Method and Apparatus for Enabling Enhanced Control of Traffic Propagation Through a Network Firewall

Abstract

A distributed firewall system is used to implement a network firewall with enhanced control over network traffic to allow policy to be implemented on a per-user basis, a per-application basis, a per-user and application basis, and to allow ports to be dynamically opened and closed as needed by the applications. The distributed firewall system may include application identifiers associated with applications running on a network element, one or more firewall agents instantiated on the network element hosting the applications, and a firewall configured to interface with the firewall agents. Communications between the distributed components are secured to allow the firewall to detect if an agent has been compromised, and to allow the firewall agent to determine if the application has been compromised. The distributed firewall system may work in a VPN environment, such as in connection with a VPN server, to implement firewall policy at the point where VPN traffic enters the protected network.

1 - 24 . (canceled) 
     
     
         25 . A method of operating a distributed firewall system, the distributed firewall system comprising a firewall, at least one firewall agent associated with a host providing at least one application, and a firewall component associated with a VPN server, the method comprising:
 communicating, from at least one firewall agent associated with the host to the firewall, information pertaining to at least one of a user and an application requesting access to a VPN service provided by the VPN server;   making a policy decision at the firewall based on the communicated information pertaining to the at least one of a user and an application;   communicating, from the firewall to the firewall component associated with the VPN server, information pertaining to implementation of the policy decision; and   implementing at least a portion of the policy decision at the VPN server based on the communicated information pertaining to implementation of the policy decision.   
     
     
         26 . The method of  claim 25 , further comprising communicating, from the at least one firewall agent associated with the host to the firewall, information pertaining to at least one VPN client to be used for the at least one of a user and an application. 
     
     
         27 . The method of  claim 25 , wherein implementing at least a portion of the policy decision at the VPN server comprises preventing particular traffic from being put on a VPN tunnel by the VPN server. 
     
     
         28 . The method of  claim 25 , further comprising:
 communicating, from the firewall to at least one firewall agent associated with the host, information pertaining to implementation of the policy decision; and   implementing at least a portion of the policy decision at the host based on the communicated information pertaining to implementation of the policy decision.   
     
     
         29 . The method of  claim 28 , wherein implementing at least a portion of the policy decision at the host comprises blocking particular traffic at the host. 
     
     
         30 . The method of  claim 25 , wherein communication between the firewall agent, the firewall and the firewall component uses a VPN service provided by the VPN server. 
     
     
         31 . The method of  claim 25 , wherein the VPN server provides a tunnel that traverses the firewall, and firewall information is carried over the tunnel. 
     
     
         32 . The method of  claim 25 , wherein the VPN server is disposed behind the firewall and at least one firewall agent is integrated with a VPN client at the VPN server, the method comprising operating the at least one firewall agent integrated with the VPN client to monitor at least one of a user and an application. 
     
     
         33 . The method of  claim 25 , wherein the VPN server is co-located with the firewall and at least one firewall agent is integrated with a VPN client at the VPN server, the method comprising operating the at least one firewall agent integrated with the VPN client to monitor at least one of a user and an application. 
     
     
         34 . The method of  claim 25 , wherein at least one personal firewall is integrated with at least one firewall agent associated with the host, the method further comprising passing at least one of user information and application information from the at least one personal firewall to the at least one firewall agent. 
     
     
         35 . A method of operating a firewall agent in a distributed firewall system, the distributed firewall system comprising a firewall, the firewall agent and a firewall component associated with a VPN server, the firewall agent being associated with a host providing at least one application, the method comprising:
 monitoring at least one user and at least one application at the host; and   communicating to the firewall information pertaining to at least one of a user and an application requesting access to a VPN service provided by the VPN server.   
     
     
         36 . The method of  claim 35 , further comprising:
 receiving from the firewall information pertaining to implementation of a policy decision; and   implementing at least a portion of the policy decision at the host based on the communicated information pertaining to implementation of the policy decision.   
     
     
         37 . The method of  claim 36 , wherein implementing at least a portion of the policy decision at the host comprises blocking particular traffic at the host. 
     
     
         38 . The method of  claim 35 , wherein at least one personal firewall is integrated with the firewall agent, the method further comprising passing at least one of user information and application information from the at least one personal firewall to the firewall agent. 
     
     
         39 . A method of operating a firewall in a distributed firewall system comprising the firewall, at least one firewall agent associated with a host providing at least one application and a firewall component associated with a VPN server, the method comprising:
 receiving, from at least one firewall agent associated with the host, information pertaining to at least one of a user and an application requesting access to a VPN service provided by the VPN server;   making a policy decision based on the communicated information pertaining to the at least one of a user and an application; and   communicating, to the firewall component associated with the VPN server, information pertaining to implementation of the policy decision to enable implementation of at least part of the policy decision at the VPN server.   
     
     
         40 . A method of operating a firewall component in a distributed firewall system comprising a firewall, at least one firewall agent associated with a host providing at least one application and the firewall component, the firewall server being associated with a VPN server, the method comprising:
 receiving, from the firewall, information pertaining to implementation of a policy decision; and   implementing at least a portion of the policy decision based on the communicated information pertaining to implementation of the policy decision.   
     
     
         41 . The method of  claim 40 , wherein implementing at least a portion of the policy decision comprises preventing particular traffic from being put on a VPN tunnel by the VPN server. 
     
     
         42 . The method of  claim 40 , further comprising:
 providing a tunnel that traverses the firewall; and   carrying firewall information over the tunnel.:   
     
     
         43 . The method of  claim 40 , wherein the VPN server is disposed behind the firewall and at least one firewall agent is integrated with a VPN client at the VPN server, the method comprising operating the at least one firewall agent integrated with the VPN client to monitor at least one of a user and an application. 
     
     
         44 . The method of  claim 40 , wherein the VPN server is co-located with the firewall and at least one firewall agent is integrated with a VPN client at the VPN server, the method comprising operating the at least one firewall agent integrated with the VPN client to monitor at least one of a user and an application.