Maintaining IP tables
Data including a set of one or more resources and one or more associated IP addresses is updated based on data from a DNS server. A request is received from a client device for a resource identified by an IP address. The IP address is matched to one of the IP addresses in the set of one or more IP addresses. A particular resource associated with the matched IP address is identified. A particular network policy that applies is identified. The identified particular network policy is applied to the received request.
1. A method performed by data processing apparatus, the method comprising:
maintaining (i) first data that identifies a set of one or more resources to which a policy of a network applies, and (ii) second data that identifies a set of one or more stored Internet Protocol (IP) addresses, and (iii) third data that associates each resource in the set with one or more IP addresses in the set of IP addresses;
registering, with a domain name system (DNS) server;
maintaining, by the DNS server, one or more IP addresses for each of the resources of the first data;
identifying, by the DNS server, a change to one or more of the IP addresses for one or more of the resources of the first data;
sending, by the DNS server, a message that is formatted according to a standard other than the DNS standard and comprising (i) fourth data that identifies two or more of the resources to which a policy of a network applies, (ii) fifth data that identifies one or more new IP addresses, and (iii) sixth data that associates each of the two or more resources in the fourth data with one or more of the new IP addresses;
receiving, from the DNS server, the message;
updating the second data, based on the fifth data, to include the one or more new IP addresses in the set of one or more IP addresses;
updating the third data, based on the sixth data, to update the associations between the set of resources and the set of IP addresses;
intercepting a request from a client device on the network for a requested resource identified by a requested IP address;
determining that the requested IP address matches one of the IP addresses in the set of IP addresses;
identifying a particular resource in the set of resources that is associated with the requested IP address;
identifying a particular policy of the network that applies to the particular resource; and
applying the particular policy to the request.
2. The method of claim 1 , wherein to apply the particular policy to the request, the data processing apparatus are configured to inspect communication between the client and a server serving the requested resource.
3. The method of claim 1 , wherein only request that have an applied policy are inspected.
4. The method of claim 1 , wherein the DNS server is hosted on the network.
5. The method of claim 1 , wherein the DNS server is under the same administrative control as the network.
6. The method of claim 1 , the method further comprising:
monitoring DNS responses;
generating, from the monitored DNS responses, (i) seventh data that identifies a second new resource, and (ii) eighth data that identifies one or more second new IP addresses, and (iii) ninth data that associates the second new resource with one or more second new IP addresses;
updating the first data, based on the seventh data, to include the second new resource in the set of one or more resources;
updating the second data, based on the eighth data, to include the one or more second new IP addresses in the set of one or more IP addresses; and
updating the third data, based on the ninth data, to update the associations between the set of resources and the set of IP addresses.
7. The method of claim 6 , wherein the DNS responses are received from DNS servers outside of the network.
8. The method of claim 1 , wherein the data processing apparatus comprise a plurality of hardware devices, each hardware device including a separate processor and memory unit;
wherein a first hardware device is configured to:
route traffic to and from client devices on the network into and out of the network;
maintain (i) first data that identifies a set of one or more resources to which a policy of a network applies, and (ii) second data that identifies a set of one or more stored Internet Protocol (IP) addresses, and (iii) third data that associates each resource in the set with one or more IP addresses in the set of IP addresses;
receive, from the DNS server, (i) fourth data that identifies a new resource, (ii) fifth data that identifies one or more new IP addresses, and (iii) sixth data that associates the new resource with one or more new IP addresses;
update the first data, based on the fourth data, to include the new resource in the set of one or more resources;
update the second data, based on the fifth data, to include the one or more new IP addresses in the set of one or more IP addresses;
update the third data, based on the sixth data, to update the associations between the set of resources and the set of IP addresses;
intercept a request from a client device on the network for a requested resource identified by a requested IP address;
determine that the requested IP address matches one of the IP addresses in the set of IP addresses;
identify a particular resource in the set of resources that is associated with the requested IP address;
identify a particular policy of the network that applies to the particular resource; and
wherein a second hardware device is configured to apply the particular policy to the request.
9. The method of claim 1 , wherein the resource is identified in the first data by the resource's Uniform Resource Locator (URL).
10. The method of claim 1 , wherein the DNS server transmits the message after interacting with one of the resources of the first data.
11. The method of claim 1 , wherein the message is formatted according to a custom standard.
12. The method of claim 1 , wherein the message is sent by the DNS server in response to passage of a time interval.
13. The method of claim 1 , wherein the message is sent by the DNS server in response to a request from a network gateway.
14. A method performed by data processing apparatus, the method comprising:
maintaining information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses;
registering, with a domain name system (DNS) server, the set of one or more resources;
maintaining, by the DNS server, one or more IP addresses for each of the resources;
identifying, by the DNS server, a change to one or more of IP addresses for one or more of the resources of the first data;
sending, by the DNS server, a message that is formatted according to a standard other than the DNS standard and comprising (i) two or more of the one or more resources of the set of resources, or (ii) two or more new IP addresses, or (iii) both two or more of the resources of the set of resources and one or more new IP addresses, wherein each new IP address is associated with one of the one or more resources in the set of one or more resources;
receiving, from the DNS server, the message;
updating the maintained information based on the message;
receiving a request from a client device on the network for a requested resource identified by a requested IP address;
determining that the requested IP address matches one of the IP addresses in the set of one or more IP addresses;
identifying a particular resource associated with the matched IP address;
identifying a particular network policy applies; and
applying the identified particular network policy to the received request.
15. The method of claim 14 , wherein to apply the particular policy to the request, the data processing apparatus are configured to inspect communication between the client and a server serving the requested resource.
16. The method of claim 14 , wherein only request that have an applied policy are inspected.
17. The method of claim 14 , wherein the DNS server is hosted on the network.
18. The method of claim 14 , wherein the DNS server is under the same administrative control as the network.
19. The method of claim 14 , the method further comprising:
monitoring DNS responses;
generating, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource;
updating the maintained information based on the data generated from the DNS responses.
20. The method of claim 19 , wherein the DNS responses are received from DNS servers outside of the network.
21. The method of claim 14 , wherein the data processing apparatus comprise a plurality of hardware devices, each hardware device including a separate processor and memory unit;
wherein a first hardware device is configured to:
route traffic to and from client devices on the network into and out of the network; and
maintain information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses;
receive, from the DNS server, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource;
update the maintained information based on the data received from the DNS;
receive a request from a client device on the network for a requested resource identified by a requested IP address;
determine that the requested IP address matches one of the IP addresses in the set of one or more IP addresses;
identify a particular resource associated with the matched IP address; and
identify a particular network policy; and
wherein a second hardware device is configured to apply the particular policy to the request.
22. The method of claim 14 , wherein the resource is identified in the information by the resource's Uniform Resource Locator (URL).
23. The method of claim 14 , wherein the DNS server transmits the message after interacting with one of the resources of the set of one or more resources.
24. The method of claim 14 , wherein the message is formatted according to a custom standard.
25. The method of claim 14 , wherein the message is sent by the DNS server in response to passage of a time interval.
26. The method of claim 14 , wherein the message is sent by the DNS server in response to a request from a network gateway.
27. A system comprising:
one or more processors configured to execute computer program instructions; and
computer storage media encoded with computer program instructions that, when executed by one or more processors, cause data processing apparatus to perform operation comprising:
maintaining (i) first data that identifies a set of one or more resources to which a policy of a network applies, and (ii) second data that identifies a set of one or more stored Internet Protocol (IP) addresses, and (iii) third data that associates each resource in the set with one or more IP addresses in the set of IP addresses;
registering, with a domain name system (DNS) server, the first data;
maintaining, by the DNS server, one or more IP addresses for each of the resources of the first data;
identifying, by the DNS server, a change to one or more of the IP addresses for one or more of the resources of the first data;
sending, by the DNS server, a message that is formatted according to a standard other than the DNS standard and comprising (i) fourth data that identifies two or more of the resources to which a policy of a network applies, (ii) fifth data that identifies one or more new IP addresses, and (iii) sixth data that associates each of the two or more resources in the fourth data with one or more of the new IP addresses;
receiving, from the DNS server, the message;
updating the second data, based on the fifth data, to include the one or more new IP addresses in the set of one or more IP addresses;
updating the third data, based on the sixth data, to update the associations between the set of resources and the set of IP addresses;
intercepting a request from a client device on the network for a requested resource identified by a requested IP address;
determining that the requested IP address matches one of the IP addresses in the set of IP addresses;
identifying a particular resource in the set of resources that is associated with the requested IP address;
identifying a particular policy of the network that applies to the particular resource; and
applying the particular policy to the request.
28. The system of claim 27 , wherein applying the particular policy to the request comprises inspecting communication between the client and a server serving the requested resource.
29. The system of claim 27 , wherein only request that have an applied policy are inspected.
30. The system of claim 27 , wherein the DNS server is hosted on the network.
31. The system of claim 27 , wherein the DNS server is under the same administrative control as the network.
32. The system of claim 27 , the operations further comprise:
monitoring DNS responses;
generating, from the monitored DNS responses, (i) seventh data that identifies a second new resource, and (ii) eighth data that identifies one or more second new IP addresses, and (iii) ninth data that associates the second new resource with one or more second new IP addresses;
updating the first data, based on the seventh data, to include the second new resource in the set of one or more resources;
updating the second data, based on the eighth data, to include the one or more second new IP addresses in the set of one or more IP addresses; and
updating the third data, based on the ninth data, to update the associations between the set of resources and the set of IP addresses.
33. The system of claim 32 , wherein the DNS responses are received from DNS servers outside of the network.
34. The system of claim 27 , wherein the data processing apparatus comprise a plurality of hardware devices, each hardware device including a separate processor and memory unit;
wherein a first hardware device is configured to:
route traffic to and from client devices on the network into and out of the network;
maintain (i) first data that identifies a set of one or more resources to which a policy of a network applies, and (ii) second data that identifies a set of one or more stored Internet Protocol (IP) addresses, and (iii) third data that associates each resource in the set with one or more IP addresses in the set of IP addresses;
receive, from the DNS server, (i) fourth data that identifies a new resource, (ii) fifth data that identifies one or more new IP addresses, and (iii) sixth data that associates the new resource with one or more new IP addresses;
update the first data, based on the fourth data, to include the new resource in the set of one or more resources;
update the second data, based on the fifth data, to include the one or more new IP addresses in the set of one or more IP addresses;
update the third data, based on the sixth data, to update the associations between the set of resources and the set of IP addresses;
intercept a request from a client device on the network for a requested resource identified by a requested IP address;
determine that the requested IP address matches one of the IP addresses in the set of IP addresses;
identify a particular resource in the set of resources that is associated with the requested IP address;
identify a particular policy of the network that applies to the particular resource; and
wherein a second hardware device is configured to apply the particular policy to the request.
35. The system of claim 27 , wherein the resource is identified in the first data by the resource's Uniform Resource Locator (URL).
36. The system of claim 27 , wherein the DNS server transmits the message after interacting with one of the resources of the first data.
37. The system of claim 27 , wherein the message is formatted according to a custom standard.
38. The system of claim 27 , wherein the message is sent by the DNS server in response to passage of a time interval.
39. The system of claim 27 , wherein the message is sent by the DNS server in response to a request from a network gateway.