Patent ID: 8079073

Claim:
A method of providing firewall services in a local area network having a plurality of devices comprising: determining firewall service capabilities published by each of a first device and a second device in the local area network, the first device and the second device each coupled to a downstream side of a router in the local area network, the router configured to receive traffic destined for the first device and the second device; determining that the firewall service capabilities published by the second device do not meet a firewall service requirement for the second device in the local area network; determining that the firewall service capabilities published by the first device meet a firewall service requirement for the first device in the local area network and meet the firewall service requirement for the second device in the local area network; configuring, by a controller, the router in the local area network to direct traffic destined for the second device to the first device over a first logical connection when the traffic destined for the second device is received by the router from an external network and to direct traffic destined for the second device to the second device over a second logical connection when the traffic destined for the second device is received by the router from the first device in the local area network; and implementing, by the controller, a distributed firewall system including the first device and the second device in the local area network by configuring the first device to provide firewall service for itself to meet the firewall service requirement for the first device and to provide firewall service for the second device to meet the firewall service requirement for the second device according to the firewall service capabilities published by the first device, wherein the first device is configured to: filter traffic directed to the first device by the router over the first logical connection according to the firewall service requirement for the first device when the traffic is destined for the first device, filter traffic directed to the first device by the router over the first logical connection according to the firewall service requirement for the second device when the traffic is destined for the second device, re-address the filtered traffic filtered according to the firewall service requirement for the second device to the second device, and transmit the traffic re-addressed to the second device to the router for delivery to the second device over the second logical connection.