Firewall Rule Transfer for Bridge Mode AP Mobility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless digital networks, clients moving from one access point to another in bridge mode experience session drops due to the lack of knowledge about specific firewall sessions at the new access point, leading to disconnected calls or transfers, as stateful firewall rules are not centrally maintained.
Innovation Solution
Implement a method where the original access point transfers existing firewall rules to the new access point when a client moves, using multicast messages to request session information and acknowledging responses to ensure seamless rule transfer and cleanup, ensuring only one access point maintains state for the client.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If clients move from one access point to another in bridge mode, then network mobility is enabled, but session drops occur due to lack of firewall session knowledge at the new access point
Solution Approach 1:
The patent implements copying by transferring firewall session state information from the source access point to the destination access point. When a client moves from one AP to another, the new AP receives and applies a copy of the client's firewall session data, enabling it to continue enforcing firewall rules without dropping the client's sessions. This copying mechanism allows the firewall state to be replicated across different access points, maintaining session continuity during client mobility.
2Reliability
If all client traffic is routed back through the original access point for firewall enforcement, then session continuity is maintained, but network efficiency deteriorates
Solution Approach 1:
The patent applies segmentation by dividing the firewall enforcement function across multiple access points rather than concentrating it at a single source AP. Each access point that serves a mobile client can independently enforce firewall rules for that client, segmenting the firewall processing load. This eliminates the need to route all client traffic back through the original AP, allowing traffic to flow directly through the current serving AP while maintaining session continuity.
3Reliability
If multiple access points maintain firewall state for the same client, then session continuity during mobility is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a centralized controller or coordination protocol that manages the distribution and synchronization of firewall session state across multiple access points. This intermediary coordinates which APs should maintain state for a given client, ensuring that state information is properly transferred when clients move between APs. The intermediary resolves conflicts and manages the complexity of distributed state maintenance, allowing multiple APs to safely hold client state without creating inconsistencies or excessive complexity.
Data Source
AI summary
Mobility of firewall rules for clients moving among bridge AP nodes in a wireless network. APs operate in bridge mode. A wireless client C is associated with a first AP. As part of that association, the first AP establishes and maintains personal firewall rules and state for client C. When wireless client C associates with a second AP in the L2 domain, the second AP sends session request to other APs. This may be in the form of a multicast message. Optionally, the second AP may send a unicast message to the first AP indicating that client C has associated with the second AP. APs receiving the multicast session request message for client C check their tables to see if they have stored firewall or other state for client C. APs having storied firewall or other state for client C send session response messages to the second AP containing stored firewall sessions and other state for client C. When the second AP receives a session response, it sends an acknowledgement to the AP which sent the response. When the AP, such as the first AP, receives the acknowledgement, it may remove all stored state for client C. If the second AP receives session response messages for client C from multiple APs, it acknowledges each, and creates session entries and state using the oldest rules in the session response messages. Flags may be logically ORed together.