Internet protocol flow data including firewall rules

Patent metadata

Field	Value
Publication number	US-10938726-B2
Application number	US-201715697409-A
Country	US
Kind code	B2
Filing date	Sep 6, 2017
Priority date	Sep 6, 2017
Publication date	Mar 2, 2021
Grant date	Mar 2, 2021

Abstract

For a network including multiple host machines that together implement at least one logical network including a firewall, some embodiments provide a method for collecting traffic flow data that includes identifiers for firewall rules applied to the traffic flow and a logical entity identifier. In some embodiments, the host machines receive traffic monitoring configuration data for a logical network. The traffic monitoring configuration data in some embodiments indicates a set of logical entities of the logical network for which to collect traffic flow data and a set of traffic flow data collectors associated with the set of logical entities. The indicated logical entities may be logical forwarding elements (logical switches, routers, etc.) or logical ports of logical forwarding elements.

First claim

We claim:

1. A method for collecting traffic flow data relating to logical ports of a logical forwarding element (LFE) of a logical network, the LFE spanning a plurality of host machines in a physical network and the logical network comprising a logical firewall for processing data messages received at the logical ports, the method comprising:
at a first host machine in the plurality of host machines that, along with at least one other host machine in the plurality of host machines, implements the LFE:
receiving traffic monitoring configuration data for the logical network indicating (i) a set of logical ports of the LFE for which to collect traffic flow data and (ii) a set of traffic flow data collectors associated with the set of logical ports;
collecting data regarding a data message received at a particular logical port in the set of logical ports, the collected data comprising an identifier of a firewall rule applied to the data message at the first host machine; and
exporting the collected data to at least one traffic flow data collector in the set of traffic flow data collectors in order to generate statistics from the collected data for the particular logical port, the generated statistics for analysis and display.

2. The method of claim 1 , wherein the particular logical port is a first logical port, the logical network is a first logical network, the LFE is a first LFE, the first host machine, along with at least a second host machine in the plurality of host machines, is spanned by a second LFE of a second logical network, the set of logical ports is a first set of logical ports, the set of traffic flow data collectors is a first set of traffic flow data collectors, the data message is a first data message, and the applied firewall rule is a first applied firewall rule, the method further comprising:
at the first host machine that, along with at least the second host machine, implements the second LFE:
receiving traffic monitoring configuration data for the second logical network indicating (i) a second set of logical ports of the second LFE for which to collect traffic flow data and (ii) a second set of traffic flow data collectors associated with the second set of logical ports;
collecting data regarding a second data message received at a second logical port in the second set of logical ports, the collected data regarding the second data message comprising an identifier for a second firewall rule applied to the second data message at the first host machine; and
exporting the collected data regarding the second data message to at least one traffic flow data collector in the second set of traffic flow data collectors for analysis and display.

3. The method of claim 1 , wherein the particular logical port is a first logical port, the set of traffic flow data collectors is a first set of traffic flow data collectors, the set of logical ports is a first set of logical ports, the LFE is a first LFE, the logical network comprises a second LFE that spans the first host machine and at least a second host machine in the plurality of host machines, the traffic monitoring configuration data is first traffic configuration data, the data message is a first data message, and the applied firewall rule is a first applied firewall rule, the method further comprising:
at the first host machine that, along with at least the second host machine, implements the second LFE:
receiving second traffic monitoring configuration data comprising (i) a second set of logical ports of the second LFE for which to collect traffic flow data and (ii) a second set of traffic flow data collectors associated with the second set of logical ports;
collecting data regarding a second data message received at a second logical port in the second set of logical ports, the collected data regarding the second data message comprising an identifier of a second firewall rule applied to the second data message at the first host machine; and
exporting the collected data regarding the second data message to at least one traffic flow data collector in the second set of traffic flow data collectors for analysis and display, the second set of flow collectors being different from the first set of flow collectors to balance a load among the sets of collectors.

4. The method of claim 1 , wherein the traffic monitoring configuration data is received from a controller computer that (1) identifies that the span of the LFE of the logical network includes the first host machine, (2) identifies the set of logical ports of the LFE for which traffic flow data should be collected, (3) identifies the set of traffic flow data collectors associated with the set of logical ports and (4) generates the traffic monitoring configuration data for the first host machine.

5. The method of claim 1 , wherein the set of logical ports is indicated by indicating the LFE in the logical network to which the set of logical ports belongs.

6. The method of claim 1 , wherein the logical firewall of the logical network comprises a plurality of logical firewall rule sections, each firewall section comprising a set of logical firewall rules that applies to a group of logical ports, and the set of logical ports is a particular group of logical ports to which a particular logical firewall rule section applies.

7. The method of claim 1 , wherein
a local control plane of the first host machine receives the traffic monitoring configuration data, collects the data regarding the data message received at the particular logical port in the set of logical ports, and exports the collected data to the at least one traffic flow data collector in the set of traffic flow data collectors; and
a managed forwarding element (MFE) executing on the first host machine implements the LFE along with at least one other MFE executing on the at least one other host machine, applies the firewall rule, and provides the data regarding the data message received at the particular logical port in the set of logical ports to the local control plane.

8. The method of claim 1 , wherein
the traffic flow data is exported in internet protocol flow information export (IPFIX) format; and
the set of traffic flow data collectors is a set of IPFIX collectors.

9. The method of claim 1 , wherein exporting the collected data comprises populating a set of fields based on the collected data, the set of fields defined by a particular template in a plurality of templates for exporting collected data.

10. The method of claim 1 , wherein host machines in the plurality of host machines execute at least two different types of hypervisors and the set of traffic flow data collectors receive collected data from at least two host machines executing different types of hypervisors.

11. The method of claim 1 , wherein each logical firewall rule of a set of logical firewall rules applied by the logical firewall specifies the particular logical port in the set of logical ports as a matching parameter for the firewall rule.

12. The method of claim 1 , wherein
the LFE is a logical router and the particular logical port is a port of the logical router that connects to a logical switch, and
the logical router and the logical switch (i) each span the plurality of host machines and (ii) are each implemented by a plurality of managed forwarding elements executing on the plurality of host machines.

13. A non-transitory machine readable medium storing a program for execution by a set of processing units of a first host machine in a plurality of host machines in a physical network, the program for collecting traffic flow data relating to logical ports of a logical forwarding element (LFE) of a lo

Assignees

• Nicira Inc

Inventors

• Lu Russell
• Qi Xin
• Shah Shadab
• Krishna Sunitha
• Zhu Yangyang
• Manuguri Subrahmanyam
• Koganty Raju

Classifications

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L43/026

  using flow identification · CPC title

• H04L43/12

  Network monitoring probes · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L47/2441 Primary

  relying on flow classification, e.g. using integrated services [IntServ] · CPC title