IP Library › Granted Patent US 7,401,355
Granted Patent B2
US 7,401,355 · App. 10/835,794 · Granted Jul 15, 2008

Firewall load balancing using a single physical device

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 7,401,355
App. No.
10/835,794
Granted
Jul 15, 2008
Kind
B2
Abstract

Methods and systems for load balancing a plurality of entities, such as firewalls, in a network environment are disclosed. In particular, the load balancing of firewalls on a bidirectional traffic path is performed using a single device that controls both incoming and outgoing traffic through the firewalls. The single device may include virtual routers for controlling the bidirectional traffic through the firewalls. A first virtual router may control incoming traffic to the firewalls and the other virtual router may control outgoing traffic to the firewalls. The virtual routers are logical partitions of the device layered on the physical resources of the device. The virtual routers share all or portions of the physical resources of the single device.

Claims (64)

1. An apparatus comprising:

a load balancer, wherein the load balancer load balances traffic in a network environment and includes:

a first virtual router for routing and load balancing the traffic to and from an untrusted network; and

a second virtual router for routing and load balancing the traffic to and from a trusted network;

wherein the first virtual router and the second virtual router are logical partitions of the load balancer and share physical resources of the load balancer, and wherein the first virtual router and the second virtual router operate independently of each other, such that data routed by the first virtual router is separate from data routed by the second virtual router.

2. The apparatus of claim 1 , wherein the load balancer load balances bi-directional traffic across a plurality of entities in the network environment.

3. The apparatus of claim 1 , wherein the load balancer includes a virtual switch, the virtual switch comprising the first virtual router and the second virtual router.

4. The apparatus of claim 1 comprising:

a plurality of firewalls in the network environment, wherein the load balancer includes switching capabilities for directing traffic to the plurality of firewalls;

wherein the first virtual router comprises:

a first virtual router for load balancing the plurality of firewalls for traffic from an untrusted network to the plurality of firewalls;

and wherein the second virtual router comprises:

a second virtual router for load balancing the plurality of firewalls for traffic from a trusted network to the plurality of firewalls.

5. The apparatus of claim 4 , wherein the first virtual router is implemented in a first virtual switch.

6. The apparatus of claim 5 , wherein the second virtual router is implemented in the first virtual switch.

7. The apparatus of claim 5 , wherein the second virtual router is implemented in a second virtual switch.

8. The apparatus of claim 1 wherein the first virtual router and the second virtual router operate independently of each other, such that the first virtual router and the second virtual router have separate routing tables, separate protocols, and separate network addresses.

9. A method comprising:

providing a single physical device for load balancing traffic in a network environment by:

providing a first virtual router within the single physical device, the first virtual router capable of routing and load balancing the traffic to and from an untrusted network; and

providing a second virtual router within the single physical device, the second virtual router capable of routing and load balancing the traffic to and from a trusted network;

wherein the first virtual router and the second virtual router are logical partitions of the single physical device and share physical resources of the single physical device, and wherein the first virtual router and the second virtual router operate independently of each other, such that data routed by the first virtual router is separate from data routed by the second virtual router; and

load balancing traffic in the network environment using the single physical device.

10. The method of claim 9 , wherein load balancing comprises:

load balancing bi-directional traffic across a plurality of entities in the network environment using the single physical device.

11. The method of claim 9 comprising:

providing a virtual switch within the single physical device, the virtual switch comprising the first virtual router and the second virtual router.

12. The method of claim 9 comprising:

providing a plurality of firewalls in the network environment, wherein the single physical device includes switching capabilities for directing traffic to the plurality of firewalls;

wherein providing a first virtual router comprises:

providing a first virtual router within the single physical device, the first virtual router capable of load balancing the plurality of firewalls for traffic from an untrusted network to the plurality of firewalls;

and wherein providing a second virtual router comprises:

providing a second virtual router within the single physical device, the second virtual router capable of load balancing the plurality of firewalls for traffic from a trusted network to the plurality of firewalls.

13. The method of claim 12 , wherein providing a first virtual router comprises:

providing a first virtual router within the single physical device, the first virtual router capable of load balancing the plurality of firewalls for traffic from an untrusted network to the plurality of firewalls, wherein the first virtual router is implemented in a first virtual switch.

14. The method of claim 13 , wherein providing a second virtual router comprises:

providing a second virtual router within the single physical device, the second virtual router capable of load balancing the plurality of firewalls for traffic from a trusted network to the plurality of firewalls, wherein the second virtual router is implemented in the first virtual switch.

15. The method of claim 13 , wherein providing a second virtual router comprises:

providing a second virtual router within the single physical device, the second virtual router capable of load balancing the plurality of firewalls for traffic from a trusted network to the plurality of firewalls, wherein the second virtual router is implemented in a second virtual switch.

16. The method of claim 9 wherein the first virtual router and the second virtual router operate independently of each other, such that the first virtual router and the second virtual router have separate routing tables, separate protocols, and separate network addresses.

17. A single physical device comprising:

a memory;

a processor;

wherein the memory includes instructions that when executed on the processor results in the single physical device load balancing traffic in a network environment by performing operations of:

providing a single physical device for load balancing traffic in a network environment by:

providing a first virtual router within the single physical device, the first virtual router capable of routing and load balancing the traffic to and from an untrusted network; and

providing a second virtual router within the single physical device, the second virtual router capable of routing and load balancing the traffic to and from a trusted network;

load balancing traffic in the network environment using the single physical device; and

wherein the first virtual router and the second virtual router are logical partitions of the single physical device and share physical resources of the single physical device, and wherein the first virtual router and the second virtual router operate independently of each other, such that data routed by the first virtual router is separate from data routed by the second virtual router.

18. The single physical device of claim 17 , wherein load balancing comprises:

load balancing bi-directional traffic across a plurality of entities in the network environment using the single physical device.

19. The single physical device of claim 17 providing a virtual switch within the single physical device, the virtual switch comprising the first virtual router and the second virtual router.

20. The single physical device of claim 17 providing a plurality of firewalls in the network environment, wherein the single physical device includes switching capabilities for directing traffic to the plurality of firewalls;

wherein computer program code for providing a first virtual router comprises:

providing a first virtual router within the single physical device, the first virtual router capable of load balancing the plurality of firewalls for traffic from an untrusted network to the plurality of firewalls;

and wherein computer program code for providing a second virtual router comprises:

providing a second virtual router within the single physical device, the second virtual router capable of load balancing the plurality of firewalls for traffic from a trusted network to the plurality of firewalls.

21. The single physical device of claim 20 wherein providing a first virtual router comprises:

providing a first virtual router within the single physical device, the first virtual router capable of load balancing the plurality of firewalls for traffic from an untrusted network to the plurality of firewalls, wherein the first virtual router is implemented in a first virtual switch.

22. The of single physical device of claim 21 wherein for providing a second virtual router comprises:

providing a second virtual router within the single physical device, the second virtual router capable of load balancing the plurality of firewalls for traffic from a trusted network to the plurality of firewalls, wherein the second virtual router is implemented in the first virtual switch.

23. The single physical device of claim 21 wherein providing the second virtual router comprises:

providing a second virtual router within the single physical device, the second virtual router capable of load balancing the plurality of firewalls for traffic from a trusted network to the plurality of firewalls, wherein the second virtual router is implemented in a second virtual switch.

24. The single physical device of claim 17 wherein the first virtual router and the second virtual router operate independently of each other, such that the first virtual router and the second virtual router have separate routing tables, separate protocols, and separate network addresses.

Assignments (2)
MERGER AND CHANGE OF NAME Recorded Dec 16, 2015
From: ORACLE USA, INC.; SUN MICROSYSTEMS, INC.; ORACLE AMERICA, INC.
To: ORACLE AMERICA, INC.
Reel/Frame 037303/0336 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Aug 19, 2004
From: SUPNIK, ROBERT M.; CAPLAN, DAVID S.; PHILLIPS, PAUL G.; BANATT, MICHAEL
To: SUN MICROSYSTEMS, INC.
Reel/Frame 015075/0055 →