Load balancing among a cluster of firewall security devices

Patent metadata

Field	Value
Publication number	US-2016359808-A1
Application number	US-201615232742-A
Country	US
Kind code	A1
Filing date	Aug 9, 2016
Priority date	Feb 16, 2011
Publication date	Dec 8, 2016
Grant date	—

Abstract

A method for balancing load among firewall security devices (FSDs) is provided. According to one embodiment, a switching device performs adaptive load balancing among cluster units of an HA cluster of firewall security devices. A load balancing (LB) function implemented by the switching device is configured based on information received from a network administrator. A LB table is maintained that forms associations between hash values output by the LB function and corresponding ports of the switching device to which the cluster units are coupled. Network traffic received by the switching device is directed to appropriate cluster units based on the LB function and the LB table. A traffic load on each of the cluster units is monitored. Responsive to a deviation from a predefined ideal traffic distribution, an attempt is made to improve performance of the HA cluster by dynamically adjusting the LB balancing table to address the deviation.

First claim

What is claimed is:

1 . A method of adaptive load balancing among a plurality of cluster units of a high availability (HA) cluster of firewall security devices associated with a private Internet Protocol (IP) network, the method comprising:
configuring, by a network switching device coupled to the HA cluster, a load balancing function implemented by the network switching device based on information received from a network administrator indicative of (i) a number of bits to be used as an input to the load balancing function and (ii) corresponding contiguous or non-contiguous bit positions within a header of a packet; maintaining, by the network switching device, a load balancing table that forms associations between hash values or emulated hash values output by the load balancing function and corresponding ports of a plurality of ports of the network switching device to which the plurality of cluster units are coupled; directing network traffic received by the network switching device to appropriate cluster units of the plurality of cluster units by:
determining a hash value or an emulated hash value by applying the load balancing function to values associated with the bit positions of the number of bits within headers of packets of the network traffic;
identifying a port of the plurality of ports to which an appropriate cluster unit of the plurality of cluster units is coupled based on the determined hash value or the determined emulated hash value and the load balancing table; and
passing the network traffic to the appropriate cluster unit via the identified port;
monitoring, by the network switch device, a traffic load on each of the plurality of cluster units; and responsive to a deviation of the monitored traffic loads from a predefined ideal traffic distribution, attempting, by the network switching device, to improve performance of the HA cluster by dynamically adjusting the load balancing table to address the deviation.

2 . The method of claim 1 , further comprising:
determining, by the network switching device, the monitored traffic load for a first cluster unit of the plurality of cluster units, coupled to a first port of the plurality of ports, is greater than the monitored traffic load for a second cluster unit of the plurality of cluster units, coupled to a second port of the plurality of ports; and causing subsequently received network traffic associated with a subset of traffic sessions for which security services are currently being performed by the first cluster unit to be performed by the second cluster unit, by, the network switching device, updating the load balancing table to replace a reference to the first port with a reference to the second port for at least one of the associations between one or more of the hash values or emulated hash values and the first port.

3 . The method of claim 1 , wherein the security services include one or more of firewalling, virtual private networking (VPN), intrusion prevention system (IPS) scanning, virus scanning, web filtering and spam filtering.

4 . The method of claim 1 , further comprising prior to said updating, causing, by the network switching device, session information associated with the subset of traffic sessions to be copied from the first cluster unit to the second cluster unit by performing targeted session synchronization between the first cluster unit and the second cluster unit.

5 . The method of claim 1 , wherein the load balancing function is based on a portion, but not an entirety, of an IP or media access control (MAC) destination address specified within the headers of the packets.

6 . The method of claim 5 , wherein the load balancing function is expressed in a form substantially as follows:
f ( x )= D N-1 *2 N-1 + . . . +D 2 *2 2 +D 1 *2 1 +D 0 *2 0 ; where D N represents a value of a particular bit position of the IP destination address; and where N represents the number of bits minus 1.

7 . The method of claim 1 , wherein the packets comprise IP version 4 packets and wherein the corresponding contiguous or non-contiguous bit positions are within one or more of a type of service field, a protocol field, a source port field, a destination port field, a source address field and a destination address field of the headers.

8 . The method of claim 1 , wherein the load balancing table is implemented within a content addressable memory (CAM) and wherein said identifying a port of the plurality of ports comprises providing the determined hash value or the determined emulated hash value to the CAM as an input and receiving from the CAM responsive thereto a port number.

9 . The method of claim 1 , wherein the load balancing table is implemented within a random access memory (RAM) and wherein said identifying a port of the plurality of ports comprises searching the load balancing table for a table entry having a hash value or an emulated hash value matching the determined hash value or the determined emulated hash value and extracting therefrom a port number.

10 . A non-transitory computer-readable storage medium readable by one or more processors of a network switching device coupled to a plurality of cluster units of a high availability (HA) cluster of firewall security devices associated with a private Internet Protocol (IP) network, the computer-readable storage medium embodying a set of instructions executable by the one or more processors to perform a method of adaptive load balancing among the plurality of cluster units, the method comprising:
configuring a load balancing function implemented by the network switching device based on information received from a network administrator indicative of (i) a number of bits to be used as an input to the load balancing function and (ii) corresponding contiguous or non-contiguous bit positions within a header of a packet; maintaining a load balancing table that forms associations between hash values or emulated hash values output by the load balancing function and corresponding ports of a plurality of ports of the network switching device to which the plurality of cluster units are coupled; directing network traffic received by the network switching device to appropriate cluster units of the plurality of cluster units by:
determining a hash value or an emulated hash value by applying the load balancing function to values associated with the bit positions of the number of bits within headers of packets of the network traffic;
identifying a port of the plurality of ports to which an appropriate cluster unit of the plurality of cluster units is coupled based on the determined hash value or the determined emulated hash value and the load balancing table; and
passing the network traffic to the appropriate cluster unit via the identified port;
monitoring a traffic load on each of the plurality of cluster units; and responsive to a deviation of the monitored traffic loads from a predefined ideal traffic distribution, attempting to improve performance of the HA cluster by dynamically adjusting the load balancing table to address the deviation.

11 . The non-transitory computer-readable storage medium of claim 10 , wherein the method further comprises:
determining the monitored traffic load for a first cluster unit of the plurality of cluster units, coupled to a first port of the plurality of ports, is greater than the monitored traffic load for a second cluster unit of the plurality of cluster units, coupled to a second port of the plurality of ports; and causing subsequently received network traffic associated with a subset of traffic sessions for which security services are currently being performed by the first cluster unit to b

Assignees

• Fortinet Inc

Inventors

• Lopez Edward
• Mihelich Joe
• Hepburn Matthew F

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• H04L67/1004

  Server selection for load balancing · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L45/74

  Address processing for routing · CPC title