US 12,184,552 B2 · Firewall load balancing with tunnel switching protocols

Abstract

An auto scale monitoring service performs load balancing on a cloud firewall with minimized traffic disruption using eager and lazy load balancing protocols. The auto scale monitoring service operates through an orchestrator that initializes a new firewall and sends forwarding instructions to the new firewall for rerouting excess traffic. The auto scale monitoring service additionally operates through a software-defined wide area network controller that sends routing instructions to a local branch of network devices to reroute to the new firewall from an overloaded current firewall. The eager protocol immediately tears down a tunneling session from the local branch to the current firewall and the lazy protocols gradually tears down this tunneling session. Both protocols properly inform firewalls how to forward ongoing traffic in each case and establish updated traffic flow through a tunneling session from the local branch to the new firewall.

Claims20

Dependent claims

A method comprising:

detecting a load balancing event affecting a first firewall;
and
lazy load balancing between the first firewall and at least a second firewall, wherein lazy load balancing between the first and second firewalls comprises,
identifying a first branch location with a set of one or more network devices communicatively coupled to the first firewall with a first tunnel;
instructing a set of one or more routing devices at the first branch location to establish a second tunnel between the set of one or more network devices of the first branch location and a second firewall;
instructing the first firewall to forward, to the second firewall, protocol data units (PDUs) for at least one of traffic flows and traffic sessions not previously observed by the first firewall;
communicating router metric values that indicate a preference for the first tunnel over the second tunnel to the set of one or more routing devices at the first branch location;
and
based on one or more tear down criteria being satisfied, instructing at least one of the first firewall and the first branch location to tear down the first tunnel.

6 more elements

A non-transitory, computer-readable medium having instructions stored thereon that are executable by a computing device, the instructions to:

detect a load balancing event affecting a first firewall;
and
eager load balance between the first firewall and at least a second firewall, wherein the instructions to eager load balance between the first and second firewalls comprise instructions to,
identify a first branch location with a set of one or more network devices communicatively coupled to the first firewall with a first tunnel;
instruct a set of one or more routing devices at the first branch location to establish a second tunnel between the set of one or more network devices of the first branch location and a second firewall;
instruct the second firewall to forward, to the first firewall, protocol data units (PDUs) for at least one of traffic flows and traffic sessions previously observed by the first firewall;
communicate router metric values that indicate a preference for the second tunnel over the first tunnel to the set of one or more routing devices at the first branch location;
and
instruct at least one of the first firewall and the first branch location to tear down the first tunnel.

6 more elements

An apparatus comprising:

a processor;
and
a computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
detect a load balancing event affecting a first firewall;
and
eager load balance between the first firewall and at least a second firewall, wherein the instructions to eager load balance between the first and second firewalls comprise instructions to,
identify a first branch location with a set of one or more network devices communicatively coupled to the first firewall with a first tunnel;
instruct a set of one or more routing devices at the first branch location to establish a second tunnel between the set of one or more network devices of the first branch location and a second firewall;
instruct the second firewall to forward, to the first firewall, protocol data units (PDUs) for at least one of traffic flows and traffic sessions previously observed by the first firewall;
communicate router metric values that indicate a preference for the second tunnel over the first tunnel to the set of one or more routing devices at the first branch location;
and
instruct at least one of the first firewall and the first branch location to tear down the first tunnel.

9 more elements

Dependencies are inferred from the claim text.

Firewall load balancing with tunnel switching protocols

Life of this patent

Firewall load balancing with tunnel switching protocols

Life of this patent

Abstract

Claims20