Integrated firewall, IPS, and virus scanner system and method
View Patent ↗A system, method and computer program product are provided including a router and a security sub-system coupled to the router. Such security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), and a plurality of virtual virus scanners. Further, each of the virtual firewalls, IPSs, and virus scanners is assigned to at least one of a plurality of user and is configured in a user-specific.
1. A security system, comprising:
a pair of parallel security systems that each include a router, wherein each router includes a security sub-system, wherein the security sub-system includes one or more of a virtual firewall, a virtual intrusion prevention system (IPS), an anti-spam module, and a virtual virus scanner; and
a set of redundant switches coupled to the pair of parallel security systems, wherein the set of redundant switches can exchange state information including an active status or a standby status per port, and wherein a respective status of each security sub-system for a port is renegotiated if the exchange state information indicates that both the security sub-systems are active for the port.
2. The system as recited in claim 1 , wherein at least one of the pair of parallel security systems further comprises:
an active interface for processing traffic received from a network; and
a standby interface.
3. The system as recited in claim 2 , wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein if at least one of the interfaces fail, traffic is routed to the standby security system.
4. The system as recited in claim 2 , wherein the active interface and the standby interface are active and process traffic in an asymmetric way.
5. The system as recited in claim 2 , wherein the active interface and the standby interface exchange state information to ensure existing active flows on a failed active interface may be processed on the standby interface.
6. The system as recited in claim 1 , wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein the active security system and the standby security system exchange state information to ensure existing active flows on a failed active security system may be processed on the standby security system.
7. The system as recited in claim 1 , wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein packets received by the standby security system are dropped.
8. A method, comprising:
assigning one or more of a virtual firewall, a virtual intrusion prevention system (IPS), an anti-spam module, and a virtual virus scanner in a security sub-system to at least one of a plurality of users, wherein a pair of parallel security systems includes routers, and each router includes the security sub-system; and
coupling a set of redundant switches to the pair of parallel security systems, wherein the set of redundant switches can exchange state information including an active status or a standby status per port, and wherein a respective status of each security sub-system for a port is renegotiated if the exchange state information indicates that both the security sub-systems are active for the port.
9. The method of claim 8 , wherein at least one of the pair of parallel security systems further comprises:
an active interface for processing traffic received from a network; and
a standby interface.
10. The method of claim 9 , wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein if at least one of the interfaces fail, traffic is routed to the standby security system.
11. The method of claim 9 , wherein the active interface and the standby interface are active and process traffic in an asymmetric way.
12. The method of claim 9 , further comprising:
exchanging state information between the active interface and the standby interface to ensure existing active flows on a failed active interface may be processed on the standby interface.
13. The method of claim 8 , further comprising:
wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein the active security system and the standby security system exchange state information to ensure existing active flows on a failed active security system may be processed on the standby security system.
14. The method of claim 8 , wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein packets received by the standby security system are dropped.
15. Logic encoded in non-transitory media that includes code for execution and when executed by a processor operable to perform operations comprising:
assigning one or more of a virtual firewall, a virtual intrusion prevention system (IPS), an anti-spam module, and a virtual virus scanner in a security sub-system to at least one of a plurality of users, wherein a pair of parallel security systems includes virtual redundancy router protocol (VRRP) routers, and each VRRP router includes the security sub-system; and
coupling a set of redundant switches to the pair of parallel security systems, wherein the set of redundant switches can exchange state information including an active status or a standby status per port, and wherein a respective status of each security sub-system for a port is renegotiated if the exchange state information indicates that both the security sub-systems are active for the port.
16. The logic of claim 15 , wherein at least one of the pair of parallel security systems further comprises:
an active interface for processing traffic received from a network; and
a standby interface.
17. The logic of claim 16 , wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein if at least one of the interfaces fail, traffic is routed to the standby security system.
18. The logic of claim 16 , wherein the active interface and the standby interface are active and process traffic in an asymmetric way.
19. The logic of claim 16 , further comprising:
exchanging state information between the active interface and the standby interface to ensure existing active flows on a failed active interface may be processed on the standby interface.
20. The logic of claim 15 , wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein the active security system and the standby security system exchange state information to ensure existing active flows on a failed active security system may be processed on the standby security system.