WO2007072245A3 - Dynamic firewall rule definition - Google Patents

Abstract

A sub-network (12) is coupled to the Internet (10) via a firewall (23). Identifier based access policy rules are provided for devices and/or services coupled to the sub-network. The identifiers are statically assigned to devices (14) coupled to the sub-network (12) and/or to services provided by said devices (14). Network addresses are dynamically assigned to the devices, for example by means of a DHCP server. A firewall management unit monitors messages on the sub-network (12) to detect messages that associate the identifiers with network addresses assigned to devices (14) assigned to the identifiers. The firewall management unit dynamically redefines firewall rules expressed in terms of the network addresses obtained by said monitoring, dependent on the access policy rules for the identifiers assigned to the devices and/or services for which the network addresses obtained by said monitoring are used. Preferably, the firewall is located between a tunnel endpoint for a virtual private network and the sub-network, the firewall being initialized to block all messages for network addresses in a dynamically assignable range, the firewall management unit making some rules more permissive when a network address for a device has been determined.