Firewall policy management

Patent metadata

Field	Value
Publication number	US-9438563-B2
Application number	US-201615073312-A
Country	US
Kind code	B2
Filing date	Mar 17, 2016
Priority date	Mar 27, 2013
Publication date	Sep 6, 2016
Grant date	Sep 6, 2016

Abstract

Methods and systems are provided for creation and implementation of firewall policies. Method of the present invention includes enabling a firewall device to maintain a log of network traffic flow observed by the device. The method further includes enabling firewall device to receive an administrator request for a customized report to be generated based on log of network traffic and generating the report by extracting information from the log based on report parameters, where the report includes desired network traffic items that are associated with one or more action objects. The method further provides for firewall device to receive a directive to implement an appropriate firewall policy on one or more network traffic items responsive to interaction of administrator with one or more action objects corresponding to the network traffic items. Based on the directive and information from log, the firewall then defines and/or establishes appropriate firewall policy.

First claim

What is claimed is:

1. A method comprising:
maintaining, by a firewall device within a private Internet Protocol (IP) network of an enterprise, a log of network traffic observed by the firewall device by storing, for each network traffic flow, information regarding one or more of traffic volume, a source interface, a destination interface, a source IP address, a destination IP address, an application name, an application type, port information, one or more timestamps and a username associated with the network traffic flow;
receiving, by the firewall device, a request from a network administrator for a report to be generated based on the log, the request containing information indicative of report parameters including (i) a specified time frame, (ii) user information indicative of an identity of one or more users within the enterprise; and (iii) application information indicative of one or more particular applications or one or more types of applications associated with the logged network traffic;
extracting, by the firewall device, information regarding network traffic flows from the log satisfying the report parameters;
presenting, by the firewall device, a customized and interactive hierarchical report to the network administrator via a graphical user interface (GUI) of the firewall device, the customized and interactive hierarchical report including (i) a plurality of aggregated network traffic items; and (ii) a plurality of action objects each corresponding to one of the plurality of aggregated network traffic items, wherein information associated with the plurality of aggregated network traffic items is determined by individually aggregating each of a plurality of traffic aggregation parameters for each observed value of a primary report parameter within the extracted information, wherein the plurality of traffic aggregation parameters, include one or more traffic volume and percentage of traffic volume;
responsive to interaction by the network administrator with a particular action object of the plurality of action objects:
receiving, by the firewall device, a request to define an appropriate firewall policy for the corresponding aggregated network traffic item of the plurality of aggregated network traffic items; and
presenting, by the firewall device, to the network administrator via the GUI a plurality of options regarding actions to be taken on matching network traffic that is subsequently observed by the firewall device traffic, wherein the plurality of options include one or more of blocking the matching network traffic, allowing the matching network traffic in accordance with a particular schedule and enforcing a bandwidth limitation on the matching network traffic; and

responsive to receiving, by the firewall device, an indication from the network administrator regarding one or more selected options of the plurality of options, defining and establishing the appropriate firewall policy, wherein the appropriate firewall policy comprises one or more rules to identify the matching network traffic and one or more corresponding actions to be taken on the matching network traffic based on the one or more selected options.

2. The method of claim 1 , further comprising responsive to a drill down request relating to a particular aggregated network traffic item of the aggregated network traffic items, updating, by the firewall device, the customized and interactive hierarchical report to include (i) aggregated subtotal network traffic items for each observed value of a secondary report parameter of the report parameters; and (ii) an action object corresponding to each aggregated subtotal network traffic item, wherein the aggregated subtotal network traffic items are determined by individually aggregating each of the plurality of traffic aggregation parameters for each observed value of the secondary report parameter within the extracted information corresponding to the particular aggregated network traffic item.

3. The method of claim 2 , wherein the primary report parameter comprises the user information and the secondary report parameter comprises the application information.

4. The method of claim 2 , wherein the primary report parameter comprises the application information and the secondary report parameter comprises the user information.

5. The method of claim 1 , wherein the user information comprises one or more selected groups of users or one or more selected users.

6. The method of claim 1 , wherein the one or more types of applications include unknown applications, business applications, games, instant messaging applications and peer-to-peer applications.

7. The method of claim 1 , wherein the particular schedule includes information regarding a time frame during which the matching network traffic is permitted or prohibited.

8. The method of claim 1 , wherein the particular schedule includes information regarding a total amount of time during which the matching network traffic is permitted per day.

9. The method of claim 1 , wherein the bandwidth limitation includes information regarding a maximum amount of total bandwidth permitted per day for the matching network traffic.

10. The method of claim 1 , wherein the bandwidth limitation includes information regarding a maximum instantaneous bandwidth rate permitted at any given time for the matching network traffic.

11. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more microprocessors of a firewall device within a private Internet Protocol (IP) network of an enterprise, cause the one or more microprocessors to perform a method comprising:
maintaining a log of network traffic observed by the firewall device by storing, for each network traffic flow, information regarding one or more of traffic volume, a source interface, a destination interface, a source IP address, a destination IP address, an application name, an application type, port information, one or more timestamps and a username associated with the network traffic flow;
receiving a request from a network administrator for a report to be generated based on the log, the request containing information indicative of report parameters including (i) a specified time frame, (ii) user information indicative of an identity of one or more users within the enterprise; and (iii) application information indicative of one or more particular applications or one or more types of applications associated with the logged network traffic;
extracting information regarding network traffic flows from the log satisfying the report parameters;
presenting a customized and interactive hierarchical report to the network administrator via a graphical user interface (GUI) of the firewall device, the customized and interactive hierarchical report including (i) a plurality of aggregated network traffic items; and (ii) a plurality of action objects each corresponding to one of the plurality of aggregated network traffic items, wherein information associated with the plurality of aggregated network traffic items is determined by individually aggregating each of a plurality of traffic aggregation parameters for each observed value of a primary report parameter within the extracted information, wherein the plurality of traffic aggregation parameters, include one or more traffic volume and percentage of traffic volume;
responsive to interaction by the network administrator with a particular action object of the plurality of action objects:
receiving a request to define an appropriate firewall policy for the corresponding aggregated network traffic item of the plurality of aggregated network traffic items; and
presenting to the network administrator vi

Assignees

• Fortinet Inc

Inventors

• Yin Jun

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/164

  at the network layer · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title