Conditional high availability peering in an all-active next generation firewall (NGFW) cluster

1 . A computer-implemented method in a next generation firewall cluster (NGFW) device, on a data communication network, for conditional high availability peering in an all-active NGFW cluster, the method comprising:

establishing a conditional high availability peering among nodes in an all-active NGFW cluster, wherein each NFGW node advertises the availability of its peering Internet Protocol (IP) address via a dynamic routing protocol capable of conditional advertisement wherein all NGFW nodes capable of processing packet data at Layer 7 for unified threat management;

monitoring data paths via said dynamic routing protocol for network isolation failures;

detecting local failure in one of the monitored data paths;

temporarily suspending the high availability peering with all remote NGFWs by withdrawing a local peering IP address, responsive to the detected data path failure; and

responsive to detecting a cure of the failed data path via said dynamic routing protocol restoring the high availability peering to all remote NGFWs by resuming advertisement of the local peering IP address, wherein the high availability peering is reactivated all remote NGFWs.

2 . The method of claim 1 , wherein the dynamic routing protocol comprises Gateway Protocol (BGP).

3 . The method of claim 1 , further comprising logging a specific session that is new among a plurality of existing sessions in a unified session table with session ownership information of the specific session.

4 . The method of claim 3 , further comprising sharing the unified session table comprising the plurality of sessions across all NGFW nodes using the conditional high availability peering.

5 . The method of claim 1 , wherein the network isolation failure is caused by a direct interface failure, a remote interface failure, or an upstream routing issue affecting the data path.

6 . The method of claim 1 , wherein processing packet data at Layer 7 for unified threat management comprises processing the packet data for intrusion prevention, web filtering, or antivirus and antimalware.

7 . The method of claim 1 , further comprising bouncing a session to an original session owner node in the all-active NGFW cluster for correct processing at Layer 7.

8 . The method of claim 1 , wherein temporarily suspending the high availability peering prevents dropping traffic due to failing a reverse path forwarding (RPF) check.

9 . The method of claim 1 , wherein withdrawing the local peering IP address comprises stopping the advertisement of the local peering IP address to the remote NGFWs.

10 . The method of claim 1 , wherein the conditional high availability peering prevents packet blackholing on the NGFW node experiencing the network isolation failure.

11 . The method of claim 1 , further comprising invoking asymmetrical traffic data paths responsive to the network isolation failure.

12 . The method of claim 11 , further comprising returning to symmetrical traffic data paths responsive to detecting the cure of the failed data path.

13 . The method of claim 1 , wherein the data communication network comprises a software-defined wide area network (SD-WAN).

14 . The method of claim 1 , wherein the nodes in the all-active NGFW cluster share network state information comprising session, network address translation (NAT), and tunnel states.

15 . The method of claim 1 , wherein temporarily suspending the high availability peering and restoring the high availability peering are executed by a link management module of the NGFW device.

16 . A non-transitory computer-readable medium storing source code in a next generation firewall cluster (NGFW) device, on a data communication network, that when executed by a processor, performs a method for conditional high availability peering in an all-active NGFW cluster, the method comprising:

establishing a conditional high availability peering among nodes in an all-active NGFW cluster, wherein each NFGW node advertises the availability of its peering Internet Protocol (IP) address via a dynamic routing protocol capable of conditional advertisement wherein all NGFW nodes capable of processing packet data at Layer 7 for unified threat management;

monitoring data paths via said dynamic routing protocol for network isolation failures;

detecting local failure in one of the monitored data paths;

temporarily suspending the high availability peering with all remote NGFWs by withdrawing a local peering IP address, responsive to the detected data path failure; and

responsive to detecting a cure of the failed data path via said dynamic routing protocol restoring the high availability peering to all remote NGFWs by resuming advertisement of the local peering IP address, wherein the high availability peering is reactivated all remote NGFWs.

17 . The method of claim 16 , wherein said dynamic routing protocol comprises Border Gateway Protocol (BGP).

18 . A next generation firewall cluster (NGFW) device, on a data communication network, for conditional high availability peering in an all-active NGFW cluster, the NGFW device comprising:

a processor;

a network interface communicatively coupled to the processor and to a data communication network; and

a memory, communicatively coupled to the processor and storing:

establishing a conditional high availability peering among nodes in an all-active NGFW cluster, wherein each NFGW node advertises the availability of its peering Internet Protocol (IP) address via a dynamic routing protocol capable of conditional advertisement wherein all NGFW nodes capable of processing packet data at Layer 7 for unified threat management;

monitoring data paths via said dynamic routing protocol for network isolation failures;

detecting local failure in one of the monitored data paths;

temporarily suspending the high availability peering with all remote NGFWs by withdrawing a local peering IP address, responsive to the detected data path failure; and

responsive to detecting a cure of the failed data path via said dynamic routing protocol (restoring the high availability peering to all remote NGFWs by resuming advertisement of the local peering IP address, wherein the high availability peering is reactivated all remote NGFWs.

19 . The NGFW device of claim 18 , wherein said dynamic routing protocol comprises Border Gateway Protocol (BGP).