Providing firewall rules for workload spread across multiple data centers

Patent metadata

Field	Value
Publication number	US-9806948-B2
Application number	US-201514811402-A
Country	US
Kind code	B2
Filing date	Jul 28, 2015
Priority date	Jun 30, 2015
Publication date	Oct 31, 2017
Grant date	Oct 31, 2017

Abstract

A method of replicating firewall rules for a tenant that has several data compute nodes across a group of data centers. The method receives a first set of firewall rules that references first and second sets of objects in a first data center. The first set of objects includes identifiers that are recognized by the network manager of the first data center. The second set of objects includes identifiers that are not recognized by the first network manager. The first set of objects is translated into a set of global objects by searching a local inventory of objects. The second set of objects is translated into a set of global objects by searching a global inventory of objects. The first set of firewall rules is translated into a second set of firewall rules by using the translated objects and is replicated to the network managers of every data center.

First claim

What is claimed is:

1. A method of replicating firewall rules for a tenant having a plurality of data compute nodes (DCNs) across a plurality of data centers, each data center comprising a set of hosts and a network manager, each host configured to host one or more DCNs, the method comprising:
receiving a first set of firewall rules referencing first and second sets of objects, each of the first set of objects comprising an identifier identifiable by a first network manager in a first data center, each of the second set of objects comprising an identifier not identifiable by the first network manager;
translating the first set of objects by searching a local inventory of objects, the local inventory of objects mapping the identifiers of the first set of objects into a first set of globally recognized identifiers that are identifiable by the network managers of the plurality of data centers;
translating the second set of objects by searching a global inventory of objects, the global inventory of objects mapping the identifiers of the second set of objects into a second set of globally recognized identifiers identifiable by the network managers of the plurality of data centers;
translating the first set of firewall rules into a second set of global firewall rules using the first and second sets of globally recognized identifiers; and
replicating the second set of global firewall rules to the network managers across the plurality of data centers,
wherein the first and second sets of identifiers comprise at least one of a static Internet protocol (IP) address and a media access control (MAC) address, wherein each global firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, and (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet.

2. The method of claim 1 , wherein the first and second sets of identifiers comprise one or more of an identifier of a virtual network interface card (VNIC), an identifier of a host, an identifier of a compute cluster, an identifier of a data center, and an identifier of a DCN that is unique across the plurality of data centers.

3. The method of claim 1 , wherein each global firewall rule further includes enforcement-node tuple.

4. The method of claim 1 , wherein the first set of objects comprise one or more of a compute construct, a network construct, and a security construct comprising an identifier recognized by the first network manager.

5. The method of claim 1 , wherein the second set of objects comprise one or more of a compute construct, a network construct, and a security construct comprising an identifier not recognized by the first network manager.

6. The method of claim 1 , wherein a DCN is a virtual machine.

7. A non-transitory machine readable medium storing a program that when executed by at least one processing unit replicates firewall rules for a tenant having a plurality of data compute nodes (DCNs) across a plurality of data centers, each data center comprising a set of hosts and a network manager, each host configured to host one or more DCNs, the program comprising sets of instructions for:
receiving a first set of firewall rules referencing first and second sets of objects, each of the first set of objects comprising an identifier identifiable by a first network manager in a first data center, each of the second set of objects comprising an identifier not identifiable by the first network manager;
translating the first set of objects by searching a local inventory of objects, the local inventory of objects mapping the identifiers of the first set of objects into a first set of globally recognized identifiers that are identifiable by the network managers of the plurality of data centers;
translating the second set of objects by searching a global inventory of objects, the global inventory of objects mapping the identifiers of the second set of objects into a second set of globally recognized identifiers identifiable by the network managers of the plurality of data centers;
translating the first set of firewall rules into a second set of global firewall rules using the first and second sets of globally recognized identifiers; and
replicating the second set of global firewall rules to the network managers across the plurality of data centers,
wherein the first and second sets of identifiers comprise at least one of a static Internet protocol (IP) address and a media access control (MAC) address, wherein each global firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, and (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet.

8. The non-transitory machine readable medium of claim 7 , wherein the first and second sets of identifiers comprise one or more of an identifier of a virtual network interface card (VNIC), an identifier of a host, an identifier of a compute cluster, an identifier of a data center, and an identifier of a DCN that is unique across the plurality of data centers.

9. The non-transitory machine readable medium of claim 7 , wherein each global firewall rule further includes enforcement-node tuple.

10. The non-transitory machine readable medium of claim 7 , wherein the first set of objects comprise one or more of a compute construct, a network construct, and a security construct comprising an identifier recognized by the first network manager.

11. The non-transitory machine readable medium of claim 7 , wherein the second set of objects comprise one or more of a compute construct, a network construct, and a security construct comprising an identifier not recognized by the first network manager.

12. The non-transitory machine readable medium of claim 7 , wherein a DCN is a virtual machine.

13. A system comprising:
a plurality of data centers, each data center comprising:
a network manager; and
a set of hosts configured to host a set of data compute nodes (DCN);
each network manager comprising:
a set of processing units; and
a non-transitory machine readable medium storing a program that when executed by at least one processing unit of the network manager replicates firewall rules for a tenant having a plurality of DCNs across the plurality of data centers, the program comprising sets of instructions for:
receiving a first set of firewall rules referencing first and second sets of objects, each of the first set of objects comprising an identifier identifiable by a first network manager in a first data center, each of the second set of objects comprising an identifier not identifiable by the first network manager;
translating the first set of objects by searching a local inventory of objects, the local inventory of objects mapping the identifiers of the first set of objects into a first set of globally recognized identifiers that are identifiable by the network managers of the plurality of data centers;
translating the second set of objects by searching a global inventory of objects, the global inventory of objects mapping the identifiers of the second set of objects into a second set of globally recognized identifiers identifiable by the network managers of the plurality of data centers;
translating the first set of firewall rules into a second set of global firewall rules using the first and second sets of globally recognized identifiers; and
replicating the second set of global firewall rules to the network managers across the plurali

Assignees

• Nicira Inc

Inventors

• Masurekar Uday
• Bansal Kaushal

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0218

  Distributed architectures, e.g. distributed firewalls · CPC title

• G06F17/30557

  Physics · mapped topic

• G06F17/30575

  Physics · mapped topic