FT-FW: A cluster-based fault-tolerant architecture for stateful firewalls

• Published in: Computers & security 2012-06, Vol.31 (4), p.524-539
• Main Authors: Ayuso, Pablo Neira, Gasca, Rafael M., Lefevre, Laurent
• Format: Article
• Language: English
• Subjects: Access control; Architecture; Clusters; Computer architecture; Computer networks; Computer Science; Computer security; Failure; Fault tolerance; Firewalls; Internet; Mathematical models; Networking and Internet Architecture; Networks; Service introduction; Stateful firewall; Studies
• ISSN: 0167-4048; 1872-6208
• DOI: 10.1016/j.cose.2012.01.011

Nowadays, stateful firewalls are part of the critical infrastructure of the Internet. Basically, they help to protect network services and users against attackers by means of access control and protocol conformance checkings. However, stateful firewalls are problematic from the fault-tolerance perspective since they introduce a single point of failure in the network schema. In this work, we summarize and enhance our previous research efforts that aim to provide a full fault-tolerant solution for stateful firewalls. These efforts have focused on the design and the implementation of the cluster-based Fault-Tolerant stateful Firewall (FT-FW) architecture. We provide details on our proposed solution and we extensively evaluate important network performance and availability aspects that we did not cover so far. The evaluation experiments are based on our Free/OpenSource implementation that has become the most popular solution for Linux-based stateful firewalls.11This includes commercial firewall vendors that base their products on Linux and OpenSource software like Vyatta Inc. (http://www.vyatta.com), Astaro AG (http://www.astaro.com) and 6WIND S.A.R.L. (http://www.6wind.com). According to the information available in their websites, these vendors sell their products to SMEs, Fortune 50 companies and the public administration all over the world.