Network security devices and methods
An OSI layer 2 network device on the edge of a network such as a SAN is configured to replace the original source address of traffic entering the network with a known identifier or address, which is used to signify that entry point as the traffic source to the other nodes of the network. Nodes of the network recognize the new source address as a valid source address. The network device also maintains state (e.g., association of original source address with new source address/identifier) so as to translate addresses to enable reply traffic to be sent back to the original sender.
1. A method of providing enhanced security to a network using a network entry device, comprising:
receiving a first data packet from a host device at a first port of the network entry device, said first data packet having a source address field including a first layer 2 source address identifying the host device, a destination address field including a destination address identifying a destination device on the network, and a payload field including data;
replacing the first layer 2 source address with a private address identifying the first port on the network device so as to produce a first modified data packet; and
sending the first modified data packet to the destination device over the network, wherein nodes on the network recognize the private address as a valid address.
2. The method of claim 1 , wherein the network is a Fibre Channel network.
3. The method of claim 1 , wherein the network is a storage area network.
4. The method of claim 1 , wherein the network entry device is a controller card.
5. The method of claim 4 , wherein the controller card is implemented in an edge switch.
6. The method of claim 1 , wherein the host has a dedicated connection to the first port of the network entry device.
7. The method of claim 1 , further including:
creating an entry in an address table in the network entry device, said entry including the private address and the first layer 2 source address.
8. The method of claim 7 , further including, for subsequent packets received from the first host at the first port:
performing a lookup in the address table using the first layer 2 source address identifying the first host to obtain the corresponding private address; and
replacing the first layer 2 source address with said corresponding private address.
9. The method of claim 1 , further comprising:
receiving a reply data packet from the destination device, the reply data packet having said private address in a destination address field;
replacing the private address in the destination address field of the reply packet with said first layer 2 source address identifying the host so as to produce a modified reply packet; and
sending the modified reply packet to the host device.
10. A network device that provides enhanced security to a network, the device comprising:
a first network entry port for receiving data packets from a host device external to the network, wherein a first data packet is received from the host, said first data packet having a source address field including a first layer 2 source address identifying the host device, a destination address field including a destination address identifying a destination device on the network, and a payload field including data;
an address replacement module configured to replace layer 2 source addresses with private addresses, wherein the first layer 2 source address of the first data packet is replaced with a first private address identifying the first network entry port on the network device so as to produce a first modified data packet; and
a network port coupled to the network,
wherein the first modified data packet is sent from the network port to the destination device over the network, and wherein nodes on the network recognize the first private address as a valid address.
11. The device of claim 10 , wherein the network is a Fibre Channel network.
12. The device of claim 10 , wherein the network is a storage area network.
13. The device of claim 10 , wherein the device is implemented in a controller card on the edge of the network.
14. The device of claim 10 , further including a memory for storing an address table, wherein the address replacement module creates an entry in the address table, said entry including the first private address and the first layer 2 source address.
15. The device of claim 14 , wherein for subsequent packets received from the first host at the first network entry port, the address replacement module performs a lookup in the address table using the first layer 2 source address identifying the first host to obtain the corresponding private address, and replaces the first layer 2 source address with said corresponding private address.
16. The device of claim 10 , wherein the device receives a reply data packet from the destination device via the network port, the reply data packet having said private address in a destination address field, wherein the address replacement module is configured to replace the private address in the destination address field of the reply packet with said first layer 2 source address identifying the host so as to produce a modified reply packet, and wherein the modified reply packet is sent to the host device via the first network entry port.
17. The device of claim 10 , further including an encapsulation/decapsulation module, coupled to the address replacement module, configured to encapsulate modified data packets and decapsulate encapsulated modified reply packets.
18. A network device that provides enhanced security to a network, the device comprising:
one or more network entry ports for receiving data packets from one or more host devices external to the network, wherein a first data packet is received from a first host, said first data packet having a source address field including a first layer 2 source address identifying the first host device, a destination address field including a destination address identifying a destination device on the network, and a payload field including data;
an address replacement module configured to generate private addresses identifying network entry ports on the network device and to replace layer 2 source addresses with the private addresses, wherein the first layer 2 source address of the first data packet is replaced with a first private address identifying the first network entry port on the network device so as to produce a first modified data packet; and
a network port coupled to the network,
wherein the first modified data packet is sent from the network port to the destination device over the network, and wherein nodes on the network recognize the first private address as a valid address.
19. The device of claim 18 , further including a memory for storing an address table, wherein the address replacement module creates an entry in the address table, said entry including the first private address and the first layer 2 source address.
20. The device of claim 19 , wherein for subsequent packets received from the first host at the first network entry port, the address replacement module performs a lookup in the address table using the first layer 2 source address identifying the first host to obtain the corresponding private address, and replaces the first layer 2 source address with said corresponding private address.