Firewall policy management

Patent metadata

Field	Value
Publication number	US-10148620-B2
Application number	US-201715810500-A
Country	US
Kind code	B2
Filing date	Nov 13, 2017
Priority date	Mar 27, 2013
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

Methods and systems are provided for creation and implementation of firewall policies. According to one embodiment, a firewall maintains a log of observed network traffic flows. An administrator may request the firewall to generate a customized report based on the logged network traffic by extracting information from the log based on specified report parameters. The report includes aggregated network traffic items and one or more corresponding action objects. Responsive to receipt of a directive to implement an appropriate firewall policy for one or more network traffic items based on interaction with one or more action objects by the administrator, the firewall then automatically defines and establishes an appropriate firewall policy.

First claim

What is claimed is:

1. A method comprising:
receiving, via a graphical user interface (GUI) of a network security device protecting a private network, a request from an administrator of the private network for a report to be generated from a log of network traffic observed by the network security device, the request containing information defining report parameters including one or more of (i) a specified time frame, (ii) user information indicative of one or more users associated with the private network; and (iii) application information specifying one or more particular applications or one or more types of applications associated with the logged network traffic;
extracting from the log, by the network security device, information regarding logged network traffic satisfying the report parameters;
presenting, by the network security device, via the GUI the report to the administrator, wherein the report includes (i) a plurality of network traffic items summarized by an administrator-selected report parameter of the report parameters; and (ii) a plurality of action objects each corresponding to one of the plurality of summarized network traffic items, wherein a traffic volume metric or a percentage of traffic volume metric displayed for each summarized network traffic item of the plurality of summarized network traffic items represents an aggregate of traffic volumes or an aggregation of percentages of traffic volumes, respectively, for each observed value of a primary report parameter of the report parameters within the extracted information for a value of the administrator-selected report parameter corresponding to the summarized network traffic item; and
responsive to interaction by the administrator with a particular action object of the plurality of action objects and selection by the administrator of an action to be taken on subsequently received network traffic matching the corresponding summarized network traffic item of the plurality of summarized network traffic items, automatically defining, by the network security device, a security policy including one or more rules identifying the matching network traffic and a corresponding action to be taken on the matching network traffic based on the selection.

2. The method of claim 1 , further comprising presenting, by the network security device, to the administrator via the GUI a plurality of options regarding actions to be taken on the matching network traffic that is subsequently observed by the network security device, wherein the plurality of options include one or more of (i) blocking the matching network traffic, (ii) selectively allowing or blocking the matching network traffic in accordance with a defined schedule, (iii) enforcing a bandwidth limitation on the matching network traffic and (iv) limiting a direction of traffic flow for the matching network traffic.

3. The method of claim 2 , wherein the bandwidth limitation includes information regarding a maximum amount of total bandwidth permitted per day for the matching network traffic.

4. The method of claim 2 , wherein the bandwidth limitation includes information regarding a maximum instantaneous bandwidth rate permitted at any given time for the matching network traffic.

5. The method of claim 1 , further comprising responsive to a drill down request relating to a particular summarized network traffic item of the plurality of summarized network traffic items, updating, by the network security device, the report to include (i) subtotal network traffic items for each observed value of a secondary report parameter of the report parameters; and (ii) an action object corresponding to each subtotal network traffic item, wherein a traffic volume metric or a percentage of traffic volume metric corresponding to the subtotal network traffic items are determined by aggregating traffic volumes or percentages of traffic volumes, respectively, for each observed value of the secondary report parameter within the extracted information for a value of the administrator-selected report parameter corresponding to the particular summarized network traffic item network traffic item.

6. The method of claim 5 , wherein the administrator-selected report parameter comprises the application information, the primary report parameter comprises the user information and the secondary report parameter comprises the specified time frame.

7. The method of claim 5 , wherein the administrator-selected report parameter comprises the user information, the primary report parameter comprises the application information information and the secondary report parameter comprises the specified time frame.

8. The method of claim 1 , wherein the user information specifies one or more groups of users or one or more users associated with the private network.

9. The method of claim 1 , wherein the one or more types of applications include unknown applications, business applications, gaming applications, instant messaging applications and peer-to-peer applications.

10. The method of claim 2 , wherein the defined schedule includes information regarding one or more of (i) a time frame during which the matching network traffic is permitted or prohibited and (ii) a total amount of time during which the matching network traffic is permitted per day.

11. A non-transitory computer-readable storage medium embodying a set of instructions representing a network security application, which when executed by one or more microprocessors of a network security device protecting a private network, cause the one or more microprocessors to perform a method comprising:
receiving, via a graphical user interface (GUI) of the network security device, a request from an administrator of the private network for a report to be generated from a log of network traffic observed by the network security device, the request containing information defining report parameters including one or more of (i) a specified time frame, (ii) user information indicative of one or more users associated with the private network; and (iii) application information specifying one or more particular applications or one or more types of applications associated with the logged network traffic;
extracting from the log information regarding logged network traffic satisfying the report parameters;
presenting via the GUI the report to the administrator, wherein the report includes (i) a plurality of network traffic items summarized by an administrator-selected report parameter of the report parameters; and (ii) a plurality of action objects each corresponding to one of the plurality of summarized network traffic items, wherein a traffic volume metric or a percentage of traffic volume metric displayed for each summarized network traffic item of the plurality of summarized network traffic items represents an aggregate of traffic volumes or an aggregation of percentages of traffic volumes, respectively, for each observed value of a primary report parameter of the report parameters within the extracted information for a value of the administrator-selected report parameter corresponding to the summarized network traffic item; and
responsive to interaction by the administrator with a particular action object of the plurality of action objects and selection by the administrator of an action to be taken on subsequently received network traffic matching the corresponding summarized network traffic item of the plurality of summarized network traffic items, automatically defining a security policy including one or more rules identifying the matching network traffic and a corresponding action to be taken on the matching network traffic based on the selection.

12. The non-transitory computer-r

Assignees

• Fortinet Inc

Inventors

• Yin Jun

Classifications

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/164

  at the network layer · CPC title