Patent ID: 7917627

Claim:
An apparatus for providing security in a network environment, comprising: a network element operable to: receive a flow that propagates through an access gateway, the flow associated with an end user and propagating through a network, the flow communicating an accounting START indicator and an accounting STOP indicator, the accounting START indicator indicating that accounting has started, the accounting STOP indicator indicating that accounting has stopped; glean internet protocol (IP) address information from the flow, the IP address information comprising an IP address; determine from the accounting START indicator that the end user is being connected to the network; remove an outdated flow for the IP address from a table and insert the flow in place of the outdated flow in the table in response to the determination from the accounting START indicator; determine from the accounting STOP indicator that the end user is being disconnected from the network; and remove the flow from the table in response to the determination from the accounting STOP indicator such that the IP address information in the access gateway and the network element is synchronized independent of a connection request or a connection response, wherein the access gateway is a general packet radio gateway service (GPRS) support node (GGSN) and the network element is a firewall.