Source-Based Symmetric Routing for Stateful Virtual Firewalls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized network environments, implementing symmetric routing for stateful firewalls across multiple zones is challenging due to the need for synchronized state information across firewall instances, which is difficult to scale and is complicated by unpredictable latency and large numbers of sessions.
Innovation Solution
A source-based symmetric routing approach is implemented, where routing is configured at the network traffic source, using static or dynamic mappings to ensure that forward and reverse traffic is directed to the same firewall instance, with dynamic adjustments based on traffic load and performance metrics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If stateful firewalls are deployed across multiple zones with distributed instances, then security coverage is improved, but synchronization of state information becomes difficult to scale
Solution Approach 1:
The patent introduces a control plane as an intermediary that centralizes state synchronization for distributed firewall instances. The control plane receives session state information from firewall instances and distributes it to relevant instances across zones, eliminating the need for direct peer-to-peer synchronization between firewall instances and enabling scalable multi-zone deployment.
Solution Approach 2:
The patent separates the firewall functionality into two dimensions: data plane (firewall instances handling traffic) and control plane (managing state synchronization). This dimensional separation allows firewall instances to focus on packet filtering while the control plane handles the complex state synchronization across multiple zones, resolving the scalability issue.
2Reliability
If symmetric routing is implemented using vendor switch/router hashing, then routing symmetry is achieved, but implementation difficulty increases in virtualized environments
Solution Approach 1:
The patent implements source-based routing at the virtual network interface card (vNIC) level, allowing virtual machines to perform their own routing decisions based on source and destination IP addresses. This self-service approach eliminates the need for complex vendor-specific hashing configurations in switches and routers, making symmetric routing implementation straightforward in virtualized environments.
Solution Approach 2:
Instead of implementing symmetric routing at the network infrastructure level (switches/routers), the patent inverts the approach and implements it at the endpoint level (vNICs/virtual machines). This inversion simplifies the network infrastructure while enabling symmetric routing through software-based source-based routing tables.
3Ease of operation
If policy-based routing is used at firewall instances, then routing control is improved, but latency becomes unpredictable
Solution Approach 1:
The patent pre-computes and stores source-based routing tables in the vNICs, containing all necessary routing decisions before traffic arrives. This preliminary action allows firewall instances to make routing decisions by simple table lookups rather than complex policy evaluations, significantly reducing routing latency while maintaining control through the pre-configured routing tables.
Solution Approach 2:
The patent replaces the mechanical policy-based routing evaluation process (which involves multiple rule checks and decision logic) with a simplified lookup mechanism in pre-computed routing tables. This substitution transforms a complex, time-consuming process into a fast, predictable operation while preserving routing control through the table configuration.
Data Source
AI summary
Embodiments disclosed herein relate to source-based symmetric routing of network traffic in virtual networks. In particular, a source of network traffic in the virtual network is equipped with a routing table that causes the source of the network traffic to route the network traffic symmetrically across zones of the virtual network.