Firewall Blade Load Balancing for Encrypted Traffic Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IPsec encryption in VPNs conceals 5-tuple headers, making it impossible to identify and manage inbound data packets for security policies across multiple gateway members, and existing techniques fail to efficiently distribute management data frames versus user data frames in chassis systems.
Innovation Solution
A system with an I/O board and load balancing engine coupled to a chassis internal switch, which selects firewall processing blades to process data packets based on session and policy matches, ensuring that management and user data packets are appropriately routed to their respective services, thereby improving network traffic throughput and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec encryption is used to secure VPN communications, then security is improved, but the ability to identify and manage inbound data packets for security policies is lost
Solution Approach 1:
The patent applies preliminary action by creating session templates and security policies in advance, before encrypted packets arrive. The system pre-defines matching criteria and actions for potential encrypted traffic patterns, enabling identification and policy enforcement without needing to decrypt packets in real-time.
Solution Approach 2:
The patent introduces an intermediary mechanism - a session template matching system that acts as a mediator between encrypted traffic and security policies. This intermediary matches packet characteristics against predefined templates without requiring decryption, thus preserving security while enabling policy management.
2Productivity
If multiple firewall processing blades are used to handle traffic, then processing capacity is improved, but the complexity of managing and distributing packets across blades increases
Solution Approach 1:
The patent applies segmentation by dividing the firewall processing function into multiple independent blades, each capable of handling specific traffic flows. The load balancing engine segments the decision-making process, selecting which blade processes each packet based on session matching, thereby distributing workload while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The load balancing engine serves as an intermediary between incoming traffic and multiple firewall blades. It receives packets, performs session template matching, and directs packets to appropriate blades, thus managing the complexity of multi-blade coordination without requiring complex inter-blade communication protocols.
3Reliability
If session template matching is performed on all inbound packets, then security policy enforcement is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by performing session template matching selectively rather than on every packet. The load balancing engine matches packets against session templates only when necessary to determine blade assignment, and subsequent packets in the same session reuse the established match, reducing overall processing time while maintaining security enforcement.
Solution Approach 2:
The system performs preliminary session template matching at the load balancing engine before packet distribution, establishing session context in advance. This preliminary action enables subsequent packets to be processed more efficiently by reusing established session matches, reducing per-packet processing time while maintaining comprehensive security policy enforcement.
Data Source
AI summary
A firewall processing card from a plurality of firewall processing cards coupled to a chassis, is selected by a load balancing engine (or other mechanism) and receives the data packet over the fabric channel. First, if the session match exists to management-type data packets the data packet is returned to the I/O board and if a match exists to user data packets the data packet is sent to a firewall service of the firewall processing card. If no session match exists, the firewall processing card checks for a policy match to the data packet for creating a new session or drops the data packet. The I/O board receives the data packet returned from the processing blade over the base channel and checks for a session matching to the data packet. If a session match exists and the data packet is a management data packet, the data packet is sent to a management service at a user level of the I/O board and if not a management data packet the data packet is dropped. If no session match exists, the I/O board creates a new session or drops the data packet.