Firewall configured with dynamic membership sets representing machine attributes
AssigneeVMware, Inc.
InventorsDebashis Basak, Rohit Toshniwal, Allwyn Sequeira
Life of this patent
Estimating the term…
Abstract
A method is provided to control the flow of packets within a system that includes one or more computer networks comprising: policy rules are provided that set forth attribute dependent conditions for communications among machines on the one or more networks; machine attributes and corresponding machine identifiers are obtained for respective machines on the networks; and policy rules are transformed to firewall rules that include machine identifiers of machines having attributes from among the obtained machine attributes that satisfy the attribute dependent policy rules.
Claims20
A method for implementing a distributed firewall on a host running a plurality of endpoints and a firewall manager, wherein an endpoint of the plurality of endpoints is associated with a virtual machine (VM), wherein the VM has a plurality of attributes and an endpoint identifier associated therewith, and wherein the firewall manager monitors updates to attributes of the VM, the method comprising:
- monitoring, by the firewall manager, communications to and from the VM according to a set of firewall rules that are based on the plurality of attributes of the VM, the set of firewall rules comprising a first set of firewall rules and a second set of firewall rules;
- determining, by the firewall manager, that an attribute of the plurality of attributes of the VM has been updated;
- identifying, by the firewall manager, a policy rule that includes the updated attribute within a condition of the policy rule;
- and
- using the endpoint identifier to transform, by the firewall manager, the identified policy rule to one or more new firewall rules, enabling the one or more new firewall rules to be applied to communications to and from the endpoint, the one or more new firewall rules comprising a third set of firewall rules that are not included in the set of firewall rules.
One or more computer-readable media having computer-executable instructions for implementing a distributed firewall on a host running a plurality of endpoints and a firewall manager, wherein an endpoint of the plurality of endpoints is associated with a virtual machine (VM), wherein the VM has a plurality of attributes and endpoint identifier associated therewith, and wherein the firewall manager monitors updates to attributes of the VM, the computer-executable instructions causing one or more processors to perform operations comprising:
- monitoring communications to and from the VM according to a set of firewall rules that are based on the plurality of attributes of the VM, the set of firewall rules comprising a first set of firewall rules and a second set of firewall rules;
- determining that an attribute of the plurality of attributes of the VM has been updated;
- identifying a policy rule that includes the updated attribute within a condition of the policy rule;
- and
- using the endpoint identifier to transform the identified policy rule to one or more new firewall rules, enabling the one or more new firewall rules to be applied to communications to and from the endpoint, the one or more new firewall rules comprising a third set of firewall rules that are not included in the set of firewall rules.
A computer system, wherein system software for the computer system is programmed to execute a method for implementing a distributed firewall, the computer system comprising:
- a memory storing policy rules;
- a host running a plurality of endpoints, wherein an endpoint of the plurality of endpoints is associated with a virtual machine (VM), wherein the VM has a plurality of attributes and an endpoint identifier associated therewith;
- a firewall manager running on the host, the firewall manager configured to:
- monitor communications to and from the VM according to firewall rules that are based on the plurality of attributes of the VM, the firewall rules comprising a first set of firewall rules and a second set of firewall rules;
- determine that an attribute of the plurality of attributes of the VM has been updated;
- identify a policy rule stored in the memory includes the updated attribute within a condition of the policy rule;
- and
- use the endpoint identifier to transform the identified policy rule to one or more new firewall rules to the endpoint, enabling the one or more new firewall rules to be applied to communications to and from the endpoint, the one or more new firewall rules comprising a third set of firewall rules that are not included in the set of firewall rules.
Dependencies are inferred from the claim text.