Fortinet, Inc.

Yixin Pan

Hongwei Li

Wenping Luo

Tao Huang

Michael Xie

Robert A May

Xiaodong Xu

Yong Wang

Systems and methods for selectively disabling anti-replay security checks based on a defined network policy that can override the globally-defined defaults for specific network sessions are provided. A network security device protecting a private network receives a packet associated with a network traffic flow between a source computing device and an internal destination computing device. The network security device identifies an anti-replay policy associated with the network traffic flow and whether the anti-replay policy is intended to override a global anti-replay policy of the network security device. When the identifying is affirmative, the network security device performs one or more anti-replay security checks in accordance with the anti-replay policy. When the identifying is negative, the network security device performs the one or more anti-replay security checks in accordance with the global anti-replay policy.

Selectively disabling anti-replay protection by a network security device

Methods and systems are provided for increasing application performance and accelerating data communications in a WAN environment. According to one embodiment, packets are received at a flow classification module operating at the Internet Protocol (IP) layer of a first wide area network (WAN) acceleration device via a private tunnel, which is operable to convey application layer data for connection-oriented applications between WAN acceleration devices. The packets are passed to a WAN socket operating at the transport layer. Based on the application protocol, the packets are passed to an application handler of multiple application handlers operating at the application layer each of which implements one or more application acceleration techniques for a particular application layer protocol known to behave poorly within a WAN environment. The existing connection-oriented flow is securely accelerated by performing one or more application acceleration techniques and applying one or more security functions.

Accelerating data communication using tunnels

Systems and methods for a VRF-aware socket are provided. According to one embodiment, a user-space application of a network device, maintaining a virtual routing table for each of multiple VRF domains, creates a VRF-aware listening socket. The socket includes information regarding: (i) which of the virtual routing tables is to be used to look up routing or forwarding information for outgoing traffic; (ii) the VRF domain(s) from which the socket is able to receive incoming traffic; and/or (iii) the last VRF domain from which the socket read data. The socket is configured to be a super-VRF listening socket capable of receiving incoming traffic from all VRF domains by setting its VRF domain(s) to a wildcard value. The super-VRF listening socket then receives from a client device associated with a first VRF domain of the multiple VRF domains a request on behalf of the user-space application.

Virtual routing and forwarding (VRF)-aware socket

Systems and methods for facilitating communication between applications associated with virtual domains (VDOMs) of a virtualized network device and an external network are provided. According to one embodiment, a sub-interface is created for a physical Ethernet interface of the network device. A unique MAC address is assigned to the sub-interface. An application associated with a first VDOM is bound to the sub-interface. When the first VDOM is operating in transparent mode and an egress packet is received via the sub-interface by an internal switch running on the network device: (i) a forwarding database of the network device is caused to learn an association between a source MAC address of the egress packet and the sub-interface; and (ii) the egress packet is transmitted to the external network device via the physical Ethernet interface without replacing the source MAC address with the unique MAC address of the sub-interface.

Configuration of sub-interfaces to enable communication with external network devices

Systems and methods for synchronizing an EMACVLAN FDB among cluster units of an HA cluster are provided. According to one embodiment, real-time synchronization of a first FDB maintained within a kernel space of a first network security operating system running on a primary unit and a second FDB maintained within a kernel space of a second network security operating system running on a secondary unit is performed by: transferring information regarding an entry from the kernel space of the first network security operating system to a first synchronization unit running within a user space of the first network security operating system, and causing the second forwarding database to be updated by the first synchronization unit in response to receipt of the information regarding the entry, by transmitting the information regarding the entry to a second synchronization unit running within the user space of the second network security operating system.

Synchronizing a forwarding database within a high-availability cluster

Systems and methods for mitigating effects of source-Media Access Control (MAC) flooding attacks on a forwarding database (FDB) that maps MAC addresses to enhanced MAC Virtual Local Area Network (EMACVLAN) sub-interfaces of a physical Ethernet interface are provided. A Virtual Domain (VDOM) operating in transparent mode receives an ingress packet by an internal switch running on the virtualized network device via a sub-interface. When an entry, corresponding to a source MAC address of the ingress packet, does not exist in the FDB, an appropriate entry is created in the FDB and the entry is queued for confirmation at a tail of an ephemeral queue. When a total number of entries contained in the FDB reaches a predetermined threshold, an unconfirmed entry at a head of the queue is removed from the FDB. When the entry is confirmed, it is retained in the FDB and is unlinked from the queue.

Mitigating effects of flooding attacks on a forwarding database

Systems and methods for coordinating security operations among members of a cooperative security fabric (CSF) are provided. According to one embodiment, a first network security appliance of a CSF receives incoming network traffic and determines if the incoming network traffic is transmitted from a second network security appliance based on the source address of the network traffic. If the incoming network traffic is from the second network security appliance, the first network security appliance determines operations that are executed by the second network security appliance and then determines local operations. The first network security appliance executes local operations to the incoming network traffic.

Reducing redundant operations performed by members of a cooperative security fabric

Systems and methods for designating interfaces of a network security appliance as source/destination interfaces in connection with defining a security rule are provided. According to one embodiment, a security rule configuration interface is displayed through which a network administrator can specify parameters of security rules to be applied to traffic attempting to traverse the network security appliance. Information defining a traffic flow to be controlled by a security rule is received via the security rule configuration interface. The information defining the traffic flow includes: (i) a set of source interfaces; and (ii) a set of destination interfaces. At least one of which includes multiple interfaces such that the security rule permits the traffic flow to be defined in terms of multiple source interfaces and/or multiple destination interfaces.

Interface groups for rule-based network security

Systems and methods for connecting a network using one network protocol with a network using another network protocol are provided. According to an embodiment, a method is provided for performing network address translation. A data packet is received, by a protocol bridge connecting a first network, using a first protocol, and a second network, using a second protocol, via a first session of the first protocol from a first network appliance of the first network. The first protocol may be either Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6) and the second protocol is the other. The data packet is translated into the second protocol. The translation is performed in a kernel space of the protocol bridge. Finally, the data packet is transmitted via a second session of the second protocol to a second network appliance of the second network.

Network address translation

Methods and systems are provided for increasing application performance and accelerating data communications in a WAN environment. According to one embodiment, packets are received at a flow classification module operating at the Internet Protocol (IP) layer of a first wide area network (WAN) acceleration device via a private tunnel, which is operable to convey application layer data for connection-oriented applications between WAN acceleration devices. Packets that are classified as being associated with an existing connection-oriented flow are passed to a WAN socket operating at the transport layer. Based on the application protocol, the packets are passed to an application handler of multiple application handlers operating at the application layer each of which implements one or more application acceleration techniques for a particular application layer protocol known to behave poorly within a WAN environment. The existing connection-oriented flow is securely accelerated by performing one or more application acceleration techniques and applying one or more security functions.

A network controller device, systems, and methods thereof are described herein for enabling a mechanism of assigning network policies to one or more users based on their respective client reputation (CR) scores. CR scores indicate a measure of the level and kind of network activity that an internal resource does with external resources. Based on the evaluation of the CR score for a given user, system of the present invention can be configured to implement an appropriate policy on the user that controls the manner in which the user interacts within and outside the network. Proposed system includes multiple virtual local area networks (VLANs), wherein each VLAN is configured with a defined policy such that once the CR score for a given user has been evaluated, the user can be put on an appropriate VLAN based on the evaluation and the intended policy that the system wants the user to follow.

Network policy assignment based on user reputation score

Systems and methods for designating a proper subset of interfaces of a network security appliance as source/destination interfaces in connection with defining a security rule pertaining to a traffic flow are provided. According to one embodiment, a security rule configuration interface is provided through which a network administrator can specify parameters of security rules to be applied to traffic attempting to traverse the network security appliance. Interface information, defining a traffic flow to be controlled by a security rule, is received via the configuration interface. The interface information specifies multiple interfaces, representing a proper subset of the interfaces of the network security appliance, as source/destination interfaces of the traffic flow. Information regarding an action to be performed on the traffic when the security rule is matched is received via the configuration interface. The security rule is stored as part of a rule set to be applied to the traffic.

Methods and systems are provided for increasing application performance and accelerating data communications in a WAN environment. According to one embodiment, packets are received at a flow classification module operating at the Internet Protocol (IP) layer of a first wide area network (WAN) acceleration device via a shared connection-oriented tunnel, which is operable to convey application layer data for connection-oriented applications between WAN acceleration devices. Packets that are classified as being associated with an existing connection-oriented flow are passed to a WAN socket operating at the transport layer. Based on the application protocol, the packets are passed to an application handler of multiple application handlers operating at the application layer each of which implements one or more application acceleration techniques for a particular poorly behaved WAN protocol. The existing connection-oriented flow is securely accelerated by performing one or more application acceleration techniques and applying one or more security functions.

Growing community of inventors

Burnaby, Canada

Yixin Pan