Firewall traffic balancing method and device, electronic equipment and storage medium
By calculating the firewall identifier through a load balancer, it is ensured that both forward and reverse traffic are processed through the same firewall, thus solving the problem of unbalanced firewall load and improving the firewall's processing efficiency.
Patent Information
- Application Number
- CN202510512122.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-23
- Publication Date
- 2025-10-24
- Estimated Expiration
- 2045-04-23
AI Technical Summary
In existing technologies, firewalls are prone to load imbalance when handling multiple sessions, resulting in low processing efficiency.
The load balancer performs a hash calculation based on the preset firewall port number, the load balancer's port number, and the 5-tuple information to determine the firewall identifier. It then matches the same firewall in both forward and reverse traffic to ensure that data is processed through the same firewall.
It achieves balanced processing of firewall traffic, improves processing efficiency, ensures that request and return data pass through the same firewall, and improves the overall performance of the system.
Smart Images
Figure CN120034540B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the network security technical field, and in particular to a firewall traffic balancing method and device, electronic equipment and storage medium. BACKGROUND
[0002] With the continuous development of network technology, in order to the security of data transmission, it is necessary to provide a firewall for data transmission equipment, and if there are many simultaneous sessions, multiple sessions will use the same firewall for data transmission, and there will also be an idle firewall at the same time, which will cause the problem of unbalanced load. Therefore, how to improve the efficiency of firewall traffic balancing is a problem that needs to be solved at present. SUMMARY
[0003] Some embodiments of the present application aim to provide a firewall traffic balancing method, device, electronic equipment and storage medium. Through the technical solutions of the embodiments of the present application, the load balancing device receives the service request sent by the client through the preset firewall; according to the port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request, the first firewall identifier corresponding to the service request is determined; according to the service request, the service data corresponding to the service request is obtained; the second firewall identifier of each port number of the load balancing device is calculated, and the first firewall identifier and the second firewall identifier are matched; in the case that the first firewall identifier and the second firewall identifier are matched, the service data is sent by the firewall matched with the first firewall identifier. In the embodiments of the present application, the port number of the firewall receiving the service request is obtained, and according to the port number, the port number of the load balancing device and the five-tuple information corresponding to the service request, the first firewall identifier corresponding to the service request is calculated, and then the first firewall identifier and the second firewall identifier in the load balancing device are matched. In the case that the first firewall identifier and the second firewall identifier are matched, the service data is sent by the firewall matched with the first firewall identifier. In this way, it can be ensured that the firewall sending the request and the firewall returning the data are the same firewall, the balanced processing of the firewall traffic is realized, and the processing efficiency is improved.
[0004] In a first aspect, some embodiments of the present application provide a firewall traffic balancing method, comprising:
[0005] receiving a service request sent by a client through a preset firewall;
[0006] determining a first firewall identifier corresponding to the service request according to the port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request;
[0007] According to the service request, obtain service data corresponding to the service request;
[0008] Calculate a second firewall identifier of each port number of the load balancing device, and match the first firewall identifier and the second firewall identifier;
[0009] In a case where the first firewall identifier and the second firewall identifier match, send the service data by using a firewall matched with the first firewall identifier.
[0010] Some embodiments of the present application obtain a port number of a firewall receiving a service request, and calculate a first firewall identifier corresponding to the service request according to the port number, a port number of a load balancing device, and five-tuple information corresponding to the service request, and then match the first firewall identifier with a second firewall identifier in the load balancing device. In a case where the first firewall identifier and the second firewall identifier match, the service data is sent by using a firewall matched with the first firewall identifier. In this way, it can be ensured that the firewall sending the request and the firewall returning the data are the same firewall, the balanced processing of the firewall traffic is realized, and the processing efficiency is improved.
[0011] Optionally, the determining the first firewall identifier corresponding to the service request according to the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request comprises:
[0012] Hash computing the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a first hash value;
[0013] The first hash value is determined as the first firewall identifier corresponding to the service request.
[0014] Some embodiments of the present application hash compute the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a seven-tuple hash value, i.e., the first firewall identifier. The first firewall identifier is used to determine that the forward traffic and the reverse traffic use the same firewall, which facilitates load balancing.
[0015] Optionally, the calculating the second firewall identifier of each port number of the load balancing device, and matching the first firewall identifier and the second firewall identifier comprises:
[0016] After receiving the service data, hash compute the port number of each firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a second hash value;
[0017] determining the second hash value as the second firewall identifier;
[0018] judging the first hash value and the second hash value.
[0019] Optionally, in the case that the first firewall identifier and the second firewall identifier match, the method further includes:
[0020] If the first hash value and the second hash value are the same, a port number of a firewall corresponding to the second hash value is determined as a target firewall port number.
[0021] The service data is sent by a firewall corresponding to the target firewall port number.
[0022] Some embodiments of the present application match a first hash value and a second hash value of a plurality of firewalls in a load balancing device, so that a firewall matching the first hash value can be found from the plurality of firewalls, so that the firewall sending the request and the firewall returning the data are ensured to be the same firewall, the balanced processing of firewall traffic is achieved, and the processing efficiency is improved.
[0023] Optionally, the method further includes:
[0024] The port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request are subjected to MD5 calculation to obtain a first MD5 value.
[0025] Some embodiments of the present application ensure the accuracy of data verification by calculating a seven-tuple hash value containing the port number of the preset firewall.
[0026] In a second aspect, some embodiments of the present application provide a balanced device for firewall traffic, including:
[0027] A receiving module is configured to receive a service request sent by a client through a preset firewall.
[0028] A determining module is configured to determine a first firewall identifier corresponding to the service request according to a port number of the preset firewall, a port number of a load balancing device, and five-tuple information corresponding to the service request.
[0029] An obtaining module is configured to obtain service data corresponding to the service request according to the service request.
[0030] a calculating module, configured to calculate a second firewall identifier of each port number of the load balancing device, and match the first firewall identifier and the second firewall identifier;
[0031] a sending module, configured to, in a case where the first firewall identifier and the second firewall identifier are matched, send the service data by using the firewall matched with the first firewall identifier.
[0032] Some embodiments of the present application can ensure that the firewall sending the request and the firewall returning the data are the same firewall, realize balanced processing of the firewall traffic, and improve processing efficiency.
[0033] Optionally, the determining module is configured to:
[0034] perform hash calculation on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a first hash value;
[0035] determine the first hash value as the first firewall identifier corresponding to the service request.
[0036] Some embodiments of the present application can obtain a seven-tuple hash value, i.e., the first firewall identifier, by performing hash calculation on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request, so as to determine that the forward traffic and the reverse traffic use the same firewall, thereby facilitating load balancing.
[0037] Optionally, the calculating module is configured to:
[0038] perform hash calculation on the port number of each firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a second hash value after receiving the service data;
[0039] determine the second hash value as the second firewall identifier;
[0040] perform judgment on the first hash value and the second hash value.
[0041] Optionally, the sending module is configured to:
[0042] If the first hash value and the second hash value are the same, determining the port number of the firewall corresponding to the second hash value as the target firewall port number;
[0043] The service data is sent using a firewall corresponding to the target firewall port number.
[0044] Some embodiments of the present application match the first hash value with the second hash values of multiple firewalls in the load balancing device. In this way, a firewall that matches the first hash value can be found from multiple firewalls. In this way, it can be ensured that the firewall that sends the request and the firewall that returns the data are the same firewall, thereby achieving balanced processing of firewall traffic and improving processing efficiency.
[0045] Optionally, the determining module is configured to:
[0046] An MD5 calculation is performed on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a first MD5 value.
[0047] Some embodiments of the present application ensure the accuracy of data verification by calculating a seven-tuple hash value containing the port number of a preset firewall.
[0048] In a third aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the firewall traffic balancing method as described in any embodiment of the first aspect can be implemented.
[0049] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the firewall traffic balancing method as described in any embodiment of the first aspect.
[0050] In a fifth aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, it can implement the firewall traffic balancing method as described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS
[0051] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the following is a brief introduction to the drawings required for use in some embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.
[0052] Figure 1 A flowchart of a firewall traffic balancing method provided by an embodiment of the present application is shown in FIG. 1;
[0053] Figure 2 A flowchart of another firewall traffic balancing method provided by an embodiment of the present application is shown in FIG. 2;
[0054] Figure 3 A structural diagram of a firewall traffic balancing device provided by an embodiment of the present application is shown in FIG. 3;
[0055] Figure 4 An electronic device provided by an embodiment of the present application is shown in FIG. 4. DETAILED DESCRIPTION
[0056] The technical solutions in some embodiments of the present application will be described below in conjunction with the accompanying drawings.
[0057] It should be noted that similar reference numerals and letters refer to similar items throughout the accompanying drawings, and thus, once an item is defined in one drawing, it is not necessary to further define and explain it in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are merely used to distinguish description, and cannot be understood as indicating or implying relative importance.
[0058] With the continuous development of network technology, in order to the security of data transmission, it is necessary to provide a firewall for the data transmission equipment, and if there are many simultaneous sessions, multiple sessions will use the same firewall for data transmission, and there will also be an idle firewall at the same time, which will cause the problem of unbalanced load, therefore, how to improve the efficiency of the flow balance of the firewall is the problem that needs to be solved at present, in view of this, some embodiments of the present application provide a firewall flow balancing method, the method comprises: receiving a service request sent by a client through a preset firewall; determining a first firewall identifier corresponding to the service request according to a port number of the preset firewall, a port number of a load balancing device and five tuple information corresponding to the service request; obtaining service data corresponding to the service request according to the service request; calculating a second firewall identifier of each port number of the load balancing device, and matching the first firewall identifier and the second firewall identifier; in the case that the first firewall identifier and the second firewall identifier match, sending the service data by using the firewall matched with the first firewall identifier, in the embodiments of the present application, the port number of the firewall receiving the service request is obtained, and then the first firewall identifier corresponding to the service request is calculated according to the port number, the port number of the load balancing device and the five tuple information corresponding to the service request, and then the first firewall identifier and the second firewall identifier in the load balancing device are matched, in the case that the first firewall identifier and the second firewall identifier match, the service data is sent by using the firewall matched with the first firewall identifier, so that the firewall sending the request and the firewall returning the data are ensured to be the same firewall, the balanced processing of the firewall flow is realized, and the processing efficiency is improved.
[0059] As shown in Figure 1 , the embodiments of the present application provide a firewall flow balancing method, the method comprises:
[0060] S101, receiving a service request sent by a client through a preset firewall;
[0061] Specifically, as shown in Figure 2 , the client terminal is connected with the switch, the switch is connected with the load balancing device, the load balancing device is connected with the external network, and the load balancing device is installed with the firewall, and the number of the firewall is not limited in the embodiments of the present application.
[0062] The client terminal, i.e. the client, sends a service request to the switch, and the load balancing device receives the service request, i.e. the session service, through the preset firewall.
[0063] S102, determining a first firewall identifier corresponding to the service request according to a port number of the preset firewall, a port number of a load balancing device and five tuple information corresponding to the service request;
[0064] Specifically, the load balancing device acquires the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information of the session corresponding to the service request, wherein the five-tuple information of the session includes five basic attributes of a network data packet, including a source IP address, a destination IP address, a source port number, a destination port number, and a transmission protocol. In network communication, each session data packet contains the five attributes, which together constitute a unique identifier of the session data packet.
[0065] The load balancing device performs a hash operation on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a first firewall identifier corresponding to the service request.
[0066] S103, according to the service request, acquiring service data corresponding to the service request;
[0067] Specifically, the load balancing device acquires the service data corresponding to the service request from the external network after acquiring the service request.
[0068] S104, calculating a second firewall identifier of each port number of the load balancing device, and matching the first firewall identifier and the second firewall identifier;
[0069] Specifically, the load balancing device calculates a firewall identifier for each firewall to obtain a second firewall identifier, that is, performs a hash operation on the port number of each firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain the second firewall identifier.
[0070] The load balancing device matches the first firewall identifier and the second firewall identifier to determine the firewall identifier matched with the first firewall.
[0071] S105, in the case that the first firewall identifier and the second firewall identifier match, sending the service data by using the firewall matched with the first firewall identifier.
[0072] Specifically, the load balancing device searches for the firewall matched with the first firewall identifier from the multiple second firewall identifiers, and sends the service data by using the firewall matched with the first firewall identifier (that is, one of the second firewall identifiers).
[0073] Some embodiments of the present application obtain the port number of the firewall receiving the service request, and according to the port number, the port number of the load balancing device and the five-tuple information corresponding to the service request, calculate the first firewall identifier corresponding to the service request, and then match the first firewall identifier and the second firewall identifier in the load balancing device. In the case that the first firewall identifier and the second firewall identifier match, the firewall matched with the first firewall identifier is used to send the service data, so that the firewall sending the request and the firewall returning the data are ensured to be the same firewall, the balanced processing of the firewall traffic is realized, and the processing efficiency is improved.
[0074] Another embodiment of the present application further supplements the balanced method of the firewall traffic provided in the above embodiment.
[0075] Optionally, according to the port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request, the first firewall identifier corresponding to the service request is determined, including:
[0076] The port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request are subjected to hash calculation to obtain a first hash value;
[0077] The first hash value is determined as the first firewall identifier corresponding to the service request.
[0078] Some embodiments of the present application obtain the port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request, and perform hash calculation to obtain a seven-tuple hash value, i.e. the first firewall identifier, which is used to determine that the forward traffic and the reverse traffic use the same firewall, facilitating the load balancing.
[0079] Optionally, the second firewall identifier of each port number of the load balancing device is calculated, and the first firewall identifier and the second firewall identifier are matched, including:
[0080] After receiving the service data, the port number of each firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request are subjected to hash calculation to obtain a second hash value;
[0081] The second hash value is determined as the second firewall identifier;
[0082] The first hash value and the second hash value are judged.
[0083] Optionally, in the case that the first firewall identifier and the second firewall identifier match, the firewall matched with the first firewall identifier is used to send the service data, including:
[0084] If the first hash value and the second hash value are the same, the port number of the firewall corresponding to the second hash value is determined as the target firewall port number;
[0085] Use the firewall corresponding to the target firewall port number to send business data.
[0086] Some embodiments of the present application match the first hash value with the second hash values of multiple firewalls in the load balancing device. In this way, a firewall that matches the first hash value can be found from multiple firewalls. In this way, it can be ensured that the firewall that sends the request and the firewall that returns the data are the same firewall, thereby achieving balanced processing of firewall traffic and improving processing efficiency.
[0087] Optionally, performing a hash calculation on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a first hash value includes:
[0088] An MD5 calculation is performed on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a first MD5 value.
[0089] Some embodiments of the present application ensure the accuracy of data verification by calculating a seven-tuple hash value containing the port number of a preset firewall.
[0090] like Figure 2 As shown, another embodiment of the present application provides a method for balancing firewall traffic, including:
[0091] 1. The PC (client) accesses the internet and sends a service request from firewall 1 to the load balancing device through the switch. The load balancing device obtains the service data corresponding to the service request from the internet and returns it to the switch through firewall 1. The switch then sends the obtained data to the PC.
[0092] 2. The load balancing device calculates the seven-tuple hash value, i.e., the first hash value, which is also the first firewall identifier, based on the five-tuple, the port number of firewall 1, and the port number of the load balancing device.
[0093] 3. Load balancing device The load balancing device calculates the firewall identifier for each firewall separately to obtain a second firewall identifier, that is, a hash operation is performed on the port number of each firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a second hash value, that is, the second firewall identifier; alternatively, the second firewall identifier can be pre-stored in the load balancing device.
[0094] 4. After receiving the service request through firewall 1, the load balancing device calculates the first hash value according to the firewall 1, compares the calculated first hash value with the pre-stored second hash value, determines the corresponding firewall according to the first hash value, and returns the data returned from the external network to the switch through the firewall return value.
[0095] 5. Load balancing equipment distributes traffic to multiple firewalls; among them, the forward traffic of the same session needs to be processed by the same firewall; the reverse traffic of the same session also needs to be processed by the same firewall, so as to achieve balanced processing of firewall traffic and improve processing efficiency.
[0096] For example, two firewalls are installed on a load balancing device. Through a switch, the load balancing device receives a service request sent by a client from firewall 1. After the load balancing device obtains the service data corresponding to the service request from the external network, it needs to return the obtained service data to the client terminal. In order to achieve load balancing, forward traffic and reverse traffic need to be transmitted through the same firewall. In this way, the traffic of a certain firewall is prevented from being too large. Based on this, the load balancing device calculates a seven-tuple hash value, i.e., a first hash value, i.e., a first firewall identifier, based on the five-tuple, the port number of firewall 1, and the port number of the load balancing device. Then, the firewall identifiers are calculated for firewall 1 and firewall 2 respectively to obtain a second firewall identifier. That is, a hash operation is performed on the port numbers of firewall 1 and firewall 2, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a second hash value. The two second hash values are matched with the first hash value respectively, and the firewall with the same first hash value is used as the firewall for reverse traffic. That is, the obtained service data is returned to the switch through firewall 1, and the switch sends the obtained data to the PC.
[0097] It should be noted that each implementable method in this embodiment can be implemented separately, or can be implemented in combination in any combination without conflict, and this application does not limit it.
[0098] Another embodiment of the present application provides a firewall traffic balancing device, which is used to execute the firewall traffic balancing method provided in the above embodiment.
[0099] like Figure 3 FIG. 3 is a schematic diagram of the structure of a firewall traffic balancing device provided in an embodiment of the present application. The firewall traffic balancing device includes a receiving module 301, a determining module 302, an acquiring module 303, a calculating module 304, and a sending module 305, wherein:
[0100] The receiving module 301 is used to receive the service request sent by the client through the preset firewall;
[0101] The determining module 302 is configured to determine a first firewall identifier corresponding to the service request according to a port number of a preset firewall, a port number of a load balancing device, and five-tuple information corresponding to the service request.
[0102] The obtaining module 303 is configured to obtain service data corresponding to the service request according to the service request.
[0103] The calculating module 304 is configured to calculate a second firewall identifier of each port number of the load balancing device, and match the first firewall identifier and the second firewall identifier.
[0104] The sending module 305 is configured to send the service data by using a firewall matched with the first firewall identifier in a case where the first firewall identifier and the second firewall identifier are matched.
[0105] As to the apparatus in the embodiment, the specific manners in which the modules perform operations have been described in detail in the embodiments of the method, and will not be described here in detail.
[0106] Some embodiments of the present application can obtain a port number of a firewall receiving a service request, and calculate a first firewall identifier corresponding to the service request according to the port number, a port number of a load balancing device, and five-tuple information corresponding to the service request, then match the first firewall identifier and a second firewall identifier in the load balancing device, and send the service data by using a firewall matched with the first firewall identifier in a case where the first firewall identifier and the second firewall identifier are matched, so that the firewall sending the request and the firewall returning data can be ensured to be the same firewall, the balanced processing of firewall traffic is realized, and the processing efficiency is improved.
[0107] Another embodiment of the present application further supplements the balanced apparatus of firewall traffic provided in the above embodiment.
[0108] Optionally, the determining module is configured to:
[0109] perform hash calculation on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a first hash value;
[0110] determine the first hash value as the first firewall identifier corresponding to the service request.
[0111] Some embodiments of the present application can perform hash calculation on the port number of the preset firewall, the port number of the load balancing device, and the five-tuple information corresponding to the service request to obtain a seven-tuple hash value, i.e., the first firewall identifier, which is used to determine that the forward traffic and the reverse traffic use the same firewall, and facilitates load balancing.
[0112] Optionally, the computing module is configured to:
[0113] After receiving the service data, the port number of each firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request are respectively subjected to hash calculation to obtain a second hash value;
[0114] The second hash value is determined as a second firewall identifier;
[0115] The first hash value and the second hash value are subjected to judgment.
[0116] Optionally, the sending module is configured to:
[0117] If the first hash value and the second hash value are the same, the port number of the firewall corresponding to the second hash value is determined as a target firewall port number;
[0118] The service data is sent by the firewall corresponding to the target firewall port number.
[0119] Some embodiments of the present application match the first hash value with the second hash values of the multiple firewalls in the load balancing device, so that the firewall matching the first hash value can be found from the multiple firewalls, so that the firewall sending the request and the firewall returning the data are ensured to be the same firewall, the balanced processing of the firewall traffic is realized, and the processing efficiency is improved.
[0120] Optionally, the determining module is configured to:
[0121] The port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request are subjected to MD5 calculation to obtain a first MD5 value.
[0122] Some embodiments of the present application ensure the accuracy of data verification by calculating the seven-tuple hash value containing the port number of the preset firewall.
[0123] As to the apparatus in the present embodiment, the specific manners in which each module performs operations have been described in detail in the embodiments of the method, and will not be described in detail here.
[0124] It should be noted that each implementable manner in the present embodiment can be implemented alone or in any combination manner without conflict, and the present application is not limited thereto.
[0125] The present embodiment further provides a computer readable storage medium having a computer program stored thereon, and the program is executed by a processor to implement the operations of the method corresponding to any embodiment of the balanced method of the firewall traffic provided by the above-mentioned embodiments.
[0126] The embodiments of the present application further provide a computer program product, the computer program product comprises a computer program, wherein the computer program is executed by a processor to implement the operations of the method corresponding to any of the embodiments of the method for balancing firewall traffic provided by the above embodiments.
[0127] As shown in Figure 4 some embodiments of the present application provide an electronic device 400, the electronic device 400 comprises a memory 410, a processor 420 and a computer program stored in the memory 410 and executable on the processor 420, wherein the processor 420 reads the program from the memory 410 through the bus 430 and executes the program to implement the method of any of the embodiments included in the method for balancing firewall traffic.
[0128] The processor 420 can process digital signals and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure implementing a combination of multiple instruction sets. In some examples, the processor 420 can be a microprocessor.
[0129] The memory 410 can be used to store instructions executed by the processor 420 or data related to the execution of the instructions. These instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 420 of the embodiments of the present disclosure can be used to execute instructions in the memory 410 to implement the method shown above. The memory 410 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory well known to those skilled in the art.
[0130] The above is only an embodiment of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.
[0131] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto. Any skilled person in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be limited by the protection scope of the claims.
[0132] It is to be noted that, as used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to "a component" can include a combination of two or more components. Additionally, the terms "comprise," "comprises," and "comprising," or any variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements is not necessarily limited to those elements, but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Furthermore, unless otherwise indicated herein, the terms "first," "second," "third," etc., are used herein merely as labels, and are not intended to impose ordinal import.
Claims
1. A method for balancing firewall traffic, characterized in that: The method is applied to a load balancing device, and comprises the following steps: receiving a service request sent by a client through a preset firewall; performing hash operation on a port number of the preset firewall, a port number of the load balancing device and five-tuple information corresponding to the service request to obtain a first hash value, and determining the first hash value as a first firewall identifier corresponding to the service request; acquiring service data corresponding to the service request according to the service request; calculating a second firewall identifier of each port number of the load balancing device, and matching the first firewall identifier and the second firewall identifier; in a case where the first firewall identifier and the second firewall identifier are matched, sending the service data by using a firewall matched with the first firewall identifier; the calculating of the second firewall identifier of each port number of the load balancing device and the matching of the first firewall identifier and the second firewall identifier comprise the following steps: after the service data is received, performing hash calculation on a port number of each firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request to obtain a second hash value; determining the second hash value as the second firewall identifier; matching the first hash value and the second hash value of a plurality of firewalls in the load balancing device, finding a firewall matched with the first hash value from the plurality of firewalls, judging the first hash value and the second hash value, if the first hash value and the second hash value are the same, determining a port number of a firewall corresponding to the second hash value as a target firewall port number, sending the service data by using the firewall corresponding to the target firewall port number, determining the corresponding firewall according to the first hash value, and returning data returned by an external network to a switch through the firewall.
2. The method of claim 1, wherein, the hash calculation on the port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request to obtain the first hash value comprises the following steps: performing MD5 calculation on the port number of the preset firewall, the port number of the load balancing device and the five-tuple information corresponding to the service request to obtain a first MD5 value.
3. A device for balancing firewall traffic, characterized by The device is applied to a load balancing device, and comprises the following steps: a receiving module, configured to receive a service request sent by a client through a preset firewall; a determining module, configured to determine a first firewall identifier corresponding to the service request according to a port number of the preset firewall, a port number of the load balancing device and five-tuple information corresponding to the service request; an acquiring module, configured to acquire service data corresponding to the service request according to the service request; a calculating module, configured to calculate a second firewall identifier of each port number of the load balancing device, and match the first firewall identifier and the second firewall identifier; a sending module, configured to send the service data by using a firewall matched with the first firewall identifier in a case where the first firewall identifier and the second firewall identifier are matched; and the determining module is configured to: Hashing the port number of the preset firewall, the port number of the load balancing device and the five tuple information corresponding to the service request to obtain a first hash value; The first hash value is determined as a first firewall identifier corresponding to the service request; The computing module is configured to: After receiving the service data, the port number of each firewall, the port number of the load balancing device and the five tuple information corresponding to the service request are hashed to obtain a second hash value; The second hash value is determined as the second firewall identifier; The first hash value and the second hash values of the multiple firewalls in the load balancing device are matched, and a firewall matching the first hash value is found in the multiple firewalls. The first hash value and the second hash value are judged. If the first hash value and the second hash value are the same, the port number of the firewall corresponding to the second hash value is determined as the target firewall port number. The service data is sent by the firewall corresponding to the target firewall port number, the corresponding firewall is determined according to the first hash value, and the data returned by the external network is returned to the switch through the firewall.
4. An electronic device, comprising: The computer readable storage medium stores a computer program, and the program is executed by the processor to realize the firewall flow balancing method of any one of claims 1-2.
5. A computer readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the program is executed by the processor to realize the firewall flow balancing method of any one of claims 1-2.