Providing application visibility for micro-segmentation of a network deployment

Patent metadata

Field	Value
Publication number	US-10567440-B2
Application number	US-201615381123-A
Country	US
Kind code	B2
Filing date	Dec 16, 2016
Priority date	Dec 16, 2016
Publication date	Feb 18, 2020
Grant date	Feb 18, 2020

Abstract

A method of creating micro-segmentation policies for a network is provided. The method identifies a set of network nodes as seed nodes. The method monitors network packet traffic flows for the seed nodes to collect traffic flow information. The method identifies a set of related nodes for the set of seed nodes based on the collected network flow information. The method analyzes the collected network flow information to identify micro-segmentation policies for the network.

First claim

What is claimed is:

1. A method of creating micro-segmentation policies for traffic flowing between compute nodes that execute distributed applications in a network, the method comprising:
through a user interface, receiving a selection of a subset of the compute nodes as seed nodes, wherein each seed node is a node for a different distributed application;
monitoring network packet traffic flows for the set of selected seed nodes bar performing deep packet inspection (DPI) to collect network traffic flow information;
analyzing the collected network flow information to identify, for each respective seed node of the selected seed nodes, a set of one or more nodes related to the respective seed node; and
for each respective selected seed node and the set of nodes related to the respective seed node, generating micro-segmentation policies for managing network packet traffic flows for the application executed by the respective seed node and the set of nodes related to the respective seed node.

2. The method of claim 1 , wherein identifying the set of one or more related nodes for a particular seed node comprises:
identifying a set of source nodes and a set of destination nodes for network packet traffic flows of the particular seed node; and
identifying the set of related nodes for the particular seed node from the set of source nodes and the set of destination nodes.

3. The method of claim 1 , wherein analyzing the collected network flow information comprises identifying a direction for packets of the monitored network packet traffic flows relative to a particular selected seed node, wherein the direction comprises at least one of incoming traffic and exiting traffic.

4. The method of claim 1 , wherein generating micro-segmentation policies comprises generating a set of firewall rules based on the analyzed network flow information.

5. The method of claim 1 , wherein analyzing the collected network flow information comprises identifying a set of security groups for the set of selected seed nodes, wherein the micro-segmentation policies are defined based on the security groups.

6. The method of claim 1 further comprising:
providing the identified micro-segmentation policies in the user interface for review;
receiving an approval for the generated micro-segmentation policies through the user interface; and
publishing the approved micro-segmentation polices into a rule table for enforcement at a set of network enforcement points.

7. The method of claim 1 , wherein analyzing the collected network flow information to identify the set of one or more related nodes for each seed node of the set of selected seed nodes comprises generating a connectivity graph depicting traffic entering and exiting the set of seed nodes, wherein the connectivity graph is displayed in the user interface to indicate how the seed nodes and the sets of related nodes communicate with each other.

8. The method of claim 1 , wherein analyzing the collected network traffic flow information comprises:
performing reverse translation on the collected network traffic flow information; and
providing the reverse translated network traffic flow information to a user via the user interface.

9. A non-transitory machine readable medium storing a program which when executed by at least one processing unit creates micro-segmentation policies for traffic flowing between compute nodes that execute distributed applications in a network, the program comprising sets of instructions for:
through a user interface, receiving a selection of a subset of the compute nodes as seed nodes, wherein each seed node is a node for a different distributed application;
monitoring network packet traffic flows for the set of selected seed nodes by performing deep packet inspection (DPI) to collect network traffic flow information;
analyzing the collected network flow information to identify, for each respective seed node of the selected seed nodes, a set of one or more nodes related to the respective seed node; and
for each respective selected seed node and the set of nodes related to the respective seed node, generating micro-segmentation policies for managing network packet traffic flows for the application executed by the respective seed node and the set of nodes related to the respective seed node.

10. The non-transitory computer readable medium of claim 9 , wherein the set of instructions for receiving the selection of the seed nodes comprises sets of instructions for:
providing a plurality of compute nodes available for selection as seed nodes in the user interface; and
receiving the selection as a selection of a subset of the plurality of available compute nodes.

11. The non-transitory computer readable medium of claim 9 , wherein the set of instructions for identifying the set of one or more related nodes for a particular seed node comprises sets of instructions for:
identifying a set of source nodes and a set of destination nodes for network packet traffic flows of the particular seed node; and
identifying the set of related nodes for the particular seed node from the set of source nodes and the set of destination nodes.

12. The non-transitory computer readable medium of claim 9 , wherein the program further comprises a set of instructions for monitoring network packet traffic flows for the set of seed nodes and the sets of related nodes for each seed node of the set of seed nodes to collect additional network flow information.

13. The non-transitory computer readable medium of claim 9 , wherein the set of instructions for analyzing the collected network flow information comprises a set of instructions for identifying a direction for packets of the monitored network packet traffic flows relative to a particular seed node, wherein the direction comprises at least one of incoming traffic and exiting traffic.

14. The non-transitory computer readable medium of claim 9 , wherein the set of instructions for generating micro-segmentation policies comprises a set of instructions for generating a set of firewall rules based on the analyzed network flow information.

15. The non-transitory computer readable medium of claim 9 , wherein the set of instructions for analyzing the collected network flow information comprises a set of instructions for identifying a set of security groups for the set of selected seed nodes, wherein the micro-segmentation policies are defined based on the security groups.

16. The non-transitory computer readable medium of claim 9 , the program further comprising sets of instructions for:
providing the identified micro-segmentation policies in the user interface for review;
receiving an approval for the generated micro-segmentation policies through the user interface; and
publishing the approved micro-segmentation polices into a rule table for enforcement at a set of network enforcement points.

17. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for analyzing the collected network flow information to identify the set of one or more related nodes for each seed node of the set of selected seed nodes comprises a set of instructions for generating a connectivity graph depicting traffic entering and exiting the set of seed nodes, wherein the connectivity graph is displayed in the user interface to indicate how the seed nodes and the sets of related nodes communicate with each other.

18. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for analyzing the collected network traffic flow information comprises sets of

Assignees

• Nicira Inc

Inventors

• Bansal Kaushal
• Sengupta Anirban
• Manuguri Subrahmanyam
• Krishna Sunitha
• Pereira Jerry

Classifications

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L67/38

  Electricity · mapped topic

• H04L41/12

  Discovery or management of network topologies · CPC title