Method and apparatus for providing policy-based services for internal applications

In a packet-forwarding device running an internal application and having a first interface and a second interface, a method for providing policy-based services, said method comprising the steps of:

• receiving incoming packets at said first interface, each one of said incoming packets having an address;
• classifying said incoming packets as internally-destined packets if said addresses of said incoming packets are in a first set of addresses and classifying said incoming packets as first external packets if said addresses of said incoming packets are in a second set of addresses;
• applying a first policy to said internally-destined packets;
• forwarding said internally-destined packets to said internal application;
• forwarding said first external packets to said second interface without applying said first policy to said first external packets.

A packet-forwarding device comprising:

• a first interface for transmitting first outgoing and receiving first incoming packets;
• a second interface for transmitting second outgoing and receiving second incoming packets;
• an internal application running on said packet-forwarding device, said internal application generating internally-generated packets and using internally-destined packets;
• an internal interface logically connected to said internal application, said internal interface forwarding said internally-generated packets to said first interface, said internal interface forwarding said internally-destined packets to said internal application;
• a packet forwarder logically connected to said first interface and to said second interface, said packet forwarder forwarding packets between said first and second interfaces;
• a first packet classifier logically connected to said first interface, said internal interface, and said packet forwarder, said first packet classifier classifying said first incoming packets as first internally-destined packets if destination addresses in said first incoming packets are in a first set of one or more addresses and classifying said first incoming packets as first external packets if destination addresses in said first incoming packets are in a second set of one or more addresses, said first packet classifier forwarding said first internally-destined packets to said internal interface, said packet classifier forwarding said first external packets to said packet forwarder;
• a second packet classifier logically connected to said second interface, said internal interface, and said packet forwarder, said second packet classifier classifying said second incoming packets as second internally-destined packets if destination addresses in said second incoming packets are in said first set of one or more addresses and classifying said second incoming packets as second external packets if destination addresses in said second incoming packets are in said second set of one or more addresses, said second packet classifier forwarding said second internally-destined packets to said internal interface, said packet classifier forwarding said second external packets to said packet forwarder, and
• a first policy engine logically connected to said internal interface and to said internal application, said first policy engine applying a first policy to internal packets, said internal packets being selected from the group consisting of said internally-generated packets and said internally-destined packets.

In a packet-forwarding device having a first interface, a second interface, a packet forwarder forwarding packets between said first and second interfaces, and running an internal application, said internal application generating internally-generated packets and using internally-destined packets, an improvement comprising:

• at least one packet classifier logically connected to said first and second interfaces, said at least one packet classifier classifying received packets received by said first and second interfaces as internal packets or external packets based on destination addresses in said received packets;
• an internal interface logically connected to said internal application and said at least one packet classifier;
• and
• a policy engine logically connected to said internal interface, said policy engine applying a policy to said internal packets.