Establishing a split-terminated communication connection through a stateful firewall, with network transparency
View Patent ↗A method and apparatus are provided for establishing a split-terminated client-server communication connection through a stateful firewall, with network transparency. In an environment in which a pair of network intermediaries is employed to optimize client-server communications, a first intermediary intercepts a client request for a new connection. The first intermediary probes the network for a counterpart near the server, and opens an optimized communication session with a second intermediary that responds affirmatively. Some or all client-server communications that transit the intermediaries' session are accelerated or otherwise optimized. The first intermediary's probe uses the client's source address, but a different port number, while the optimized intermediary session is opened using the client's source address and source port. Therefore, a network monitoring tool can monitor the end-to-end connection, and the stateful firewall will not reject the optimized session.
1. A method of establishing a network transparent communication connection between a client and a server through a stateful firewall and a pair of network intermediaries configured to optimize communications between the client and the server, the method comprising:
receiving from the client a first request to initiate a connection with the server, wherein the first request comprises a source address and a first source port of the client;
storing the first request in a temporary storage device;
transmitting a probe toward the server, said probe comprising a second request to initiate a connection with the server; and
after receipt of a response to said probe, transmitting a third request to initiate a connection;
wherein the second request comprises:
the source address and a second source port different from the first source port; and
a first tag; and
wherein the third request comprises:
the source address and the first source port; and
a second tag different from the first tag.
2. The method of claim 1 , wherein said receiving, said storing, said transmitting a probe and said transmitting a third request are performed by a first network intermediary in the pair of network intermediaries.
3. The method of claim 2 , further comprising, at a second network intermediary in the pair of network intermediaries:
intercepting the probe;
recognizing the first tag as signifying a test to determine whether the second intermediary is active; and
responding to the probe to indicate that the second intermediary is active.
4. The method of claim 3 , wherein the response to the probe comprises the first tag.
5. The method of claim 3 , further comprising at the second network intermediary:
intercepting the third request;
recognizing the second tag as signifying a request for an optimized communication session; and
responding to the third request to establish the optimized communication session between the first network intermediary and the second network intermediary.
6. The method of claim 5 , wherein:
the first request, the second request and the third request comprise TCP (Transport Control Protocol) SYN packets; and
the response to the probe and the response to the third request comprise SYN/ACK packets.
7. The method of claim 5 , wherein the network transparent connection between the client and the server comprises:
a first communication session between the client and the first network intermediary;
the optimized communication session between the first network intermediary and the second network intermediary; and
a second communication session between the second network intermediary and the server.
8. The method of claim 1 , wherein:
the first request to initiate a connection with the server comprises a first initial sequence number; and
the second request to initiate a connection with the server comprises a second initial sequence number out of range from the first initial sequence number.
9. The method of claim 8 , wherein the third request to initiate a connection with the server comprises a third initial sequence number out of range from the first initial sequence number.
10. A computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method of establishing a network transparent communication connection between a client and a server through a stateful firewall and a pair of network intermediaries configured to optimize communications between the client and the server, the method comprising:
receiving from the client a first request to initiate a connection with the server, wherein the first request comprises a source address and a first source port of the client;
storing the first request in a temporary storage device;
transmitting a probe toward the server, said probe comprising a second request to initiate a connection with the server; and
after receipt of a response to said probe, transmitting a third request to initiate a connection;
wherein the second request comprises:
the source address and a second source port different from the first source port; and
a first tag; and
wherein the third request comprises:
the source address and the first source port; and
a second tag different from the first tag.
11. In a network comprising:
a client;
a server;
a first network intermediary and a second network intermediary operating between the client and the server; and
a firewall operating between the first network intermediary and the second network intermediary;
a method of establishing a network-transparent connection between the client and the server, the method comprising:
receiving from a client, at the first network intermediary, a first request for a communication connection with the server, wherein:
a source address of the first request comprises a source address of the client; and
a source port of the first request comprises a source port of the client;
temporarily storing the first request;
transmitting from the first network intermediary toward the server a test request for a communication connection to determine whether the second network intermediary is active, wherein:
a source address of the test request comprises the source address of the client; and
a source port of the test request comprises a source port different from the source port of the client; and
if the second network intermediary is determined to be active, transmitting from the first network intermediary a request for an optimized connection, wherein:
a source address of the request for an optimized connection comprises the source address of the client; and
a source port of the request for an optimized connection comprises the source port of the client.
12. The method of claim 11 , wherein:
the test request is marked with a first tag that is recognizable to the second intermediary as indicating a test request, but is not recognizable to the server as indicating a test request; and
the request for an optimized connection is marked with a second tag that is recognizable to the second intermediary as indicating a request for an optimized connection, but is not recognizable to the server as indicating a request for an optimized connection.
13. The method of claim 12 , wherein the second network intermediary is determined to be active if the first network intermediary receives, in response to the test request, a return communication that includes the first tag.
14. The method of claim 11 , further comprising:
in response to the first request, establishing a first communication session between the client and the first network intermediary;
establishing the optimized communication session between the first network intermediary and the second network intermediary; and
establishing a second communication session between the second network intermediary and the server;
wherein the network-transparent connection between the client and the server comprises the first communication session, the second communication session and the optimized communication session.
15. The method of claim 11 , further comprising:
configuring the test request for a communication connection with an initial TCP (Transport Control Protocol) sequence number out of range from an initial TCP sequence number of the first request for a communication connection.
16. The method of claim 15 , further comprising:
configuring the request for an optimized connection with an initial TCP sequence number out of range from the initial TCP sequence number of the first request for a communication connection.
17. The method of claim 11 , wherein the source port of the test request is calculated by adding a fixed number to the client source port.
18. The method of claim 11 , wherein the test request comprises a TCP (Transport Control Protocol) SYN packet, the method further comprising:
terminating the test request connection according to the TCP protocol.