Patent ID: 8316435

Claim:
A network router comprising: a plurality of interfaces configured to send and receive packets; a firewall integrated within the network router, the firewall configured to provide a plurality of virtual security systems to apply stateful firewall services to the packets, each of the virtual security systems represents a logically partitioned firewall instance; a routing engine comprising hardware that executes a routing protocol to maintain separate routing information for each of the virtual security systems, the routing information for each of the virtual security systems specifying routes through a network, wherein the protocols include at least one protocol to establish virtual private network (VPN) tunnels for one or more customer VPNs for at least one of the virtual security systems; a forwarding engine configured by the routing engine to select next hops for the packets in accordance with the routing information for each of the virtual security systems, the forwarding engine comprising a switch fabric to forward the packets to the interfaces based on the selected next hops, wherein the forwarding engine includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the firewall for application of the stateful firewall services; a user interface by which a user defines one or more zones to be recognized by the firewall when applying stateful firewall services to the packets, wherein the user interface supports a syntax that allows the user to define the zones by specifying the customer VPNs as interfaces associated with the zones, wherein the routing engine executes a network services protocol that communicates mapping information between the routing engine and the firewall, wherein for each of the virtual security systems the mapping information associates VPN labels for VPN tunnels with the customer VPNs for that virtual security system as specified by the user interface, and wherein for VPN tunnels for which the network router operates as an egress label switched router, the mapping information associates inner VPN labels affixed to packets received from the VPN tunnels by the interface cards with respective ones of the customer VPNs for the different virtual security systems.