Maintaining IP tables
Data including a set of one or more resources and one or more associated IP addresses is updated based on monitored DNS responses. A request is received from a client device for a resource identified by an IP address. The IP address is matched to one of the IP addresses in the set of one or more IP addresses. A particular resource associated with the matched IP address is identified. A particular network policy that applies is identified. The identified particular network policy is applied to the received request.
1. A method performed by data processing apparatus, the method comprising: maintaining information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitoring domain name service (DNS) responses; generating, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; updating the maintained information based on the data received from the DNS; receiving a request from a client device on the network for a requested resource identified by a requested IP address; determining that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identifying a particular resource associated with the matched IP address; identifying a particular network policy applies; and applying the identified particular network policy to the received request, wherein the data processing apparatus comprise a plurality of hardware devices, each hardware device including a separate processor and memory unit; wherein a first hardware device is configured to: route traffic to and from client devices on the network into and out of the network; and maintain information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitor DNS responses; generate, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; update the maintained information based on the data received from the DNS; receive a request from a client device on the network for a requested resource identified by a requested IP address; determine that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identify a particular resource associated with the matched IP address; identify a particular network policy; and wherein a second hardware device is configured to apply the identified particular network policy to the request.
2. The method of claim 1 , wherein to apply the identified particular network policy to the request, the data processing apparatus are configured to inspect communication between the client and a server serving the requested resource.
3. The method of claim 1 , wherein only requests that have an applied policy are inspected.
4. The method of claim 1 , wherein the DNS server is hosted on the network.
5. The method of claim 1 , wherein the DNS server is under the same administrative control as the network.
6. The method of claim 1 , the method further comprising: receiving, from a DNS server, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; and updating the maintained information based on the data generated from the DNS responses.
7. The method of claim 6 , wherein the DNS responses are received from DNS servers outside of the network.
8. The method of claim 1 , wherein the resource is identified in the information by the resource's Uniform Resource Locator (URL).
9. A system comprising: one or more processors configured to execute computer program instructions; and computer storage media encoded with computer program instructions that, when executed by one or more processors, cause data processing apparatus to perform operation comprising: maintaining information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitoring DNS responses; generating, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; updating the maintained information based on the data received from the DNS; receiving a request from a client device on the network for a requested resource identified by a requested IP address; determining that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identifying a particular resource associated with the matched IP address; identifying a particular network policy applies; and applying the identified particular network policy to the received request, wherein the data processing apparatus comprise a plurality of hardware devices, each hardware device including a separate processor and memory unit; wherein a first hardware device is configured to: route traffic to and from client devices on the network into and out of the network; and maintain information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitor DNS responses; generate, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; update the maintained information based on the data received from the DNS; receive a request from a client device on the network for a requested resource identified by a requested IP address; determine that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identify a particular resource associated with the matched IP address; identify a particular network policy; and wherein a second hardware device is configured to apply the identified particular network policy to the request.
10. The system of claim 9 , wherein to apply the identified particular network policy to the request, the data processing apparatus are configured to inspect communication between the client and a server serving the requested resource.
11. The system of claim 9 , wherein only requests that have an applied policy are inspected.
12. The system of claim 9 , wherein the DNS server is hosted on the network.
13. The system of claim 9 , wherein the DNS server is under the same administrative control as the network.
14. The system of claim 9 , the operations further comprising: receiving, from a DNS server, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; and updating the maintained information based on the data generated from the DNS responses.
15. The system of claim 14 , wherein the DNS responses are received from DNS servers outside of the network.
16. The system of claim 9 , wherein the resource is identified in the information by the resource's Uniform Resource Locator (URL).