Load balancing among a cluster of firewall security devices

A non-transitory computer-readable storage medium readable by one or more processors of a switching device, the computer-readable storage medium embodying a set of instructions executable by the one or more processors to perform a method comprising:

• causing a plurality of firewall security devices within a network and operating as part of a cluster to enter into a load balancing mode by sending one or more control messages to the plurality of firewall security devices;
• responsive to receiving a heartbeat signal on a port of a plurality of ports of the switching device from a firewall security device of the plurality of firewall security devices, including information regarding the firewall security device and the port into a load balancing table maintained by the switching device that maps a plurality of hash values or emulated hash values output by a load balancing function to the plurality of ports;
• receiving a packet from a client device associated with the network;
• and
• forwarding the packet to a firewall security device of the cluster by:
• extracting a configurable number of bit values from a configurable set of bit positions within one or more of a packet type, a source port, a destination port, a source address and a destination address of the packet, wherein the configurable set of bit positions are not limited to being contiguous;
• determining a hash value or an emulated hash value by applying the load balancing function to the configurable number of bit values;
• identifying a port of the plurality of ports to which the firewall security device is coupled based on the hash value or the emulated hash value and the load balancing table;
• transmitting the packet to the firewall security device via the identified port;
• wherein the load balancing function is based on a portion, but not an entirety, of the destination address of the packet;
• and
• wherein the load balancing function is expressed in a form substantially as follows:
• f(x)=DN*2N+DN-1*2N-1 +. . . +D2*22+D1*21+D0*20;
• where DNrepresents a value of a particular bit position within the destination address of the packet;
• and
• where N represents the configurable number of bit values minus 1.

A switching device comprising:

• one or more processors;
• a memory, coupled to the one or more processors, containing therein instructions, which when executed by the one or more processors cause the switch to perform a method comprising:
• causing a plurality of firewall security devices within a network and operating as part of a cluster to enter into a load balancing mode by sending one or more control messages to the plurality of firewall security devices;
• responsive to receiving a heartbeat signal on a port of a plurality of ports of the switching device from a firewall security device of the plurality of firewall security devices, including information regarding the firewall security device and the port into a load balancing table maintained by the switching device that maps a plurality of hash values or emulated hash values output by a load balancing function to the plurality of ports;
• receiving a packet from a client device associated with the network;
• and
• forwarding the packet to a firewall security device of the cluster by:
• extracting a configurable number of bit values from a configurable set of bit positions within one or more of a packet type, a source port, a destination port, a source address and a destination address of the packet, wherein the configurable set of bit positions are not limited to being contiguous;
• determining a hash value or an emulated hash value by applying the load balancing function to the configurable number of bit values;
• identifying a port of the plurality of ports to which the firewall security device is coupled based on the hash value or the emulated hash value and the load balancing table;
• transmitting the packet to the firewall security device via the identified port;
• wherein the load balancing function is based on a portion, but not an entirety, of the destination address of the packet;
• and
• wherein the load balancing function is expressed in a form substantially as follows:
• f(x)=DN*2N+DN-1*2N-1 +. . . +D2*22+D1*21+D0*20;
• where DN represents a value of a particular bit position within the destination address of the packet;
• and
• where N represents the configurable number of bit values minus 1.