Back to results
US 11,240,208 B2Granted
Split tunneling based on content type to exclude certain network traffic from a tunnel
AssigneePalo Alto Networks, Inc.
InventorsYongjie Yin, Joby Menon, Andrey Tverdokhleb, Kevin Yao
Life of this patent
Estimating the term…
Abstract
Various techniques for split tunneling based on content type are disclosed. In some embodiments, a system, process, and/or computer program product for split tunneling based on content type includes monitoring session traffic received at a data appliance; determining if the session traffic is associated with a first content type; and redirecting the session traffic if the session traffic is associated with the first content type based on a policy.
Claims20
A system for performing split tunneling based on content type, comprising:
- a physical adapter;
- a Virtual Private Network (VPN) with a virtual adapter;
- a processor of a security platform configured to:
- monitor session traffic received from a client at the security platform, wherein the session traffic is initially routed through a Virtual Private Network (VPN) tunnel, and wherein the session traffic is decrypted and decoded at the security platform;
- determine, from the decrypted and decoded session traffic, if the session traffic is associated with a first content type, wherein the first content type includes video network or audio network traffic;
- and
- send a special redirect response, the special redirect response utilizing a special port option or a TCP option, to re-route the session traffic from the virtual adapter of the VPN tunnel to the physical adapter outside of the VPN tunnel, if the session traffic is associated with the first content type based on a security policy, wherein the session traffic redirect is based on the security policy to perform split tunneling, wherein the split tunneling is based on different content types based on the security policy to reduce bandwidth and computing resources used for performing security inspection of network traffic associated with video network traffic or audio network traffic, and wherein the session traffic is redirected outside of the VPN tunnel using an HTTP/HTTPS redirect request with the same destination as the client after determining that the session traffic is associated with the first content type;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
A method for performing split tunneling based on content type, comprising:
- monitoring session traffic received from a client at a security platform, wherein the session traffic is initially routed through a Virtual Private Network (VPN) tunnel, and wherein the session traffic is decrypted and decoded at the security platform;
- determining, from the decrypted and decoded session traffic, if the session traffic is associated with a first content type, wherein the first content type includes video network or audio network traffic;
- and
- send a special redirect response, the special redirect response utilizing a special port option or a TCP option, to re-route the session traffic from a virtual adapter of the VPN tunnel to a physical adapter outside of the VPN tunnel, if the session traffic is associated with the first content type based on a security policy, wherein the session traffic redirect is based on the security policy to perform split tunneling, wherein the split tunneling is based on different content types based on the security policy to reduce bandwidth and computing resources used for performing security inspection of network traffic associated with video network traffic or audio network traffic, and wherein the session traffic is redirected outside of the VPN tunnel using an HTTP/HTTPS redirect request with the same destination as the client after determining that the session traffic is associated with the first content type.
1 more element
A computer program product for performing split tunneling based on content type, the computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for:
- monitoring session traffic received from a client at a security platform, wherein the session traffic is initially routed through a Virtual Private Network (VPN) tunnel, and wherein the session traffic is decrypted and decoded at the security platform;
- determining, from the decrypted and decoded session traffic, if the session traffic is associated with a first content type, wherein the first content type includes video network or audio network traffic;
- and
- send a special redirect response, the special redirect response utilizing a special port option or a TCP option, to re-route the session traffic from a virtual adapter of the VPN tunnel to a physical adapter outside of the VPN tunnel, if the session traffic is associated with the first content type based on a security policy, wherein the session traffic redirect is based on the security policy to perform split tunneling, wherein the split tunneling is based on different content types based on the security policy to reduce bandwidth and computing resources used for performing security inspection of network traffic associated with video network traffic or audio network traffic, and wherein the session traffic is redirected outside of the VPN tunnel using an HTTP/HTTPS redirect request with the same destination as the client after determining that the session traffic is associated with the first content type.
1 more element
Dependencies are inferred from the claim text.