Patent ID: 8307422

Claim:
A network router comprising: a plurality of interfaces configured to send and receive packets for customer virtual private networks (VPNs), wherein the plurality of interfaces includes an interface to connect to a service provider network and one or more interfaces to connect to one or more customer networks; a firewall integrated within the network router, the firewall configured to apply stateful firewall services to the packets; a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network, wherein the control unit executes at least one multi-protocol label switched (MPLS) protocol to establish a plurality of MPLS label switched paths (LSPs) through the service provider network to carry the packets for the customer VPNs; a forwarding engine configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding engine comprising a switch fabric to forward the packets to the interfaces based on the selected next hops, wherein the forwarding engine includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the firewall for application of the stateful firewall services; and a user interface by which a user specifies one or more zones to be recognized by the firewall when applying the stateful firewall services to the packets, each of the zones defined by a list of one or more of the interfaces, wherein the user interface supports a syntax that allows the user to define the zones by specifying the customer VPNs within lists of interfaces associated with the zones, and wherein the user interface allows the user to specify one or more policies for the firewall with respect to the zones, wherein the control unit of the routing engine executes a network services protocol that programs the firewall with mapping information that specifies one or more MPLS labels for each of the MPLS LSPs and that maps the MPLS labels to the customer VPNs specified by the user interface, wherein the firewall applies the policies to the packets received from the service provider network having MPLS labels that match the MPLS labels specified within the mapping information programmed into the firewall by the network services protocol of the routing engine, and wherein the firewall applies the policies to the packets received from the customer networks that are destined to be forwarded by the routing device to the MPLS LSPs as MPLS packets.