Routing device having integrated MPLS-aware firewall with virtual security system support

A method comprising:

• executing, with a routing engine of a router, at least one protocol to establish VPN tunnels for one or more customer VPNs, wherein the router includes an integrated firewall configured to provide a plurality of virtual security systems, each of the virtual security systems represents a logically partitioned firewall instance;
• presenting, with the router, a user interface by which a user specifies one or more zones to be recognized by the firewall, wherein the user interface allows the user to define different zones for different ones of the virtual security systems, and wherein the user interface supports a syntax that allows the user to define at least one of the zones by specifying one or more of the customer VPNs as interfaces associated with the zone;
• communicating mapping information from the routing engine to the firewall, wherein for each of the virtual security systems the mapping information associates VPN labels for the VPN tunnels with the customer VPNs for that virtual security system, wherein for VPN tunnels for which the network router operates as an egress label switched router, the mapping information associates inner VPN labels affixed to packets received by the interface cards with respective ones of the customer VPNs for the different virtual security systems;
• receiving, from a network, packets at a plurality of interfaces of the router;
• directing, with a flow control module of a forwarding engine of the router, one or more of the received packets to the firewall for application of stateful firewall services;
• applying stateful firewall services to the packets with the firewall of the network router based on the zones specified by the user by associating each of the packets with one of the virtual security devices and identifying the zones specified by the user for the associated virtual security device based on the mapping information;
• after applying stateful firewall services, forwarding at least some of the packets from the firewall to the forwarding engine;
• selecting next hops for the packets within the network with the forwarding engine;
• and
• forwarding the packets to the interfaces in accordance with the selected next hops.

A non-transitory computer-readable storage medium comprising program instructions to cause a processor to:

• execute, with a routing engine of a router, at least one protocol to establish label switched paths (LSPs) to carry VPN communications for a plurality of customer virtual private networks (VPNs), wherein the router includes an integrated firewall configured to provide a plurality of virtual security systems, each of the virtual security systems represents a logically partitioned firewall instance;
• present, with the router, a user interface by which a user specifies one or more zones to be recognized by the firewall integrated within the router,
• wherein the user interface allows the user to define different zones for different ones of the virtual security systems of the firewall, and
• wherein the user interface supports a syntax that allows the user to define at least one of the zones by specifying one or more of the customer VPNs as interfaces associated with the zone;
• and
• communicate mapping information from the routing engine to the firewall, wherein for each of the virtual security systems the mapping information associates VPN labels for the VPN tunnels with the customer VPNs for that virtual security system, wherein for VPN tunnels for which the network router operates as an egress label switched router, the mapping information associates inner VPN labels affixed to packets received by the interface cards with respective ones of the customer VPNs for the different virtual security systems.