Firewall access control with border gateway protocol attributes
Packets are routed from at least one internet protocol (IP) address in accordance with border gateway protocol (BGP); while carrying out the routing in accordance with the border gateway protocol (BGP), at least one border gateway protocol (BGP) attribute associated with the at least one internet protocol (IP) address is noted. A firewall policy is applied to the packets from the at least one internet protocol (IP) address based on the at least one border gateway protocol (BGP) attribute associated with the at least one internet protocol (IP) address. Techniques may be implemented, for example, on a router or on a separate firewall device coupled to a router.
1. A method comprising the steps of:
determining whether packets can be routed from at least one internet protocol (IP) address in accordance with border gateway protocol (BGP) or a tuple policy;
routing said packets from said at least one internet protocol (IP) address in accordance with said border gateway protocol (BGP) upon determining that said packets can be routed from said at least one internet protocol (IP) address in accordance with said border gateway protocol (BGP), bypassing determining compliance of said packets with said tuple policy;
while carrying out said routing in accordance with said border gateway protocol (BGP), noting at least one border gateway protocol (BGP) attribute associated with said at least one internet protocol (IP) address; and
applying a firewall policy to said packets from said at least one internet protocol (IP) address based on said at least one border gateway protocol (BGP) attribute associated with said at least one internet protocol (IP) address.
2. The method of claim 1 , wherein said at least one border gateway protocol (BGP) attribute comprises a community attribute and wherein said applying step comprises applying said firewall policy to said packets from said at least one internet protocol (IP) address based on said community attribute, and wherein said community attribute corresponds to a characteristic of at least one subscriber and is distinct from an IP address of the subscriber.
3. The method of claim 2 , wherein said applying step comprises passing said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an appropriate source.
4. The method of claim 3 , wherein said appropriate source comprises at least one of a predetermined service provider and a predetermined content provider.
5. The method of claim 2 , wherein said applying step comprises dropping said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.
6. The method of claim 2 , wherein said applying step comprises subjecting said packets from said at least one internet protocol (IP) address to conventional firewall logic if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.
7. The method of claim 1 , further comprising;
locating a firewall device at a network location in proximity to a location where said routing in accordance with said border gateway protocol (BGP) is being carried out; and
providing at least one of program instructions and a policy file to said firewall device to cause said firewall device to carry out said step of applying said firewall policy.
8. The method of claim 1 , further comprising;
providing firewall functionality on a router where said routing in accordance with said border gateway protocol (BGP) is being carried out; and
providing at least one of program instructions and a policy file to cause said firewall functionality on said router to carry out said step of applying said firewall policy.
9. A combined firewall-router device for interposition between a network and at least one computing device to be protected, at a location in said network wherein border gateway protocol (BGP) routing is taking place, said firewall device comprising:
a persistent storage device storing a policy file in a non-transitory manner;
a memory; and
at least one processor, coupled to said memory, and operative, when said policy file is loaded into said memory, to:
determine whether packets can be routed from at least one internet protocol (IP) address in accordance with said border gateway protocol (BGP) or a tuple policy;
route said packets from said at least one internet protocol (IP) address in accordance with said border gateway protocol (BGP) upon determining that said packets can be routed from said at least one internet protocol (IP) address in accordance with said border gateway protocol (BGP), bypassing determining compliance of said packets with said tuple policy;
while carrying out said routing in accordance with said border gateway protocol (BGP), note at least one border gateway protocol (BGP) attribute associated with said at least one internet protocol (IP) address; and
apply a firewall policy to said packets from said at least one internet protocol (IP) address based on said at least one border gateway protocol (BGP) attribute associated with said at least one internet protocol (IP) address.
10. The combined firewall-router device of claim 9 , wherein said at least one border gateway protocol (BGP) attribute comprises a community attribute and wherein said at least one processor is operative to apply said firewall policy by applying said firewall policy to said packets from said at least one internet protocol (IP) address based on said community attribute, and wherein said community attribute corresponds to a characteristic of at least one subscriber and is distinct from an IP address of the subscriber.
11. The combined firewall-router device of claim 10 , wherein said at least one processor is operative to apply said firewall policy by passing said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an appropriate source.
12. The combined firewall-router device of claim 11 , wherein said appropriate source comprises at least one of a predetermined service provider and a predetermined content provider.
13. The combined firewall-router device of claim 10 , wherein said at least one processor is operative to apply said firewall policy by dropping said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.
14. The combined firewall-router device of claim 10 , wherein said at least one processor is operative to apply said firewall policy by subjecting said packets from said at least one internet protocol (IP) address to conventional firewall logic if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.
15. A firewall device for interposition between a network and at least one computing device to be protected, at a location in said network proximate to a router wherein border gateway protocol (BGP) routing is taking place to route packets from at least one internet protocol (IP) address in accordance with the border gateway protocol (BGP), said firewall device comprising:
a persistent storage device storing a policy file in a non-transitory manner;
a memory; and
at least one processor, coupled to said memory, and operative, when said policy file is loaded into said memory, to:
obtain, from the router, at least one border gateway protocol (BGP) attribute associated with the at least one internet protocol (IP) address; and
apply a firewall policy to said packets from said at least one internet protocol (IP) address based on said at least one border gateway protocol (BGP) attribute associated with said at least one internet protocol (IP) address,
wherein said at least one border gateway protocol (BGP) attribute comprises a community attribute and wherein said at least one processor is operative to apply said firewall policy by applying said firewall policy to said packets from said at least one internet protocol (IP) address based on said community attribute, and wherein said community attribute corresponds to a characteristic of at least one subscriber and is distinct from an IP address of the subscriber, and
wherein said at least one processor is operative to apply said firewall policy by subjecting said packets from said at least one internet protocol (IP) address to conventional firewall logic if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.
16. The firewall device of claim 15 , wherein said at least one processor is operative to apply said firewall policy by passing said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an appropriate source.
17. The firewall device of claim 16 , wherein said appropriate source comprises at least one of a predetermined service provider and a predetermined content provider.
18. The firewall device of claim 15 , wherein said at least one processor is operative to apply said firewall policy by dropping said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.
19. An apparatus comprising:
means for determining whether packets can be routed from at least one internet protocol (IP) address in accordance with border gateway protocol (BGP) or a tuple policy;
means for said routing packets from said at least one internet protocol (IP) address in accordance with border gateway protocol (BGP), bypassing determining compliance of said packets with said tuple policy;
means for, while carrying out said routing in accordance with said border gateway protocol (BGP), noting at least one border gateway protocol (BGP) attribute associated with said at least one internet protocol (IP) address; and
means for applying a firewall policy to said packets from said at least one internet protocol (IP) address based on said at least one border gateway protocol (BGP) attribute associated with said at least one internet protocol (IP) address.
20. The apparatus of claim 19 , wherein said at least one border gateway protocol (BGP) attribute comprises a community attribute and wherein said means for applying apply said firewall policy to said packets from said at least one internet protocol (IP) address based on said community attribute, and wherein said community attribute corresponds to a characteristic of at least one subscriber and is distinct from an IP address of the subscriber.
21. The apparatus of claim 20 , wherein said means for comprise means for passing said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an appropriate source.
22. The apparatus of claim 21 , wherein said appropriate source comprises at least one of a predetermined service provider and a predetermined content provider.
23. The apparatus of claim 20 , wherein said means for applying comprise means for dropping said packets from said at least one internet protocol (IP) address if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.
24. The apparatus of claim 20 , wherein said means for applying comprise means for subjecting said packets from said at least one internet protocol (IP) address to conventional firewall logic if said community attribute identifies a source of said packets, based on said community attribute, as an inappropriate source.