Palo Alto Networks, Inc.

Nazanin Magharei

Harshavardhan Parandekar

Vikram Guleria

Tapraj Singh

Rimu Bhardwaj

Yu Zhang

A pseudo-active/active firewall configuration handles firewall switchover events with minimized session disconnection. A passive firewall is set to an active state, and an active firewall is switched to a pseudo-active state wherein it continues to process ingress and egress traffic according to traffic handling protocols for its active state. During updating of a corresponding Network Address Translation (NAT) table to route traffic to the now-active firewall, the pseudo-active firewall enters a forwarding state wherein it forwards ingress network sessions to the now-active firewall and processes the ingress network sessions according to its active state. The now-active firewall receives the ingress network sessions and records session states prior to discarding them. After updating the NAT table, when traffic is routed to the now-active firewall, the recorded session states are used to maintain active sessions.

Firewall switchover with minimized session disconnection

A pseudo-active/active firewall configuration handles firewall switchover events without traffic disruption. A passive firewall is set to an active state, and an active firewall is switched to a pseudo-active state wherein it continues to process ingress and egress traffic according to traffic handling protocols for its active state. An Internet protocol address binding linking the now pseudo-active firewall to an Internet gateway that forwards traffic to the firewalls is updated in a network address translation (NAT) table to route traffic to the newly active firewall. Once a pseudo-active timer expires and the binding is successfully updated to route traffic to the newly active firewall, the pseudo-active firewall is set to a passive state.

Firewall switchover with minimized traffic disruption

A proxy server can be configured to manage flow between terminated transport layer connections despite incongruous network conditions. The proxy server is programmed to dynamically adjust window size of one transport layer connection in the pair of proxy terminated connections to accommodate the other connection. After detecting a network condition related to one of the connections, the proxy server determines a drain rate of the transmit buffer of the transport layer connection corresponding to the impacting network condition. The proxy server then adjusts the transport layer window size for the other connection of the connection pair based on the determined drain rate.

Growing community of inventors

San Jose, CA, United States of America

Nazanin Magharei