# US 12,184,552 B2 · Firewall load balancing with tunnel switching protocols > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,552 B2 - Document ID: US12184552B2 - Status: Granted - Kind: B2 - Application number: 17/660,128 - Filed: 2022-04-21 - Published: 2023-10-26 - Granted: 2024-12-31 - Earliest claimed: 2022-04-21 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Avaneesh Anandrao Kadam; Bhaskar Bhupalam; Ketan Gunawant Kulkarni - Web page: https://patentgrep.com/patent/US12184552B2 ## CPC - H04L 47/125: by balancing the load, e.g. traffic engineering - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An auto scale monitoring service performs load balancing on a cloud firewall with minimized traffic disruption using eager and lazy load balancing protocols. The auto scale monitoring service operates through an orchestrator that initializes a new firewall and sends forwarding instructions to the new firewall for rerouting excess traffic. The auto scale monitoring service additionally operates through a software-defined wide area network controller that sends routing instructions to a local branch of network devices to reroute to the new firewall from an overloaded current firewall. The eager protocol immediately tears down a tunneling session from the local branch to the current firewall and the lazy protocols gradually tears down this tunneling session. Both protocols properly inform firewalls how to forward ongoing traffic in each case and establish updated traffic flow through a tunneling session from the local branch to the new firewall. ## Claims ### Claim 1 A method comprising: detecting a load balancing event affecting a first firewall; and lazy load balancing between the first firewall and at least a second firewall, wherein lazy load balancing between the first and second firewalls comprises, identifying a first branch location with a set of one or more network devices communicatively coupled to the first firewall with a first tunnel; instructing a set of one or more routing devices at the first branch location to establish a second tunnel between the set of one or more network devices of the first branch location and a second firewall; instructing the first firewall to forward, to the second firewall, protocol data units (PDUs) for at least one of traffic flows and traffic sessions not previously observed by the first firewall; communicating router metric values that indicate a preference for the first tunnel over the second tunnel to the set of one or more routing devices at the first branch location; and based on one or more tear down criteria being satisfied, instructing at least one of the first firewall and the first branch location to tear down the first tunnel. ### Claim 2 (depends on 1) The method of claim 1, wherein the first firewall and the second firewall are hosted in a cloud. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more tear down criteria comprise a determination that at least one of traffic flows and traffic sessions not previously observed by the first firewall have at least one of inactive and timed out. ### Claim 4 (depends on 1) The method of claim 1, wherein communicating router metric values that indicate the preference for the first tunnel over the second tunnel to the set of one or more routing devices at the first branch location comprises communicating, to a wide area network controller managing the set of one or more routing devices, instructions to, update one or more routing tables for the set of one or more routing devices with a first route corresponding to the second tunnel, wherein the first route in the updated one or more routing tables has a higher router metric value than a second route corresponding to the first tunnel; and advertise the second route. ### Claim 5 (depends on 1) The method of claim 1, further comprising communicating, to a network orchestrator managing at least the first and second firewalls, instructions to, initialize the second firewall based, at least in part, on detecting the load balancing event; and communicate forwarding instructions to the first firewall and the second firewall. ### Claim 6 (depends on 5) The method of claim 5, wherein communicating the instructions to initialize the second firewall comprises communicating initialization parameters to a cloud service provider, wherein the initialization parameters are formatted according to an application programming interface for the cloud service provider. ### Claim 7 (depends on 1) The method of claim 1, wherein the lazy load balancing between the first firewall and at least the second firewall is based, at least in part, on a determination that a traffic load at the first firewall is acceptable for at least a time interval until the tear down criteria are satisfied. ### Claim 8 (depends on 7) The method of claim 7, wherein the determination that the traffic load at the first firewall is acceptable for at least the time interval until the tear down criteria are satisfied is based, at least in part, on network topology for a network comprising the first firewall and the second firewall. ### Claim 9 A non-transitory, computer-readable medium having instructions stored thereon that are executable by a computing device, the instructions to: detect a load balancing event affecting a first firewall; and eager load balance between the first firewall and at least a second firewall, wherein the instructions to eager load balance between the first and second firewalls comprise instructions to, identify a first branch location with a set of one or more network devices communicatively coupled to the first firewall with a first tunnel; instruct a set of one or more routing devices at the first branch location to establish a second tunnel between the set of one or more network devices of the first branch location and a second firewall; instruct the second firewall to forward, to the first firewall, protocol data units (PDUs) for at least one of traffic flows and traffic sessions previously observed by the first firewall; communicate router metric values that indicate a preference for the second tunnel over the first tunnel to the set of one or more routing devices at the first branch location; and instruct at least one of the first firewall and the first branch location to tear down the first tunnel. ### Claim 10 (depends on 9) The computer-readable medium of claim 9, further comprising instructions to instruct the first firewall to forward, to the second firewall, indications of the at least one of traffic flows and traffic sessions previously observed by the first firewall, wherein the instructions to instruct the second firewall to forward, to the first firewall, the PDUs for at least one of traffic flows and traffic sessions previously observed by the first firewall are based, at least in part, on the indications of the at least one of traffic flows and traffic sessions previously observed by the first firewall. ### Claim 11 (depends on 9) The computer-readable medium of claim 9, further comprising instructions to, subsequent to instructing at least one of the first firewall and the first branch location to tear down the first tunnel, determine that an inspection criterion is satisfied; and based on the inspection criterion being satisfied, instruct the second firewall to terminate forwarding, to the first firewall, PDUs for at least one of traffic flows and traffic sessions previously observed by the first firewall. ### Claim 12 (depends on 11) The computer-readable medium of claim 11, wherein the inspection criterion comprises a determination that the at least one of traffic flows and traffic sessions previously observed the first firewall are at least one of inactive and timed out. ### Claim 13 (depends on 9) The computer-readable medium of claim 9, wherein the first firewall and the second firewall are hosted in a cloud. ### Claim 14 (depends on 9) The computer-readable medium of claim 9, wherein the instructions to communicate router metric values that indicate the preference for the second tunnel over the first tunnel to the set of one or more routing devices at the first branch location comprise instructions to communicate, to a wide area network controller managing the set of one or more routing devices, instructions to, update one or more routing tables for the set of one or more routing devices with a first route corresponding to the second tunnel, wherein the first route in the updated one or more routing tables has a lower router metric value than a second route corresponding to the first tunnel; and advertise the first route. ### Claim 15 (depends on 9) The computer-readable medium of claim 9, further comprising instructions to communicate to a software-defined wide area network (SD-WAN) orchestrator managing at least the first and second firewalls instructions to, initialize the second firewall based, at least in part, on detecting the load balancing event; and communicate forwarding instructions to the first firewall and the second firewall. ### Claim 16 (depends on 9) The computer-readable medium of claim 9, wherein the instructions to eager load balance between the first firewall and at least the second firewall are based, at least in part, on a determination that a traffic load at the first firewall is above a threshold load, wherein the threshold load corresponds to immediate traffic rerouting. ### Claim 17 (depends on 16) The computer-readable medium of claim 16, wherein the threshold load is based, at least in part, on network topology for a network comprising the first firewall and the second firewall. ### Claim 18 An apparatus comprising: a processor; and a computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, detect a load balancing event affecting a first firewall; and eager load balance between the first firewall and at least a second firewall, wherein the instructions to eager load balance between the first and second firewalls comprise instructions to, identify a first branch location with a set of one or more network devices communicatively coupled to the first firewall with a first tunnel; instruct a set of one or more routing devices at the first branch location to establish a second tunnel between the set of one or more network devices of the first branch location and a second firewall; instruct the second firewall to forward, to the first firewall, protocol data units (PDUs) for at least one of traffic flows and traffic sessions previously observed by the first firewall; communicate router metric values that indicate a preference for the second tunnel over the first tunnel to the set of one or more routing devices at the first branch location; and instruct at least one of the first firewall and the first branch location to tear down the first tunnel. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the computer-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to instruct the first firewall to forward, to the second firewall, indications of the at least one of traffic flows and traffic sessions previously observed by the first firewall, wherein the instructions to instruct the second firewall to forward, to the first firewall, the PDUs for at least one of traffic flows and traffic sessions previously observed by the first firewall are based, at least in part, on the indications of the at least one of traffic flows and traffic sessions previously observed by the first firewall. ### Claim 20 (depends on 18) The apparatus of claim 18, wherein the computer-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to, subsequent to instructing at least one of the first firewall and the first branch location to tear down the first tunnel, determine that an inspection criterion is satisfied; and based on the inspection criterion being satisfied, instruct the second firewall to terminate forwarding, to the first firewall, PDUs for at least one of traffic flows and traffic sessions previously observed by the first firewall.