Firewall rules for application connectivity

Patent metadata

Field	Value
Publication number	US-11757940-B2
Application number	US-202017103706-A
Country	US
Kind code	B2
Filing date	Nov 24, 2020
Priority date	Sep 28, 2020
Publication date	Sep 12, 2023
Grant date	Sep 12, 2023

Abstract

Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifies a requirement that the application receive data traffic from sources external to the virtual infrastructure. Based on the application definition, the method defines a first set of firewall rules for the application that indicate conditions for allowing data traffic from sources external to the virtual infrastructure. For an existing second set of higher-level firewall rules for data traffic entering and exiting the virtual infrastructure, the method specifies a new firewall rule that directs a network element implementing the sets of firewall rules to apply the first set of firewall rules to any data traffic that is from sources external to the virtual infrastructure and directed to the application.

First claim

We claim:

1. For a network management and control system that manages a virtual infrastructure deployed across a set of datacenters, a method comprising:
receiving a definition of an application to be deployed in the virtual infrastructure, the application definition specifying a requirement that the application receive data traffic from sources external to the virtual infrastructure;
based on the application definition:
defining a first set of firewall rules for the application that indicate conditions for allowing data traffic from sources external to the virtual infrastructure; and
specifying a new firewall rule that directs a network element, which enforces a second set of firewall rules for data traffic entering and exiting the virtual infrastructure, to examine the first set of firewall rules before the second set of firewall rules for any data traffic that is (i) from sources external to the virtual infrastructure and (ii) directed to the application.

2. The method of claim 1 , wherein the network element that enforces the second set of firewall rules is an edge device implementing a logical network gateway.

3. The method of claim 2 , wherein the edge device implements a centralized routing component of a tier-0 logical router, wherein the first set of firewall rules and the second set of firewall rules are associated with the centralized routing component.

4. The method of claim 1 , wherein the first set of firewall rules and the second set of firewall rules comprise distributed firewall rules.

5. The method of claim 1 , wherein the data traffic directed to the application comprises data traffic directed to a particular set of network addresses associated with the application.

6. The method of claim 1 , wherein the data traffic directed to the application comprises data traffic directed to a particular set of transport layer ports associated with the application.

7. The method of claim 1 , wherein the conditions for allowing data traffic from sources external to the virtual infrastructure comprises allowing any data traffic from sources external to the virtual infrastructure.

8. The method of claim 1 , wherein the conditions for allowing data traffic from sources external to the virtual infrastructure comprises allowing data traffic from a particular set of network addresses.

9. The method of claim 1 , wherein defining the first set of firewall rules comprises:
defining a first firewall rule that allows data traffic meeting specified conditions for data traffic to the application from sources external to the virtual infrastructure; and
defining a second firewall rule that denies data traffic directed to the application from sources external to the virtual infrastructure that does not meet the specified conditions.

10. The method of claim 1 further comprising, based on the application definition, defining a third set of firewall rules for allowing a first set of data compute nodes (DCNs) that implement the application to access a second set of DCNs in the virtual infrastructure.

11. The method of claim 10 , wherein the second set of DCNs do not implement the application but are accessible to a plurality of different applications implemented in the virtual infrastructure.

12. The method of claim 1 , wherein the second set of firewall rules are associated with a particular security zone in the virtual infrastructure for DCNs that receive data traffic from external sources.

13. The method of claim 1 , wherein the second set of firewall rules have a higher priority than the first set of firewall rules.

14. The method of claim 1 , wherein the new firewall rule directs the network element to skip the second set of firewall rules for any data traffic that is (i) from sources external to the virtual infrastructure and (ii) directed to the application.

15. A non-transitory machine-readable medium storing a network manager program which when executed by at least one processing unit manages a virtual infrastructure deployed across a set of datacenters, the network manager program comprising sets of instructions for:
receiving a definition of an application to be deployed in the virtual infrastructure, the application definition specifying a requirement that the application receive data traffic from sources external to the virtual infrastructure;
based on the application definition:
defining a first set of firewall rules for the application that indicate conditions for allowing data traffic from sources external to the virtual infrastructure; and
specifying a new firewall rule that directs a network element, which enforces a second set of firewall rules for data traffic entering and exiting the virtual infrastructure, to examine the first set of firewall rules before the second set of firewall rules for any data traffic that is (i) from sources external to the virtual infrastructure and (ii) directed to the application.

16. The non-transitory machine-readable medium of claim 15 , wherein:
the network element that enforces the second set of firewall rules is an edge device implementing a centralized routing component of a tier-0 logical router; and
the first set of firewall rules and the second set of firewall rules are associated with the centralized routing component.

17. The non-transitory machine-readable medium of claim 15 , wherein the conditions for allowing data traffic from sources external to the virtual infrastructure comprises allowing any data traffic from sources external to the virtual infrastructure.

18. The non-transitory machine-readable medium of claim 15 , wherein the conditions for allowing data traffic from sources external to the virtual infrastructure comprises allowing data traffic from a particular set of network addresses.

19. The non-transitory machine-readable medium of claim 15 , wherein the set of instructions for defining the first set of firewall rules comprises sets of instructions for:
defining a first firewall rule that allows data traffic meeting specified conditions for data traffic to the application from sources external to the virtual infrastructure; and
defining a second firewall rule that denies data traffic directed to the application from sources external to the virtual infrastructure that does not meet the specified conditions.

20. The non-transitory machine-readable medium of claim 15 , wherein the network manager program further comprises a set of instructions for, based on the application definition, defining a third set of firewall rules for allowing a first set of data compute nodes (DCNs) that implement the application to access a second set of DCNs in the virtual infrastructure.

21. The non-transitory machine-readable medium of claim 15 , wherein the new firewall rule directs the network element to skip the second set of firewall rules for any data traffic that is (i) from sources external to the virtual infrastructure and (ii) directed to the application.

Assignees

• Vmware Inc

Inventors

• Vaidya Sachin Mohan
• Kumar Kausum
• Jain Jayant
• Shah Shadab
• Sengupta Anirban

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L41/0803 Primary

  Configuration setting · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title