Patent ID: 8990885
Filing Date: 2015-03-24
Classification: G06F,H04L

Abstract:
1. A method comprising: at a virtual network device, defining and storing information representing a security management zone for a virtual firewall policy comprising one or more common attributes of applications associated with the security management zone; defining and storing information representing a firewall rule for the security management zone comprising conditions for matching common attributes of applications associated with the security management zone, and an action to be performed on application traffic; receiving parameters associated with the application traffic; generating a policy lookup request comprising at least one lookup attribute identifier, the lookup attribute identifier identifying a common attribute and an associated lookup attribute value based on the application traffic parameters; determining that the at least one lookup attribute identifier of the policy lookup request matches a cached attribute identifier stored in a cache of lookup results; in response to determining that a match exists, returning a rule identifier associated with the cached attribute identifier, wherein the rule identifier identifies the firewall rule; retrieving the firewall rule based on the rule identifier; determining if the application traffic parameters satisfy the conditions of the firewall rule based on one or more results from the policy lookup request; and in response to determining that the conditions are satisfied, performing the action.