Maintaining IP tables
Data including a set of one or more resources and one or more associated IP addresses is updated based on monitored DNS responses. A request is received from a client device for a resource identified by an IP address. The IP address is matched to one of the IP addresses in the set of one or more IP addresses. A particular resource associated with the matched IP address is identified. A particular network policy that applies is identified. The identified particular network policy is applied to the received request.
1. A method performed by data processing apparatus, the method comprising: maintaining information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitoring domain name service (DNS) responses; generating, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; updating the maintained information based on the data received from the DNS; receiving a request from a client device on the network for a requested resource identified by a requested IP address; determining that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identifying a particular resource associated with the matched IP address; identifying a particular network policy applies; and applying the identified particular network policy to the received request; further comprising: receiving, from a DNS server, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; and updating the maintained information based on the data generated from the DNS responses, wherein the DNS responses are received from DNS servers outside of the network.
2. The method of claim 1 , wherein to apply the identified particular network policy to the received request, the data processing apparatus are configured to inspect communication between the client and a server serving the requested resource.
3. The method of claim 1 , wherein only requests that have an applied policy are inspected.
4. The method of claim 1 , wherein the DNS server is under the same administrative control as the network.
5. The method of claim 1 , wherein the data processing apparatus comprise a plurality of hardware devices, each hardware device including a separate processor and memory unit; wherein a first hardware device is configured to: route traffic to and from client devices on the network into and out of the network; and maintain information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitor DNS responses; generate, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; update the maintained information based on the data received from the DNS; receive a request from a client device on the network for a requested resource identified by a requested IP address; determine that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identify a particular resource associated with the matched IP address; identify a particular network policy; and wherein a second hardware device is configured to apply the identified particular network policy to the request.
6. The method of claim 1 , wherein the resource is identified in the information by the resource's Uniform Resource Locator (URL).
7. A system comprising: one or more processors configured to execute computer program instructions; and computer storage media encoded with computer program instructions that, when executed by one or more processors, cause data processing apparatus to perform operation comprising: maintaining information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitoring DNS responses; generating, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; updating the maintained information based on the data received from the DNS; receiving a request from a client device on the network for a requested resource identified by a requested IP address; determining that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identifying a particular resource associated with the matched IP address; identifying a particular network policy applies; and applying the identified particular network policy to the received request; further comprising: receiving, from a DNS server, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; and updating the maintained information based on the data generated from the DNS responses, wherein the DNS responses are received from DNS servers outside of the network.
8. The system of claim 7 , wherein to apply the identified particular network policy to the received request, the data processing apparatus are configured to inspect communication between the client and a server serving the requested resource.
9. The system of claim 7 , wherein only requests that have an applied policy are inspected.
10. The system of claim 7 , wherein the DNS server is under the same administrative control as the network.
11. The system of claim 7 , wherein the data processing apparatus comprise a plurality of hardware devices, each hardware device including a separate processor and memory unit; wherein a first hardware device is configured to: route traffic to and from client devices on the network into and out of the network; and maintain information including (i) a set of one or more resources to which a network policy applies, and (ii) a set of one or more Internet Protocol (IP) addresses, wherein each resource is associated with one or more of the IP addresses; monitor DNS responses; generate, from the monitored DNS responses, data identifying (i) a new resource, or (ii) one or more new IP addresses, or (iii) both a new resource and one or more new IP addresses, wherein each new IP address is associated with either a resource in the set of one or more resources, or the new resource; update the maintained information based on the data received from the DNS; receive a request from a client device on the network for a requested resource identified by a requested IP address; determine that the requested IP address matches one of the IP addresses in the set of one or more IP addresses; identify a particular resource associated with the matched IP address; identify a particular network policy; and wherein a second hardware device is configured to apply the identified particular network policy to the request.
12. The system of claim 7 , wherein the resource is identified in the information by the resource's Uniform Resource Locator (URL).