The stateful cluster security gateway (CSG) architecture for robust switched Linux cluster security

This work presents a new cluster security model for securing switched Linux clusters. The stateful CSG improves upon the stateless CSG in the sense that it supports stateful firewalling, provides high availability, greater scalability and load balancing capability. This model combines various mechanisms like distributed sender-initiated Layer 2 per-packet firewall load balancing, firewall state synchronization, failover, MAC address takeover, Network Access Control using switch MAC ACLs and port security, and Layer 2 and Layer 3 packet filtering in order to provide robust, scalable and reliable cluster-level security. Experimental results of performance not only give an idea of the effectiveness of the new scheme at boosting firewall performance and reliability, but also at improving network performance and security. In addition, the response of the new scheme in the face of threats is assessed qualitatively and its salient characteristics like tamper resistance, anti-spoofing, anti-sniffing and low end-user host processing strain, are highlighted.