Firewall clustering for multiple network servers

A method of managing message traffic between an interior network and an exterior network in conjunction with a plurality of firewalls securing the interior network from intrusion from the exterior network, comprising:

• creating an internal firewall cluster containing a plurality of the firewalls which are in the interior network, the internal firewall cluster being addressed by a first logical Internet Protocol (IP) address that is distinct from unique IP addresses of the firewalls contained within the internal firewall cluster, and further being addressed by a first associated media access control (MAC) address that is distinct from MAC addresses of the firewalls contained within the internal firewall cluster;
• creating an external firewall cluster containing a plurality of the firewalls that are in the exterior network, the external firewall cluster being addressed by a second logical IP address that is distinct from unique IP addresses of the firewalls contained within the external firewall cluster, and further being addressed by a second associated MAC address that is distinct from MAC addresses of the firewalls contained within the external firewall cluster;
• in response to a first packet outbound to the exterior network and addressed to the first logical IP address or the first associated MAC address, a first flow controller that is associated with the internal firewall cluster and that is distinct from the firewalls contained within the internal firewall cluster selecting a first firewall from among the internal firewall cluster on a basis of information in a header of the first packet;
• in response to the selecting of the first firewall, the first flow controller addressing the first packet to the MAC address of the first firewall;
• in response to the addressing of the first packet, the first flow controller sending the first packet to the first firewall for transferring the first packet from the interior network via the first firewall;
• in response to a second packet inbound to the interior network and addressed to the second logical IP address or the second associated MAC address, a second flow controller that is associated with the external firewall cluster and that is distinct from the firewalls contained within the external firewall cluster selecting a second firewall from among the external firewall cluster on a basis of information in a header of the second packet;
• in response to selecting of the second firewall, the second flow controller addressing the second packet to the MAC address of the second firewall;
• and
• in response to the addressing of the second packet, the second flow controller sending the second packet to the second firewall for transferring the second packet from the exterior network via the second firewall.

An apparatus for managing message traffic between an interior network and an exterior network in conjunction with a plurality of firewalls securing the interior network from intrusion from the exterior network, comprising:

• a first flow controller defining an internal firewall cluster containing a plurality of the firewalls which are in the interior network, the internal firewall cluster being addressed by a first logical Internet Protocol (IP) address that is distinct from unique IP addresses of the firewalls contained within the internal firewall cluster, and further being addressed by a first associated media access control (MAC) address that is distinct from unique MAC addresses of the firewalls contained within the internal firewall cluster, the first flow controller being associated with the internal firewall cluster, being distinct from the firewalls contained within the internal firewall cluster, and being responsive to a first packet outbound to the exterior network and addressed to the first logical IP address or the first associated MAC address by selecting a first firewall from among the internal firewall cluster on a basis of information in a header of the first packet, addressing the first packet to the MAC address of the first firewall, and sending the first packet to the first firewall for transfer of the packet by the first firewall between the interior network and the exterior network;
• and
• a second flow controller defining an external firewall cluster containing a plurality of the firewalls which are in the exterior network, the external firewall cluster being addressed by a second logical IP address that is distinct from unique IP addresses of the firewalls contained within the external firewall cluster, and further being addressed by a second associated MAC address that is distinct from MAC addresses of the firewalls contained within the external firewall cluster, the second flow controller being associated with the external firewall cluster, being distinct from the firewalls contained within the external firewall cluster, and being responsive to a second packet inbound to the interior network and addressed to the second logical IP address or the second associated MAC address by selecting a second firewall from among the external firewall cluster on a basis of information in a header of the second packet, addressing the second packet to the MAC address of the second firewall, and sending the second packet to the second firewall for transfer of the packet by the second firewall between the exterior network and the interior network.