second step, the initial package processing, specifically includes the following steps: S1. Select the target server via SLB; S2. After receiving the first packet, the destination FW performs a slow-walk process and sends the response message to the SLB. After receiving the response message, S3 and SLB determine the result of the destination FW's processing of the data packet; S1, which selects the destination server via SLB, specifically includes the following steps: S11. Determine if the data packet involves the ALG protocol. If yes, execute S12; otherwise, execute S13. S12 and SLB are fixed to select the preset FW as the target FW; S13 and SLB use a load balancing algorithm to select the FW with the lowest current load based on the total number of packets received by each FW and the total number of currently active sessions. S14. Create an SLB_SESSION_TABLE entry, set the destination FW, set the status of this entry to INIT, and set the aging time to 1 second; In step S2, after receiving the first packet, the destination FW performs a slow-walk process and sends a response message to the SLB, which specifically includes the following steps: S21. Check the data packet; S22. Determine the inspection result. If the packet is allowed, create a new session; otherwise, discard the packet. S23. Encapsulate the processing result in a response message and send it to the SLB; The subsequent packet processing in the second step specifically involves determining the current state of the SLB_SESSION_TABLE entries: When the status is DENY, the data packet is discarded; When the status is ACCEPT, the data packet is sent to the destination server specified in the entry. When the status is INIT, the data packet is cached in the pending data packet queue SLB_SESSION_TABLE_PENDING_Q of this table entry, and will be processed after the table entry status changes to DENY or ACCEPT or the table entry ages. The simplification of ALG-related protocol data packets specifically includes the following steps: S1 and SLB monitor the total number of packets received and the number of currently active sessions across all servers. S2. Determine if the number of FTP or SIP related sessions has increased. If so, reduce the number of other sessions that SLB distributes to the destination FW selected based on the preset FW.

2. The method for implementing a high-availability cloud firewall cluster according to claim 1, characterized in that: S3 specifically includes the following steps: S31. If the request is approved, set the status of the corresponding SLB_SESSION_TABLE entry to ACCEPT, set the aging time to 0, update the total number of packets received and the number of active sessions of the destination FW, send the pending data packets in the pending data packet queue SLB_SESSION_TABLE_PENDING_Q of the entry to the destination FW, and clear the queue. S32. If the packet is not allowed, set the status of the corresponding SLB_SESSION_TABLE entry to DENY, set the aging time to 180 seconds, update the total number of packets received by the destination FW, discard the pending packets in the pending packet queue SLB_SESSION_TABLE_PENDING_Q for this entry, and clear the queue.

3. The method for implementing a high-availability cloud firewall cluster according to claim 1, characterized in that: The implementation of dynamic scaling of FW nodes specifically includes the following: S1. Determine if the FW node or link is faulty. If so, SLB removes it from the list of available FW nodes and selects a new destination FW node according to the load balancing algorithm. S2. Update all entries in the session routing table SLB_SESSION_TABLE where the destination FW is the faulty FW node, and set the destination FW to the newly selected FW node; S3. When the average number of concurrent sessions across all FW nodes exceeds 4 / 5 of the maximum number of concurrent sessions per node, add more FW nodes. S4. When the average number of concurrent sessions across all FW nodes is less than half the maximum number of concurrent sessions per node, reduce the number of FW nodes.

4. An implementation apparatus for a cloud firewall high-availability cluster, used to implement the implementation method according to any one of claims 1 to 3, characterized in that, It includes a traffic offloading module, a simplified processing module, and a node dynamic scaling module, among which: The traffic splitting module is used to perform session traffic splitting on data packets based on the SLB session traffic splitting table. The simplification module is used to simplify data packets related to ALG protocols. The node dynamic scaling module is used to monitor the health status and concurrent session count of each FW node in real time through SLB, thereby enabling dynamic scaling of FW nodes.

Images