Firewall control device, method and firewall device
摘要
說明書
In other words, some or all of the FWC 7 and the FWs 5 may be real machines or may be VMs.
Each of the FWs 5 exemplarily stores therein information or data in which traffics permitted to pass between the core network 2 and the corresponding sub-network 3 and traffics to be blocked therebetween are registered. The “traffic” may be called a “data flow” or may be simply called a “flow”. The information or data for controlling a passage or blocking (may be called “discarding”) of a flow may be conveniently called a “flow entry” or simply called an “entry”.
Based on entries, each of the FWs 5 may identify flows to be permitted to pass through the relevant FW 5 and flows to be blocked by the relevant FW 5, may cause data of the flows caused to pass to pass therethrough, and may discard data of the flows to be blocked. The contents of the flow entries may be exemplarily determined in accordance with a policy (may be called a “FW policy”) related to the FW in the corresponding sub-network 3.
Note that data of a flow caused to pass or to be blocked may be exemplarily packet data or frame data. The packet data may be simply abbreviated to a “packet”, and the frame data may be simply abbreviated to a “frame”. The “frame” may be exemplarily an Ethernet frame. The “Ethernet” is a registered trademark.
As a setting method for flow entries in each of the FWs 5, 2 methods are considered.
