Multi-perimeter firewall in the cloud
Systems and methods for providing multi-perimeter firewalls via a virtual global network are disclosed. In one embodiment the network system may comprise an egress ingress point in communication with a first access point server, a second access point server in communication with the first access point server, an endpoint device in communication with the second access point server, a first firewall in communication with the first access point server, and a second firewall in communication with the second access point server. The first and second firewalls may prevent traffic from passing through their respective access point servers. The first and second may be in communication with each other and exchange threat information.
1. A method of operating a multi-perimeter distributed firewall in a geographically extended virtual network system, the method comprising:
connecting
a compute cloud location and
a secure endpoint located at a remote location that is geographically separate from
the compute cloud location to a packet-data-based secure virtual network maintained over-the-top of at least one wide area network;
determining, at a control node for the secure virtual network, an on-demand allocation of compute resources at the compute cloud location to instantiate a variable number of virtual firewalls, up to a plurality of virtual firewalls, to serve the secure virtual network;
upon instantiation of each given firewall of the virtual firewalls, configuring that given firewall as part of a first firewall perimeter for at least a portion of packet traffic ingressing to a secure perimeter that includes connection to the secure virtual network at the compute cloud location;
operating the variable number of virtual firewalls in parallel as the first firewall perimeter to provide traffic inspection for packet traffic ingressing to the secure perimeter;
for packet traffic clearing the first firewall perimeter and having a respective destination reachable via the remote location, forwarding that packet traffic over the secure virtual network towards the remote location; and
operating at least one second firewall at a second firewall perimeter coupled to the secure virtual network, to provide second traffic inspection for at least some packet traffic forwarded from the first firewall perimeter over the secure virtual network towards the remote location.
2. The method of claim 1 , wherein the secure endpoint is one of a plurality of respective secure endpoints located at a plurality of respective remote locations that are geographically separate from the compute cloud location, each of the plurality of respective secure endpoints connected to the secure virtual network, the variable number of virtual firewalls providing the first firewall perimeter for packet traffic having a respective destination reachable by any of the remote locations.
3. The method of claim 1 , further comprising each of the variable number of firewalls, the second firewall, and the secure endpoint communicating at least with the control node via a back channel mechanism separate from the secure virtual network.
4. The method of claim 3 , further comprising providing access to one or more of the variable number of firewalls and the second firewall, via the back channel mechanism, to threat information detected by one or more others of the variable number of firewalls and the second firewall.
5. The method of claim 1 , further comprising configuring instantiation of each given firewall of the virtual firewalls to require retrieval of secure boot credentials from a boot server upon validation of that given firewall.
6. The method of claim 1 , wherein each of the variable number of firewalls is configured to perform stateful packet inspection for a respective load-balanced portion of the packet traffic ingressing to the secure perimeter.
7. The method of claim 6 , wherein the at least one second firewall is configured to perform deep packet inspection for the at least some packet traffic.
8. The method of claim 7 , further comprising cloning the packet traffic upon which deep packet inspection is to be performed, and directing the cloned packet traffic to the at least one second firewall.
9. The method of claim 6 , further comprising connecting each of the variable number of firewalls to receive its respective load-balanced portion of the packet traffic ingressing to the secure perimeter through a cloud firewall load balancer, the cloud firewall load balancer operating to direct the respective load-balanced portions to each of the variable number of firewalls.
10. The method of claim 1 , wherein the at least a portion of packet traffic ingressing to the secure perimeter comprises traffic ingressing from the open Internet.
11. The method of claim 10 , wherein the at least a portion of packet traffic ingressing to the secure perimeter comprises traffic ingressing from cloud-based servers or storage devices associated with an organization operating at the remote location.
12. The method of claim 1 , wherein the at least a portion of packet traffic ingressing to the secure perimeter comprises traffic ingressing from cloud-based servers or storage devices associated with an organization operating at the remote location.