Patent ID: 9276904
Filing Date: 2016-03-01
CPC Classification: H04L

Claim Text:
1. A method of specifying firewall rules, the method comprising: specifying a plurality of high-level firewall rules that each includes a high-level construct tuple that identifies a set of high-level constructs in a network where the high-level firewall rule has to be enforced; translating each high-level firewall rule to a set of lower-level firewall rules, each lower-level firewall rule comprising a lower-level enforcement-node tuple that identifies a first set of lower-level enforcement nodes associated with the high-level construct of the high-level firewall rule; and distributing at least two different subsets of the lower-level firewall rules to at least two enforcement devices, each enforcement device comprising a second set of lower-level enforcement nodes for which the distributed subset of lower-level firewall rules are enforced according to a precedence hierarchy that defines a precedence order for the lower-level firewall rules.