Dual mode firewall

1. A firewall, comprising:

a first port configured for communication with a first device within a first network;

a second port configured for communication with a second device within the first network;

a third port configured for communication between the first network and a second network; and

a processor configured to:

determine that a first portion of the incoming packets should be bridged, the first portion having a first source address and a first destination address within the first network, wherein the step of determining that the first portion should be bridged comprises performing a bridge lookup based upon media access control address information of the incoming packets;

apply a first screening process to the first portion;

determine that a second portion of the incoming packets should be routed, the second portion having a second source address or a second destination address outside the first network; and

apply a second screening process to the second portion.

2. The firewall of claim 1 , wherein the at least one processor is configured to control traffic between the first device and the second device according to a spanning tree protocol.

3. The firewall of claim 1 , wherein the at least one processor is configured to control traffic between the first device and the second device according to one or more fields in a layer 2 header of a packet.

4. The firewall of claim 1 , wherein the at least one processor is configured to perform an initial check on a packet, wherein the procedures of the initial check are selected from the group consisting of checking for broadcasting, multicasting and Internet protocol fragments.

5. The firewall of claim 1 , wherein the at least one processor is configured to apply the first screening process according to security policies implemented at one or more of layers 3 through 7 .

6. The firewall of claim 3 , wherein the at least one processor is configured to control traffic between the first device and the second device according to layer 2 access lists applied to one or more fields in the layer 2 header of the packet.

7. The firewall of claim 1 , wherein the at least one processor is configured to apply the second screening process according to security policies implemented at one or more of layers 3 through 7 .

8. The firewall of claim 1 , further comprising a control plane configured to build a bridge table.

9. The firewall of claim 8 , wherein the control plane is further configured to inspect one or more of DHCP, ARP or OSPF packets.

10. The firewall of claim 8 , wherein the control plane is further configured to builds a routing table.

11. The firewall of claim 1 , further comprising a data plane configured to enforce screening policies.

12. The firewall of claim 11 , wherein the data plane is further configured to determine whether to bridge or route packets.

13. The firewall of claim 12 , wherein the data plane is further configured to rewrite packet headers before transmitting packets.

14. A firewall, comprising:

means for receiving first packets and second packets at a first device;

means for determining, at the first device, that the first packets should be bridged, the first packets having a first source address and a first destination address within the first network, wherein the means determines that the first packets should be bridged by performing a bridge lookup based upon media access control address information of the first packets;

means for applying a first screening process to the first packets at the first device;

means for determining, at the first device, that the second packets should be routed; and

means for applying a second screening process to the second packets at the first device.

15. A method of implementing a firewall, comprising:

receiving first packets and second packets at a first device;

determining, at the first device, that the first packets should be bridged, the first packets having a first source address and a first destination address within the first network, wherein determining that the first packets should be bridged comprises performing a bridge lookup based upon media access control address information of the first packets;

applying a first screening process to the first packets at the first device;

determining, at the first device, that the second packets should be routed; and

applying a second screening process to the second packets at the first device.

16. The method of claim 15 , wherein the second screening process comprises performing an access list check.

17. The method of claim 15 , wherein the first screening process comprises applying security policies implemented at one or more of layers 3 through 7 .

18. A computer program embodied in a machine-readable medium, the computer program comprising instructions for controlling a firewall to perform the following steps:

receive first packets and second packets at a first device;

determine, at the first device, that the first packets should be bridged, the first packets having a first source address and a first destination address within the first network;

perform a bridge lookup based upon media access control address information of the first packets;

apply a first screening process to the first packets at the first device;

determine, at the first device, that the second packets should be routed; and

apply a second screening process to the second packets at the first device.

19. The computer program of claim 18 , wherein the instructions for applying the first screening process further comprise instructions for causing the firewall to perform an access list check.

20. The computer program of claim 18 , wherein the instructions for applying the second screening process further comprise instructions for causing the firewall to perform an access list check.