Network policy migration to a public cloud

Patent metadata

Field	Value
Publication number	US-11184397-B2
Application number	US-201916248824-A
Country	US
Kind code	B2
Filing date	Jan 16, 2019
Priority date	Aug 20, 2018
Publication date	Nov 23, 2021
Grant date	Nov 23, 2021

Abstract

An example method of migrating a firewall policy between a first virtual data center and a second virtual data center includes: generating a static firewall from a firewall document at a first firewall server in the first virtual data center, the firewall document defining polices applied to groups of objects in the first virtual data center, the static firewall including firewall rule tuples; sending the static firewall from the first firewall server to a second firewall server in the second virtual data center; migrating a plurality of virtual machines (VMs) from the first virtual data center to the second virtual data center; and importing the firewall document from the first firewall server to the second firewall server by mapping the policies of the first firewall to groups of objects in an inventory of the second virtual data center.

First claim

What is claimed is:

1. A method of migrating a firewall policy between a first virtual data center and a second virtual data center, comprising:
generating a static firewall from a firewall document at a first firewall server in the first virtual data center, the firewall document defining a plurality of policies dynamically applied to one or more objects of a plurality of objects in the first virtual data center according to a membership of each of the one of more objects to a corresponding policy, wherein generating the static firewall comprises removing the dynamic applicability of the plurality of policies to each of the one of more objects according to a corresponding membership, the static firewall including firewall rule tuples, wherein:
the first virtual data center comprises:
a first plurality of host machines;
a first plurality of virtual machines (VMs) running on the first plurality of host machines;
a first gateway configured to provide the first plurality of VMs with connectivity to an external network outside of the first virtual data center; and
a first virtualized infrastructure manager for the first virtual data center; and

the second virtual data center comprises:
a second plurality of host machines;
a second plurality of VMs running on the second plurality of host machines;
a second gateway configured to provide the second plurality of VMs with connectivity to the external network outside of the second virtual data center; and
a second virtualized infrastructure manager for the second virtual data center;

sending the static firewall from the first firewall server to a second firewall server in the second virtual data center;
migrating one or more VMs from the first virtual data center to the second virtual data center;
importing the firewall document from the first firewall server to the second firewall server by mapping the policies defined by the firewall document to groups of objects in an inventory of the second virtual data center; and
replacing the static firewall with the imported firewall document at the second firewall server, the imported firewall document defining the plurality of policies dynamically applied to the groups of objects in the inventory of the second virtual data center.

2. The method of claim 1 , wherein the step of generating the static firewall comprises exporting the firewall document into a machine-readable format.

3. The method of claim 2 , wherein the step of sending the static firewall comprises exporting the static firewall into the machine-readable format.

4. The method of claim 1 , further comprising:
receiving a change to the firewall document; and
modifying the static firewall by adding, editing, or removing one or more firewall rule tuples in response to the change.

5. The method of claim 1 , further comprising obtaining migration information at the first firewall server from the second firewall server, wherein the policies defined by the firewall document are mapped to the groups of objects in the inventory of the second virtual data center based on the migration information.

6. The method of claim 1 , further comprising:
receiving a manual mapping from an administrator; and
adding the manual mapping when importing the firewall document from the first firewall server to the second firewall server.

7. The method of claim 1 , wherein mapping the policies defined by the firewall document to groups of objects in the inventory of the second virtual data center further comprises mapping a name of a container to a name in the first firewall document.

8. The method of claim 7 , wherein the container is a logical container of one or more pre-configured virtual machines that package applications and parameters that define operational details of the package.

9. A non-transitory computer-readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method of migrating a firewall policy between a first virtual data center and a second virtual data center, comprising:
generating a static firewall from a firewall document at a first firewall server in the first virtual data center, the firewall document defining a plurality of policies dynamically applied to one or more objects of a plurality of objects in the first virtual data center according to a membership of each of the one of more objects to a corresponding policy, wherein generating the static firewall comprises removing the dynamic applicability of the plurality of policies to each of the one of more objects according to a corresponding membership, the static firewall including firewall rule tuples, wherein:
the first virtual data center comprises:
a first plurality of host machines;
a first plurality of virtual machines (VMs) running on the first plurality of host machines;
a first gateway configured to provide the first plurality of VMs with connectivity to an external network outside of the first virtual data center; and
a first virtualized infrastructure manager for the first virtual data center; and

the second virtual data center comprises:
a second plurality of host machines;
a second plurality of VMs running on the second plurality of host machines;
a second gateway configured to provide the second plurality of VMs with connectivity to the external network outside of the second virtual data center; and
a second virtualized infrastructure manager for the second virtual data center;

sending the static firewall from the first firewall server to a second firewall server in the second virtual data center;
migrating one or more VMs from the first virtual data center to the second virtual data center;
importing the firewall document from the first firewall server to the second firewall server by mapping the policies defined by the firewall document to groups of objects in an inventory of the second virtual data center; and
replacing the static firewall with the imported firewall document at the second firewall server, the imported firewall document defining the plurality of policies dynamically applied to the groups of objects in the inventory of the second virtual data center.

10. The non-transitory computer-readable medium of claim 9 , wherein the step of generating the static firewall comprises exporting the firewall document into a machine-readable format.

11. The non-transitory computer-readable medium of claim 10 , wherein the step of sending the static firewall comprises exporting the static firewall into the machine-readable format.

12. The non-transitory computer-readable medium of claim 9 , further comprising:
receiving a change to the firewall document; and
modifying the static firewall by adding, editing, or removing one or more firewall rule tuples in response to the change.

13. The non-transitory computer-readable medium of claim 9 , further comprising obtaining migration information at the first firewall server from the second firewall server, wherein the policies defined by the firewall document are mapped to the groups of objects in the inventory of the second virtual data center based on the migration information.

14. The non-transitory computer-readable medium of claim 9 , further comprising:
receiving a manual mapping from an administrator; and
adding the manual mapping when importing the firewall document from the first firewall server to the second firewall server.

15. A computing system, comprising:
a first virtual data center comprising:
a first plurality of host machines;
a first plurality of virtual machines (VMs) running on the first plurality of host machines;
a fi

Assignees

• Vmware Inc

Inventors

• Annadata Bhaskar Subramanyam
• Bhagwat Abhinav Vijay
• Thakkar Sachin
• Basak Debashis
• Maskalik Serge

Classifications

• H04L63/0263 Primary

  Rule management · CPC title

• G06F9/4856

  resumption being on a different machine, e.g. task migration, virtual machine migration (G06F9/5088 takes precedence) · CPC title

• G06F9/5072

  Grid computing · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title