# US 10,320,749 B2 · Firewall rule creation in a virtualized computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,749 B2 - Document ID: US10320749B2 - Status: Granted - Kind: B2 - Application number: 15/344,591 - Filed: 2016-11-07 - Published: 2018-05-10 - Granted: 2019-06-11 - Earliest claimed: 2016-11-07 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Anirban Sengupta; Sunitha Krishna; Subrahmanyam Manuguri - Web page: https://patentgrep.com/patent/US10320749B2 ## CPC - H04L 63/0263: {Rule management} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0245: {Filtering by information in the payload} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Example methods are provided for a network management entity to perform firewall rule creation in a virtualized computing environment. The method may comprise obtaining flow data associated with an application-layer protocol session between a first endpoint and a second endpoint in the virtualized computing environment; and identifying, from the flow data, an association between a control flow and at least one data flow of the application-layer protocol session. The method may also comprise: based on the association, creating a firewall rule that is applicable to both the control flow and at least one data flow; and instructing a first firewall engine associated with the first endpoint, or a second firewall engine associated with the second endpoint, or both, to apply the firewall rule during the application-layer protocol session. ## Claims ### Claim 1 A method for a network management entity to perform firewall rule creation in a virtualized computing environment that includes the network management entity, a first endpoint and a second endpoint, wherein the method comprises: obtaining flow data associated with an application-layer protocol session between the first endpoint and second endpoint; identifying, from the flow data, an association between a control flow and at least one data flow of the application-layer protocol session; based on the association, creating a firewall rule that is applicable to both the control flow and at least one data flow; and instructing a first firewall engine associated with the first endpoint, or a second firewall engine associated with the second endpoint, or both, to apply the firewall rule during the application-layer protocol session, wherein the first firewall engine, or the second firewall engine, or both processes packets in response to the instructing to apply the firewall rule. ### Claim 2 (depends on 1) The method of claim 1, wherein creating the firewall rule comprises: creating the firewall rule based on the control flow, while ignoring the at least one data flow during firewall rule creation. ### Claim 3 (depends on 2) The method of claim 2, wherein creating the firewall rule comprises: creating the firewall rule to allow communication via a control port number associated with the control flow, wherein at least one ephemeral data port number is dynamically negotiated for the respective at least one data flow through the control flow. ### Claim 4 (depends on 3) The method of claim 3, wherein creating the firewall rule comprises: creating the firewall rule to specify an application-layer protocol for which application-layer gateway (ALG) processing is supported by the first firewall engine, the second firewall engine, or both, wherein the ALG processing is to allow communication via the at least one ephemeral data port number based on the firewall rule. ### Claim 5 (depends on 1) The method of claim 1, wherein identifying the association comprises: traversing a tree structure in the flow data to identify the association based on a parent node and at least one child node linked to the parent node, wherein the parent node represents the control flow and the at least one child node represents respective at least one data flow. ### Claim 6 (depends on 1) The method of claim 1, wherein obtaining the flow data comprises: obtaining the tree structure from the first firewall engine, the second firewall engine, or both. ### Claim 7 (depends on 1) The method of claim 1, wherein obtaining the flow data comprises: obtaining the flow data associated with the application-layer protocol session that utilizes one of the following application-layer protocols: File Transfer Protocol (FTP), Remote Procedure Call (RPC), Common Internet File System (CIFS), Transparent Network Substrate (TNS) and Trivial File Transfer Protocol (TFTP). ### Claim 8 A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a network management entity, cause the processor to perform a method of firewall rule creation in a virtualized computing environment that includes the network management entity, a first endpoint and a second endpoint, wherein the method comprises: obtaining flow data associated with an application-layer protocol session between the first endpoint and second endpoint; identifying, from the flow data, an association between a control flow and at least one data flow of the application-layer protocol session; based on the association, creating a firewall rule that is applicable to both the control flow and at least one data flow; and instructing a first firewall engine associated with the first endpoint, or a second firewall engine associated with the second endpoint, or both, to apply the firewall rule during the application-layer protocol session, wherein the first firewall engine, or the second firewall engine, or both processes packets in response to the instructing to apply the firewall rule. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein creating the firewall rule comprises: creating the firewall rule based on the control flow, while ignoring the at least one data flow during firewall rule creation. ### Claim 10 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein creating the firewall rule comprises: creating the firewall rule to allow communication via a control port number associated with the control flow, wherein at least one ephemeral data port number is dynamically negotiated for the respective at least one data flow through the control flow. ### Claim 11 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein creating the firewall rule comprises: creating the firewall rule to specify an application-layer protocol for which application-layer gateway (ALG) processing is supported by the first firewall engine, the second firewall engine, or both, wherein the ALG processing is to allow communication via the at least one ephemeral data port number based on the firewall rule. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein identifying the association comprises: traversing a tree structure in the flow data to identify the association based on a parent node and at least one child node linked to the parent node, wherein the parent node represents the control flow and the at least one child node represents respective at least one data flow. ### Claim 13 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein obtaining the flow data comprises: obtaining the tree structure from the first firewall engine, the second firewall engine, or both. ### Claim 14 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein obtaining the flow data comprises: obtaining the flow data associated with the application-layer protocol session that utilizes one of the following application-layer protocols: File Transfer Protocol (FTP), Remote Procedure Call (RPC), Common Internet File System (CIFS), Transparent Network Substrate (TNS) and Trivial File Transfer Protocol (TFTP). ### Claim 15 A computer system configured to perform firewall rule creation in a virtualized computing environment, the computer system comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to: obtain flow data associated with an application-layer protocol session between a first endpoint and a second endpoint in the virtualized computing environment; identify, from the flow data, an association between a control flow and at least one data flow of the application-layer protocol session; based on the association, create a firewall rule that is applicable to both the control flow and at least one data flow; and instruct a first firewall engine associated with the first endpoint, or a second firewall engine associated with the second endpoint, or both, to apply the firewall rule during the application-layer protocol session, wherein the first firewall engine, or the second firewall engine, or both processes packets in response to the processor instructing to apply the firewall rule. ### Claim 16 (depends on 15) The computer system of claim 15, wherein instructions for creating the firewall rule cause the processor to: create the firewall rule based on the control flow, while ignoring the at least one data flow during firewall rule creation. ### Claim 17 (depends on 16) The computer system of claim 16, wherein instructions for creating the firewall rule cause the processor to: create the firewall rule to allow communication via a control port number associated with the control flow, wherein at least one ephemeral data port number is dynamically negotiated for the respective at least one data flow through the control flow. ### Claim 18 (depends on 17) The computer system of claim 17, wherein instructions for creating the firewall rule cause the processor to: create the firewall rule to specify an application-layer protocol for which application-layer gateway (ALG) processing is supported by the first firewall engine, the second firewall engine, or both, wherein the ALG processing is to allow communication via the at least one ephemeral data port number based on the firewall rule. ### Claim 19 (depends on 15) The computer system of claim 15, wherein instructions for identifying the association cause the processor to: traverse a tree structure in the flow data to identify the association based on a parent node and at least one child node linked to the parent node, wherein the parent node represents the control flow and the at least one child node represents respective at least one data flow. ### Claim 20 (depends on 15) The computer system of claim 15, wherein instructions for obtaining the flow data cause the processor to: obtain the tree structure from the first firewall engine, the second firewall engine, or both. ### Claim 21 (depends on 15) The computer system of claim 15, wherein instructions for obtaining the flow data cause the processor to: obtain the flow data associated with the application-layer protocol session that utilizes one of the following application-layer protocols: File Transfer Protocol (FTP), Remote Procedure Call (RPC), Common Internet File System (CIFS), Transparent Network Substrate (TNS) and Trivial File Transfer Protocol (TFTP).