Firewall Gateway Load Balancing Cloud Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for deploying firewall instances in cloud computing environments, such as VPN connections and native VPC attachments, face limitations in scalability, throughput, and computational efficiency, and lack visibility into network traffic sources due to the use of IPSec tunnels, BGP, and SNAT.
Innovation Solution
A distributed cloud computing system with a controller that deploys multiple firewall instances within a security VPC, using a native VPC attachment methodology to connect to a transit gateway, eliminating the need for IPSec tunnels and BGP, and enabling active-active configurations for scalable and efficient firewall operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VPN connection with IPSec tunnel is used to deploy firewall instances, then security and traffic inspection capability are improved, but throughput is limited to 1 Gbps and computational resources are consumed excessively
Solution Approach 1:
The patent extracts the IPSec tunnel encapsulation/decapsulation process from the firewall instance processing path and relocates it to be performed by the cloud provider's network infrastructure. This removes the computational overhead of IPSec processing from the firewall instances, allowing them to focus on security inspection while achieving higher throughput without the 1 Gbps limitation imposed by tunnel traversal.
Solution Approach 2:
The patent introduces a gateway component as an intermediary between the firewall instances and the cloud network infrastructure. The gateway handles the IPSec tunnel management and BGP routing operations, acting as a mediator that shields the firewall instances from these computationally expensive operations while maintaining secure connectivity to multiple VPCs.
2Reliability
If multiple firewall instances are deployed with VPN connections, then security coverage is improved, but device complexity and configuration overhead increase significantly
Solution Approach 1:
The patent makes the gateway component universal by having it perform multiple functions: IPSec tunnel management, BGP routing for multiple VPCs, and coordination with multiple firewall instances. This multi-functional gateway reduces overall system complexity compared to configuring each firewall instance with individual VPN connections to each VPC.
Solution Approach 2:
The patent merges the IPSec tunnel management and BGP routing functions into a single gateway component that serves all firewall instances. Instead of each firewall instance maintaining separate VPN connections and routing configurations, these functions are combined in the gateway, significantly reducing configuration overhead and simplifying deployment.
3Ease of operation
If SNAT is used in VPN deployment, then network address translation is achieved, but visibility of traffic source destination is lost
Solution Approach 1:
The patent applies different network address translation strategies at different locations in the network architecture. SNAT is applied only where necessary by the gateway for returning traffic, while the firewall instances maintain direct visibility of original source and destination addresses in their inspection rules. This localized application of NAT preserves visibility where needed while providing NAT functionality where required.
4Productivity
If native VPC attachment is used instead of VPN, then computational efficiency is improved by eliminating IPSec and BGP, but scalability is limited to single firewall per attachment
Solution Approach 1:
The patent segments the network attachment functionality by creating a many-to-many relationship between firewalls and VPCs through the gateway. Instead of a single native attachment limiting one firewall to one VPC, the gateway segments and distributes traffic from multiple VPCs to multiple firewall instances, enabling scalable deployment while maintaining the computational efficiency of native VPC attachment.
Data Source
AI summary
A computerized method for directing transmission of a data packet within a distributed cloud computing system is disclosed that includes receiving the data packet by a receiving gateway instance deployed within the distributed cloud computing system, when a session corresponding to the data packet is found via a session lookup, forwarding the data packet to a destination in accordance with the session lookup, when the session is not found via the session lookup, determining whether one least one peer firewall instance is available, and when a first peer firewall instance is available and the data packet is a synchronize packet, forwarding the data packet to the first peer firewall instance. In some instances, the data packet is a TCP packet and in others, the data packet is received from either of a spoke gateway or a transit gateway that is deployed within the distributed cloud computing system.