Dynamic FQDN Resolution in Network Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network policies that use Fully Qualified Domain Names (FQDNs) do not provide dynamic resolution of IP addresses, leading to ineffective policy enforcement, especially in virtual system environments, where IP addresses can change frequently and are not updated in real-time.
Innovation Solution
Implementing a dynamic resolution mechanism that periodically updates IP address information associated with FQDNs through DNS queries, allowing for context-sensitive resolution and enforcement of network policies, supporting both IPv4 and IPv6 addresses, and enabling dynamic resolution at both configuration and enforcement times.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static IP address resolution is used in network policies, then policy configuration is simple, but policy enforcement becomes ineffective in dynamic environments where IP addresses change frequently
Solution Approach 1:
The patent implements dynamic resolution of FQDN address objects by periodically querying DNS servers to obtain current IP addresses associated with domain names. This allows network policies to automatically adapt to IP address changes in virtual system environments, transforming the static resolution mechanism into a dynamic one that maintains policy enforcement effectiveness without requiring manual updates.
Solution Approach 2:
The patent introduces a DNS query mechanism as an intermediary between the network policy system and IP address resolution. By using DNS servers as mediators to resolve FQDNs to current IP addresses, the system achieves dynamic updates without directly managing IP address changes, thereby maintaining simplicity while improving reliability.
2Reliability
If dynamic DNS queries are performed periodically to update IP addresses, then policy enforcement remains effective, but system resource consumption increases
Solution Approach 1:
The patent implements periodic DNS queries at configured intervals to update IP address information for FQDNs in network policies. This periodic action balances the need for fresh IP address data with resource conservation, allowing the system to maintain effective policy enforcement while avoiding continuous resource consumption associated with real-time updates.
Solution Approach 2:
The patent allows configuration of update intervals and selective querying based on policy priorities. By changing the frequency parameter of DNS queries according to specific needs, the system optimizes the balance between maintaining fresh IP address information and conserving system resources.
Data Source
AI summary
Dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions is provided. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes receiving a network policy that includes a domain name (e.g., the network policy can include a network security rule that is based on the domain name); and periodically updating Internet Protocol (IP) address information associated with the domain name by performing a Domain Name Server (DNS) query. In some embodiments, dynamic resolution of Fully Qualified Domain Name (FQDN) address objects in policy definitions includes dynamically performing a first local Domain Name Server (DNS) lookup for a first VSYS using a first DNS server on a first domain name for implementing a network policy based on the first domain name; dynamically performing a second local DNS lookup for a second VSYS using a second DNS server on the first domain name for implementing the network policy based on the first domain name; in which the network policy includes a network security rule that is based on the first domain name, and the network policy includes a network security rule that is based on the second domain name.