Back to results
US 8,806,605 B1Granted
Provisioning network access through a firewall
AssigneeJuniper Networks, Inc.
InventorRoger A. Chickering
Life of this patent
Estimating the term…
Abstract
A method may include determining one or more rules and communicating the one or more rules to a firewall, where the firewall receives a data unit and determines, based on the one or more rules, whether to forward the data unit to a destination address; receiving a redirection of a device from the firewall when the firewall determines not to forward the data unit to the destination address; receiving an indication that the firewall did not forward the data unit to the destination address; and determining a new rule to allow the firewall to forward the data unit to the destination address and communicating the new rule to the firewall; and redirecting the device to the destination address.
Claims20
A method comprising:
- determining, by one or more devices, one or more rules for provisioning access to a resource;
- communicating, by the one or more devices, the one or more rules to a firewall,
- the firewall receiving a data unit from a device and determining, based on the one or more rules, not to forward the data unit to a destination address associated with the resource;
- receiving, at the one or more devices and from the firewall, a redirection of the device,
- the firewall redirecting the device to the one or more devices based on determining not to forward the data unit to the destination address;
- receiving, at the one or more devices and from the firewall, an indication that the firewall did not forward the data unit to the destination address;
- determining, by the one or more devices and based on accessing a memory containing information associated with the device, that the firewall should forward the data unit to the destination address;
- determining, by the one or more devices and based on determining that the firewall should forward the data unit, a new rule to allow the firewall to forward the data unit to the destination address;
- communicating, by the one or more devices, the new rule to the firewall;
- receiving, at the one or more devices, confirmation from the firewall that the firewall received the new rule;
- determining, by the one or more devices and based on receiving the confirmation, whether the firewall has provisioned access to the resource for the device;
- and
- redirecting, by the one or more devices and when the firewall has provisioned access to the resource for the device, the device to the destination address via the firewall.
10 more elements
A network device comprising:
- one or more memories to store information associated with a first device;
- and
- a processor to:
- determine one or more rules for provisioning access to a resource;
- communicate the one or more rules to a firewall,
- the firewall receiving a data unit from the first device and determining, based on the one or more rules, not to forward the data unit to a destination address associated with the resource;
- receive a redirection of the first device from the firewall,
- the firewall redirecting the first device to the network device based on determining not to forward the data unit to the destination address;
- receive, from the firewall, an indication that the firewall did not forward the data unit to the destination address;
- access the one or more memories to determine, based on the information associated with the first device, that the firewall should forward the data unit to the destination address;
- determine, based on determining that the firewall should forward the data unit, a new rule to allow the firewall to forward the data unit to the destination address;
- communicate the new rule to the firewall;
- receive a confirmation from the firewall,
- the confirmation indicating that the new rule was received by the firewall;
- determine whether the firewall has provisioned access to the resource for the first device;
- and
- redirect, when the firewall has provisioned access to the resource for the first device, the first device to the destination address.
14 more elements
A system comprising:
- a first server device to:
- receive a data unit from a device;
- and
- determine, based on one or more rules associated with provisioning access to a network resource, not to forward the data unit to a destination address associated with the network resource;
- and
- a second server device to:
- determine the one or more rules;
- and
- communicate the one or more rules to the first server device;
- the first server device being further to:
- redirect, based on determining not to forward the data unit, the device to the second server device;
- provide, to the second server device, information indicating that the data unit was not forwarded to the destination address;
- the second server device being further to:
- determine, based on information included in the data unit, that the device is authorized to access the resource;
- determine, based on the device being authorized to access the resource, a new rule to allow the first server device to forward the data unit to the destination address;
- communicate the new rule to the first server device;
- determine that the first server device received the new rule;
- determine when the first server device has provisioned access to the resource to the device;
- and
- redirect the device to the destination address after the second server device has provisioned access to the resource to the device.
17 more elements
An apparatus comprising:
- a processor to:
- authenticate a user device attempting to access a resource,
- the user device transmitting a request to access the resource based on the user device being authenticated,
- a firewall receiving the request to access the resource and determining, based on one or more rules associated with provisioning access to the resource, not to provision access to the resource to the user device;
- receive, from the firewall, a redirection of the user device,
- the firewall redirecting the user device to the apparatus based on determining not to provision the access to the resource to the user device;
- determine that the firewall did not provision the access to the resource to the user device;
- determine, based on authenticating the user device, that the firewall should provision the access to the resource to the user device;
- provide, to the firewall and based on determining that the firewall should provision the access to the resource to the user device, information indicating that the user device is authorized to access to the resource;
- receive a confirmation indicating that the firewall modified a group of rules associated with provisioning access to the resource,
- the modified group of rules including a new rule associated with provisioning access to the resource to the user device;
- determine, after receiving the confirmation, that the firewall has provisioned access to the resource to the user device;
- and
- redirect, based on determining that the firewall device has provisioned access to the resource to the user device, the user device to a destination address associated with the resource.
11 more elements
Dependencies are inferred from the claim text.