Configuring and managing remote security devices

Patent metadata

Field	Value
Publication number	US-2015106909-A1
Application number	US-201414495804-A
Country	US
Kind code	A1
Filing date	Sep 24, 2014
Priority date	Aug 31, 2011
Publication date	Apr 16, 2015
Grant date	—

Abstract

Techniques for configuring and managing remote security devices are disclosed. In some embodiments, configuring and managing remote security devices includes receiving a registration request for a remote security device at a device for configuring and managing a plurality of remote security devices; verifying the registration request to determine that the remote security device is an authorized remote security device for an external network; and sending a response identifying one or more security gateways to the remote security device, in which the remote security device is automatically configured to connect to each of the one or more security gateways using a distinct Layer 3 protocol tunnel (e.g., a virtual private network (VPN)).

First claim

What is claimed is:

1 . (canceled)

2 . A system, comprising:
a processor of a device for configuring and managing a plurality of remote security devices configured to:
receive a registration request for a remote security device, wherein the registration request includes a serial number of the remote security device, a media access control (MAC) address of the remote security device, a user entered unique identifier, or any combination thereof;
verify the registration request to determine that the remote security device is an authorized remote security device for an external network;
send a response identifying one or more security gateways to the authorized remote security device, wherein the sending of the response includes sending a certificate to the remote security device to establish an associated tunnel;
identify an updated set of one or more security gateways to the authorized remote security device, wherein the remote security device is automatically configured to connect to a second security gateway over the remote security device's associated tunnel, and wherein the second security gateway is included in the identified updated set of one or more security gateways; and
revoke the certificate issued to the remote security device, wherein the remote security device can no longer connect to a first security gateway after revocation of its certificate; and
a memory of the device for configuring and managing a plurality of remote security devices coupled to the processor of the device for configuring and managing a plurality of remote security devices and configured to provide the processor of the device for configuring and managing a plurality of remote security devices with instructions.

3 . The system recited in claim 2 , wherein the remote security device is automatically configured to connect to each of the one or more security gateways over the remote security device's associated tunnel using the distinct Layer 3 protocol tunnel.

4 . The system recited in claim 2 , wherein the remote security device is configured to route selected outbound network traffic from the external network to the one or more security gateways over the remote security device's associated tunnel.

5 . The system recited in claim 2 , wherein the one or more security gateways performs security processing on the received outbound traffic based on a security policy.

6 . The system recited in claim 2 , wherein the one or more security gateways forwards the selected outbound network traffic to an original destination after performing the security processing, the original destination being external to a network associated with the one or more security gateways.

7 . The system recited in claim 2 , wherein the first security gateway and the second security gateway are included in the identified one or more security gateways.

8 . The system recited in claim 2 , wherein the device for configuring and managing the plurality of remote security devices executes a portal that can be used for configuring and managing the plurality of remote security devices.

9 . The system recited in claim 2 , wherein each of the plurality of security devices is connected to a distinct external network that is associated with a distinct entity.

10 . The system recited in claim 2 , wherein the distinct Layer 3 protocol tunnel is a virtual private network (VPN) tunnel.

11 . The system recited in claim 2 , wherein the processor of the device for configuring and managing the plurality of remote security devices is further configured to:
receive the security policy for managing security associated with an external network protected by the remote security device.

12 . The system recited in claim 2 , wherein:
the remote security device routes traffic to one of the first security gateway and the second security gateway based on a level of traffic on the external network, a network capacity and/or availability of the first and second security gateways, or any combination thereof.

13 . The system recited in claim 2 , wherein a processor of the first security gateway is further configured to:
receive a plurality of packets from a plurality of external networks, each packet being received from the distinct Layer 3 protocol tunnel that terminates at an edge of one of the external networks; select a respective security policy for each of the received packets according to the external network from which the packet was received; perform security processing on payloads of each of the received packets according to their respective selected security policies; and a memory of the first security gateway coupled to the processor of the first security gateway and configured to provide the processor of the first security gateway with instructions.

14 . The system recited in claim 2 , wherein a processor of the first security gateway is further configured to:
examine the payload to classify the payload including classifying the payload using information included in a payload header and payload content; determine instructions for processing the payload based on the information and the packet's respective security policy; process the payload using the instructions to perform signature matching on the payload content, wherein processing the packet comprises one or more of logging, storing, allowing the packet to pass, setting an alarm, blocking the packet, or dropping the packet, and wherein a payload of a packet in the plurality of packets is a Layer 3 protocol packet or a Layer 4 protocol packet; and a memory of the first security gateway coupled to the processor of the first security gateway and configured to provide the processor of the first security gateway with instructions.

15 . A method, comprising:
receiving a registration request for a remote security device at a device for configuring and managing a plurality of remote security devices, wherein the registration request includes a serial number of the remote security device, a media access control (MAC) address of the remote security device, a user entered unique identifier, or any combination thereof; verifying the registration request to determine that the remote security device is an authorized remote security device for an external network; sending a response identifying one or more security gateways to the remote security device, wherein the sending of the response includes sending a certificate to the remote security device to establish an associated tunnel; identifying an updated set of one or more security gateways to the authorized remote security device, wherein the remote security device is automatically configured to connect to a second security gateway over the remote security device's associated tunnel using a distinct Layer 3 protocol tunnel, and wherein the second security gateway is included in the identified updated set of one or more security gateways; and revoking the certificate issued to the remote security device, wherein the remote security device can no longer connect to a first security gateway after revocation of its certificate.

16 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving a registration request for a remote security device at a device for configuring and managing a plurality of remote security devices, wherein the registration request includes a serial number of the remote security device, a media access control (MAC) address of the remote security device, a user entered unique identifier, or any comb

Assignees

• Palo Alto Networks Inc

Inventors

• Chen Yueh-Zen
• Xu Wilson
• Gill Monty Sher

Classifications

• G06F2221/2103

  Challenge-response · CPC title

• G06F21/6272

  by registering files or documents with a third party · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• H04L63/164

  at the network layer · CPC title

• H04L63/0254

  Stateful filtering · CPC title