System and method of traffic inspection and stateful connection forwarding among geographically dispersed network appliances organized as clusters
A peering relationship among two or more network appliances is established through an exchange of control messages among the network appliances. The peering relationship defines a cluster of peered network appliances, and at each network appliance of the cluster traffic flow state information for all the network appliances of the cluster is maintained. Network traffic associated with traffic flows of the network appliances of the cluster is managed according to the state information for the traffic flows. This managing of the network traffic may include forwarding among the network appliances of the cluster (i.e., to those of the appliances handling the respective flows) at least some of the network traffic associated with one or more of the traffic flows according to the state information for the one or more traffic flows. The traffic flows may be TCP connections or UDP flows.
1. A method for asymmetrically routing traffic flows comprising:
authenticating, by each of a plurality of network appliances including a first and a second network appliance, each other network appliance;
establishing, by each network appliance, a peering relationship with each of the other authenticated network appliances so as to define a cluster of peered network appliances,
exchanging, by each peered network appliance, traffic flow state information including (i) a source port and a destination port corresponding to each of one or more received traffic flows and (ii) an action corresponding to each of the one or more traffic flows to be taken by a member of the cluster upon receipt of network traffic associated with the traffic flow;
routing, by the first network appliance, a t least one of the traffic flows in a first direction through a first network; and
routing, by the second network appliance, the at least one of the traffic flows in a second direction through a second network, wherein the second network is different from the first network.
2. The method of claim 1 , wherein authenticating further comprises using an X.509 certificate.
3. The method of claim 1 , wherein establishing a peering relationship further comprises exchanging encrypted cluster control management messages among the network appliances.
4. The method of claim 1 , wherein establishing a peering relationship further comprises establishing secure socket layer (SSL) connections between the network appliances.
5. The method of claim 1 , wherein at least two or more of the network appliances of the cluster are on different network domains.
6. The method of claim 1 , wherein the action indicates that a particular one of the one or more traffic flows should be forwarded between two or more of the peered network appliances when flowing in one of the opposing directions.
7. The method of claim 1 , wherein the action indicates that the one or more traffic flows should bypass a particular one of the peered network appliances.
8. The method of claim 7 , wherein the action indicates that a particular connection in the one or more traffic flows should statically bypass the particular one of the peered network appliances.
9. The method of claim 7 , wherein the action indicates that the one or more traffic flows should dynamically bypass the particular one of the peered network appliances for all connections between a particular client and a particular server.
10. The method of claim 9 , wherein the action further indicates a lifetime for the dynamic bypass.
11. The method of claim 1 , wherein the action indicates that a receiver is to share its connection tables with one or more of the peered network appliances in the cluster.
12. The method of claim 1 , wherein one or more of the peered network appliances comprises a proxy device.
13. The method of claim 1 , wherein one or more of the peered network appliances performs Internet Protocol (IP) address spoofing of a client associated with at least one of the one or more traffic flows.
14. The method of claim 13 , wherein the statically-configured membership list is distributed via command line interfaces (CLIs) of the network appliances.
15. The method of claim 1 , further comprising:
distributing a statically-configured membership list among the network appliances that identifies the two or more network appliances that are to join the cluster.
16. The method of claim 1 , wherein the action indicates at least one of: that the peering relationship should be kept alive, that a new network appliance is to join to the cluster, or
that a particular one of the networking appliances in the cluster is to be removed from the cluster.
17. The method of claim 1 , further comprising:
employing a rule-based mechanism to resolve peering request collisions between the peered networking appliances in the cluster.
18. The method of claim 17 , wherein the rule-based mechanism resolves a peering request collision by favoring the peered networking appliance that has a larger host identifier in its network address.
19. A system for asymmetrically routing traffic flows comprising:
a plurality of network appliances including a first network appliance and a second network appliance;
a first network connected to the first network appliance;
a second network, different from the first network, connected to the second network appliance,
wherein each network appliance is configured to:
authenticate each other network appliance;
establish a peering relationship with each of the authenticated network appliances so as to define a cluster of peered network appliances,
exchange traffic flow state information including (i) a source port and a destination port corresponding to each of one or more received traffic flows and (ii) an action corresponding to each of the one or more traffic flows to be taken by a member of the cluster upon receipt of network traffic associated with the traffic flow,
wherein the network appliances are configured to route at least one of the traffic flows (i) in a first direction through the first network and the first network appliance and (ii) in a second direction through the second network and the second network appliance.
20. A first network appliance comprising a processor configured to:
authenticate each of a plurality of other network appliances including a second network appliance;
establish a peering relationship with each of authenticated network appliances so as to define a cluster of peered network appliances,
exchange, with each peer network appliance, traffic flow state information including (i) a source port and a destination port corresponding to each of one or more received traffic flows and (ii) an action corresponding to each of the one or more traffic flows to be taken by a member of the cluster upon receipt of network traffic associated with the traffic flow;
route, by the first network appliance, at least one of the traffic flows in only a first direction through a first network, wherein the at least one of the traffic flows is routed in a second direction through a second network and the second network appliance, wherein the second network is different from the first network.