防火墙系统高可用性研究

从系统可用性的一般定义出发，提出了防火墙可用性包括两个方面：一是“时间可用性”，其衡量防火墙工作的持续性；二是“能力可用性”，其衡量防火墙提供规定功能、性能的能力。并通过形式化数学方法对防火墙可用性进行了描述。之后进一步对由两台或两台以上防火墙构成的防火墙系统的高可用性进行了定义，并对提高防火墙系统高可用性的两种解决方案进行了定量分析和比较，结果表明“并联冗余”解决方案适用于对时间可用性要求特别高的应用场合，“旁联冗余”解决方案适用于对时间可用性要求比较高的应用场合，从而为解决适用于不同网络应用环境的防火墙系统高可用性问题提供了可行的理论依据和工程方法。

Research on High Availability of Firewall System

This paper devotes a systematic research on the availability of firewall based on the genaral availability definition of system, puts forward the opinion that availability of firewall should include two aspects, one is called time availability which evaluates the running persistence of firewall, another is called capacity availability which assesses the ability that firewall provides the stated function and performance. The paper also describes the availability of firewall through mathematical formal methods, afterwards defines the high availability of firewall system which is composed of two(or more) firewalls, and quantitatively analyzes and compares the two solutions that can enhance the high availability of firewall system, the results indicate that parallel connection redundancy solution may be applicable in situations where the availability is especially demanding and bypass connection redundancy solution may be applicable in situations where the availability demands is more important, which consequently provides a feasible theoretical basis and engineering method to resolve the problem of firewall system high availability that can be applied in different network application situations.