# US 12,003,483 B1 · Smart firewall filtering in a label-based network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,483 B1 - Document ID: US12003483B1 - Status: Granted - Kind: B1 - Application number: 16/710,918 - Filed: 2019-12-11 - Granted: 2024-06-04 - Earliest claimed: 2019-12-11 - Assignees: Juniper Networks, Inc. - Applicants: Juniper Networks, Inc. - Inventors: Amin Qassoud - Web page: https://patentgrep.com/patent/US12003483B1 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network device may receive an input identifying one or more conditions associated with traversal of packets through a network and one or more actions to be performed if the one or more conditions are satisfied. The network device may transmit, to a path computation element, a request for a label set that satisfies the one or more conditions. The network device may receive the label set from the path computation element. The network device may configure a firewall policy indicating that the one or more actions are to be performed for a packet associated with a label stack that includes the label set. ## Claims ### Claim 1 A method, comprising: receiving, at a network device, an input identifying: one or more conditions associated with traversal of packets through a network, wherein the one or more conditions comprise: a first condition that a packet, of the packets, traverses along a path to a destination node through a particular sequence of nodes included in the path, and a second condition that the packet is routed to avoid a network segment that includes a particular untrusted network, and one or more actions, associated with a firewall policy, to be performed if the one or more conditions are satisfied; transmitting, by the network device and to a path computation element, a request for a label set, that includes one or more subsets of labels, that satisfies the one or more conditions, wherein the label set identifies a particular sequence of labels associated with the particular sequence of nodes in the network; receiving, by the network device and from the path computation element, the label set based on transmitting the request; identifying, by the network device, a label stack of the packet that includes the label set; comparing, by the network device, the label set and the label stack of the packet to determine if one or more subsets of labels in the label set are included in the label stack of the packet; determining, by the network device, that the label stack of the packet satisfies the firewall policy based on comparing the label set and the label stack of the packet; performing, by the network device, the one or more actions based on determining that the label stack of the packet satisfies the firewall policy, wherein the one or more actions are associated with the packet; receiving, by the network device and from the path computation element, an updated label set based on changes in the network; and automatically updating, by the network device, the firewall policy to include the updated label set. ### Claim 2 (depends on 1) The method of claim 1, wherein the one or more actions comprise at least one of: logging the packet, saving the packet, performing deep packet inspection on the packet, or dropping or discarding the packet. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more conditions comprise: a first condition associated with one or more first nodes in the network, and a second condition associated with one or more second nodes in the network, wherein the first condition and the second condition are associated by an AND operator. ### Claim 4 (depends on 1) The method of claim 1, wherein the label set comprises: a first label associated with a first node in the network, and a combination of a particular sequence of labels that comprises: a second label associated with a second node in the network, and a third label associated with a third node in the network. ### Claim 5 (depends on 1) The method of claim 1, wherein the device is a label edge router for the network. ### Claim 6 (depends on 1) The method of claim 1, further comprising: identifying one or more labels associated with each node identified in the one or more conditions; generating a label set based on the one or more labels; and wherein transmitting the request for the label set that satisfies the one or more conditions comprises: transmitting the request for the label set, wherein the label set is based on the one or more labels. ### Claim 7 (depends on 1) The method of claim 1, wherein receiving the input comprises: receiving the input via a command line interface of the network device. ### Claim 8 A network device, comprising: one or more memories; and one or more processors, to: receive an input identifying: a plurality of conditions associated with traversal of packets through a network, wherein the plurality of conditions comprise: a first condition that a packet, of the packets, traverses along a path to a destination node through a particular sequence of nodes included in the path, and a second condition that the packet is routed to avoid a network segment that includes a particular untrusted network; and one or more actions, associated with a firewall policy, to be performed if one or more of the plurality of conditions are satisfied; transmit, to a path computation element, a request for a label set, that includes one or more subsets of labels, for the plurality of conditions, wherein the label set identifies a particular sequence of labels associated with the particular sequence of nodes in the network; receive, from the path computation element and based on transmitting the request, the label set; identify a label stack of the packet that includes the label set; compare the label set and the label stack of the packet to determine if one or more subset of labels in the label set are included in the label stack of the packet; determine that the label stack of the packet satisfies the firewall policy based on comparing the label set and the label stack of the packet; perform the one or more actions based on determining that the label stack of the packet satisfies the firewall policy, wherein the one or more actions are associated with the packet; receive, from the path computation element, an updated label set based on changes in the network; and automatically update the firewall policy to include the updated label set. ### Claim 9 (depends on 8) The network device of claim 8, wherein the network is a multiprotocol label switching segment routing network. ### Claim 10 (depends on 8) The network device of claim 8, wherein the network device is a label edge router for the network. ### Claim 11 (depends on 8) The network device of claim 8, wherein, the one or more processors, when receiving the input, are to: receive the input from another network device, receive the input via a command line interface of the network device, or receive the input from an application associated with the network device. ### Claim 12 (depends on 8) The network device of claim 8, wherein the plurality of conditions comprise: a first condition associated with one or more first nodes in the network, a second condition associated with one or more second nodes in the network, and a third condition associated with one or more third nodes in the network, wherein the first condition, the second condition, and the third condition are associated by a plurality of OR operators. ### Claim 13 (depends on 8) The network device of claim 8, wherein the label set is a part of a plurality of label sets, and the plurality of label sets comprise: a first label set associated with a first condition, a second label set associated with a second condition, and a third label set associated with a third condition. ### Claim 14 (depends on 8) The network device of claim 8, wherein the one or more processors are further to: identify one or more labels associated with each node identified in the plurality of conditions; generate a label set based on the one or more labels; and wherein the one or more processors, when transmitting the request for the label set that satisfies the plurality of conditions, are to: transmit the request for the label set, wherein the label set is based on the one or more labels. ### Claim 15 A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors, cause the one or more processors to: receive an input identifying: one or more conditions associated with traversal of packets through a network, wherein the one or more conditions comprise: a first condition that a packet, of the packets, traverses along a path to a destination node through a particular sequence of nodes included in the path, and a second condition that the packet is routed to avoid a network segment that includes a particular untrusted network, and one or more actions, associated with a firewall policy, to be performed if the one or more conditions are satisfied; transmit, to a path computation element, a request for a label set that satisfies the one or more conditions; receive, from the path computation element and based on transmitting the request, the label set, that includes one or more subsets of labels, wherein the label set identifies a particular sequence of labels associated with the particular sequence of nodes in the network; identify a label stack of a packet that includes the label set; compare the label set and the label stack of the packet to determine if one or more subset of labels in the label set are included in the label stack of the packet; determine that the label stack of the packet satisfies the firewall policy based on comparing the label set and the label stack of the packet; perform the one or more actions based on determining that the label stack of the packet satisfies the firewall policy, wherein the one or more actions are associated with the packet; receive, from the path computation element, an updated label set based on changes in the network; and automatically update the firewall policy to include the updated label set. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more actions comprise at least one of: routing the packet along an intended path, rerouting the packet along another path, or counting the packet. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein, the one or more instructions, that cause the one or more processors to receive the input, cause the one or more processors to: receive the input from another network device, receive the input via a command line interface of the network device, or receive the input from an application associated with the network device. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the network is a multiprotocol label switching segment routing network. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more conditions comprise: a first condition associated with one or more first nodes in the network, a second condition associated with one or more second nodes in the network, and a third condition associated with one or more third nodes in the network, wherein the first condition and the second condition are associated by an AND operator, and wherein the third condition is associated with the first condition and the second condition by a NOT operator. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the label stack includes a particular set of labels in the label stack that is selected for the one or more actions that are specified in a firewall policy.