Networking and security split architecture
Techniques for providing a networking and security split architecture are disclosed. In some embodiments, a system, process, and/or computer program product for providing a networking and security split architecture includes receiving a flow at a security service; processing the flow at a network layer of the security service to perform one or more networking functions; and offloading the flow to a security layer of the security service to perform security enforcement based on a policy.
1 . A system comprising:
a processor configured to:
receive a plurality of flows at a security service;
process the plurality of flows at a network layer of the security service to perform one or more networking functions, wherein the processing of the plurality of flows at the network layer of the security service comprises to:
determine that a flow of the plurality of flows matches a policy-based forwarding rule; and
in response to a determination that the flow of the plurality of flows matches the policy-based forwarding rule:
determine that the policy-based forwarding rule does not match server to client (s2c) traffic; and
in response to a determination that the policy-based forwarding rule does not match the s2c traffic:
determine that a plurality of active next hops are defined; and
in response to a determination that the plurality of active next hops are defined:
select an active next hop of the plurality of active next hops; and
forward the flow to the selected active next hop;
load balance the plurality of flows for offloading to a security layer of the security service; and
perform security enforcement on an offloaded flow of the offloaded plurality of flows to the security layer of the security service based on a policy; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system recited in claim 1 , wherein the offloaded flow is determined to be a new flow at the security service, and wherein meta information is extracted from each flow of the plurality of flows during processing of the plurality of flows at the network layer of the security service, and wherein the meta information includes an application identification associated with each flow.
3 . The system recited in claim 1 , wherein the processing of the plurality of flows at the network layer includes performing IPSEC termination.
4 . The system recited in claim 1 , wherein the processing of the plurality of flows at the network layer includes performing routing.
5 . The system recited in claim 1 , wherein the processing of the plurality of flows at the network layer includes performing network address translation (NAT).
6 . The system recited in claim 1 , wherein the processing of the plurality of flows at the network layer includes using deep packet inspection.
7 . The system recited in claim 1 , wherein the security layer includes a plurality of security instances.
8 . The system recited in claim 1 , wherein the security layer includes a security instance of a firewall.
9 . The system recited in claim 1 , wherein the security layer includes a plurality of security instances for distinct micro services of security functions including one or more of the following: antivirus, antispam, DNS security, intrusion detection/prevention security (IDS/IPS), and data exfiltration security.
10 . The system recited in claim 1 , wherein the network layer includes a network router.
11 . The system recited in claim 1 , wherein the network layer includes a virtual private network (VPN) gateway.
12 . The system recited in claim 1 , wherein the network layer includes a load balancer.
13 . The system recited in claim 1 , wherein the network layer includes a load balancer, and wherein the load balancer sends a first session of the flow to a first security instance of the security layer and sends a child of the first session of the flow to the first security instance of the security layer.
14 . The system recited in claim 1 , wherein the network layer includes a network anchor instance.
15 . The system recited in claim 1 , wherein the security service is a cloud-based security service.
16 . The system recited in claim 1 , wherein the security service is a cloud-based security service that is provided using a public cloud service provider.
17 . The system recited in claim 1 , wherein the security service is a cloud-based security service that is provided using a plurality of public cloud service providers.
18 . The system recited in claim 1 , wherein the processor is further configured to:
close the plurality of flows; and
receive session statistics associated with each flow of the plurality of flows from the security layer.
19 . A method, comprising:
receiving, using a processor, a plurality of flows at a security service;
processing, using the processor, the plurality of flows at a network layer of the security service to perform one or more networking functions, wherein the processing of the plurality of flows at the network layer of the security service comprises:
determining that a flow of the plurality of flows matches a policy-based forwarding rule; and
in response to a determination that the flow of the plurality of flows matches the policy-based forwarding rule:
determining that the policy-based forwarding rule does not match server to client (s2c) traffic; and
in response to a determination that the policy-based forwarding rule does not match the s2c traffic:
determining that a plurality of active next hops are defined; and
in response to a determination that the plurality of active next hops are defined:
selecting an active next hop of the plurality of active next hops; and
forwarding the flow to the selected active next hop;
load balancing, using the processor, the plurality of flows for offloading to a security layer of the security service; and
performing, using the processor, security enforcement on an offloaded flow of the offloaded plurality of flows to the security layer of the security service based on a policy.
20 . A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a plurality of flows at a security service;
processing the plurality of flows at a network layer of the security service to perform one or more networking functions, wherein the processing of the plurality of flows at the network layer of the security service comprises:
determining that a flow of the plurality of flows matches a policy-based forwarding rule; and
in response to a determination that the flow of the plurality of flows matches the policy-based forwarding rule:
determining that the policy-based forwarding rule does not match server to client (s2c) traffic; and
in response to a determination that the policy-based forwarding rule does not match the s2c traffic:
determining that a plurality of active next hops are defined; and
in response to a determination that the plurality of active next hops are defined:
selecting an active next hop of the plurality of active next hops; and
forwarding the flow to the selected active next hop;
load balancing the plurality of flows for offloading to a security layer of the security service; and
performing security enforcement on an offloaded flow of the offloaded plurality of flows to the security layer of the security service based on a policy.