# US 9,882,875 B2 · Regional firewall clustering in a networked computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,875 B2 - Document ID: US9882875B2 - Status: Granted - Kind: B2 - Application number: 15/255,494 - Filed: 2016-09-02 - Published: 2016-12-22 - Granted: 2018-01-30 - Earliest claimed: 2013-06-07 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Robert K. Floyd, III; Baiju D. Mandalia; Robert P. Monaco; Mahesh Viswanathan - Web page: https://patentgrep.com/patent/US9882875B2 ## CPC - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 43/0864: Round trip delays - H04L 47/283: in response to processing delays, e.g. caused by jitter or round trip time [RTT] - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/5681: Pre-fetching or pre-delivering data based on network characteristics - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An approach for regional firewall clustering for optimal state-sharing of different sites in a virtualized/networked (e.g., cloud) computing environment is provided. In a typical embodiment, each firewall in a given region is informed of its peer firewalls via a registration process with a centralized server. Each firewall opens up an Internet protocol (IP)-based communication channel to each of its peers in the region to share state table information. This allows for asymmetrical firewall flows through the network and allows routing protocols to ascertain the best path to a given destination without having to take firewall placement into consideration. ## Claims ### Claim 1 A method for managing a firewall cluster in a networked computing environment, comprising the computer-implemented steps of: defining a cluster delay time interval as a highest round trip time (RTT) value among a set of firewall pairs in a firewall cluster; receiving a packet at a first firewall in the firewall cluster between a source and a destination, wherein the packet has an unknown session state; reading a session state table to determine whether there exists a session state match based on the source and destination; determining, based on the reading, that a session state match is not found; determining, in response to the determination that the session state match is not found, whether the packet is allowed by a regional policy of the firewall cluster; when the packet is allowed by the regional policy, buffering the packet for the duration of the cluster delay interval; determining whether session state information arrives from a second firewall prior to expiration of the cluster delay interval; and when the session state information arrives from the second firewall prior to the expiration of the cluster delay interval, forwarding the packet to the destination. ### Claim 2 (depends on 1) The method of claim 1, further comprising the computer-implemented step of determining the cluster delay time interval. ### Claim 3 (depends on 1) The method of claim 1, further comprising the computer-implemented step of opening a communication channel between each firewall pair in the firewall cluster. ### Claim 4 (depends on 3) The method of claim 3, further comprising determining a round-trip time (RTT) value between each firewall pair in the firewall cluster using the respective communication channel. ### Claim 5 (depends on 4) The method of claim 4, wherein the computer-implemented step of determining a round-trip time (RTT) value between a firewall pair in the firewall cluster comprises pinging the second firewall in the firewall pair from the first firewall in the firewall pair. ### Claim 6 (depends on 1) The method of claim 1, further comprising the computer-implemented step of updating the session state table with session state information related to the source and destination. ### Claim 7 (depends on 1) The method of claim 1, where the networked computing environment is a cloud computing environment. ### Claim 8 (depends on 1) The method of claim 1, wherein a solution service provider provides a computer infrastructure operable to perform for one or more consumers. ### Claim 9 A system for correcting non-compliant source code, comprising: a memory medium comprising program instructions; a bus coupled to the memory medium; and a processor, for executing the program instructions, which causes the system to: define a cluster delay time interval as a highest round trip time (RTT) value among a set of firewall pairs in a firewall cluster; receive a packet at a first firewall in the firewall cluster between a source and a destination, wherein the packet has an unknown session state; read a session state table to determine whether there exists a session state match based on the source and destination; determine, based on the reading, that a session state match is not found; determine, in response to the determination that the session state match is not found, whether the packet is allowed by a regional policy of the firewall cluster; when the packet is allowed by the regional policy, buffering the packet for the duration of the cluster delay interval; determine whether session state information arrives from a second firewall prior to expiration of the cluster delay interval; and when the session state information arrives from the second firewall prior to the expiration of the cluster delay interval, forwarding the packet to the destination. ### Claim 10 (depends on 9) The system of claim 9, the memory medium further comprising instructions for causing the system to determine the cluster delay time interval. ### Claim 11 (depends on 9) The system of claim 9, the memory medium further comprising instructions for causing the system to open a communication channel between each firewall pair in the firewall cluster. ### Claim 12 (depends on 11) The system of claim 11, the memory medium further comprising instructions for causing the system to determine a round-trip time (RTT) value between each firewall pair in the firewall cluster using the respective communication channel. ### Claim 13 (depends on 12) The system of claim 12, the memory medium further comprising instructions for causing the system to determine a round-trip time (RTT) value between a firewall pair in the firewall cluster comprises pinging the second firewall in the firewall pair from the first firewall in the firewall pair. ### Claim 14 (depends on 9) The system of claim 9, the memory medium further comprising instructions for causing the system to update the session state table with session state information related to the source and destination. ### Claim 15 A computer program product for managing a firewall cluster in a networked computing environment, the computer program product comprising a computer readable hardware storage device, and program instructions stored on the computer readable hardware storage device, to: define a cluster delay time interval as a highest round trip time (RTT) value among a set of firewall pairs in a firewall cluster; receive a packet at a first firewall in the firewall cluster between a source and a destination, wherein the packet has an unknown session state; read a session state table to determine whether there exists a session state match based on the source and destination; determine, based on the reading, that a session state match is not found; determine, in response to the determination that the session state match is not found, whether the packet is allowed by a regional policy of the firewall cluster; when the packet is allowed by the regional policy, buffering the packet for the duration of the cluster delay interval; determine whether session state information arrives from a second firewall prior to expiration of the cluster delay interval; and when the session state information arrives from the second firewall prior to the expiration of the cluster delay interval, forwarding the packet to the destination. ### Claim 16 (depends on 15) The computer program product of claim 15, the computer readable hardware storage device further comprising instructions to open a communication channel between each firewall pair. ### Claim 17 (depends on 16) The computer program product of claim 16, the computer readable hardware storage device further comprising instructions to determine a round-trip time (RTT) value between each firewall pair using an appropriate communication channel. ### Claim 18 (depends on 17) The computer program product of claim 17, the computer readable hardware storage device further comprising instructions to determine a round-trip time (RTT) value between a firewall pair comprises pinging the second firewall in the firewall pair from the first firewall in the firewall pair. ### Claim 19 (depends on 15) The computer program product of claim 15, the computer readable hardware storage device further comprising instructions to update the session state table with session state information related to the source and destination. ### Claim 20 (depends on 15) The computer program product of claim 15, wherein the networked computing environment is a cloud computing environment.