Patent ID: 8001279

Claim:
A method of synchronizing firewalls in a communication system; said method comprising steps of: a) determining, upon receiving a packet for a connection at a secondary interface firewall, whether a connection state of the received packet is incompatible with an expected state based on a current state of the connection on the secondary interface firewall; b) determining, upon receiving the packet at the secondary interface firewall whether the packet corresponds to a new connection for which standard firewall processing has been completed by a firewall other than the secondary interface firewall; c) in response to a determination that the packet corresponds to a new connection or that the state of the received packet is incompatible, initializing, in the secondary interface firewall, a synchronization message exchange specific to the received packet with a primary interface firewall to retrieve from the primary interface firewall state information necessary for the secondary interface firewall to process the packet, and d) in response to the received packet, registering by the primary interface firewall a connection state in a common connection table maintained by the primary interface firewall that said connection goes through only if said connection is new or if said connection state has changed, the registering enabling any firewall in a firewall community that includes the primary interface firewall and the secondary interface firewall to process a subsequent packet received for the connection, wherein the communication system comprises a server farm connected to an Internet network by an Internet front-end including at least an Internet access router, said server farm comprising at least two customer cabinets with each customer cabinet including at least a WEB server and server farm resources enabling users connected to the Internet network to access the WEB servers in said customer cabinets, and at least two firewalls for controlling communication between users and one of said WEB servers, said firewalls using a Virtual Router Redundancy Protocol (VRRP) to set up as the primary interface firewall a firewall which owns the primary interface of the VRRP group of interfaces to at least one customer cabinet, wherein the synchronizing allows the primary interface firewall and the secondary interface firewall to control the communication concurrently.