Using headerspace analysis to identify unneeded distributed firewall rules
AssigneeNicira, Inc.
InventorsAmar Padmanabhan, Amre Shakimov, Anupam Chanda
Life of this patent
Estimating the term…
Abstract
Some embodiments provide a method for identifying unnecessary firewall rules for a distributed firewall of a logical network. The method identifies a firewall policy for network traffic of the logical network. The firewall policy includes a set of firewall rules. The method generates a set of data for implementing the firewall policy on a set of managed forwarding elements that implement the logical network. The method analyzes potential network traffic based on the generated set of data to identify a subset of unnecessary data. The method identifies a subset of unnecessary firewall rules of the set of firewall rules that corresponds to the subset of unnecessary data.
Claims20
A method for identifying unnecessary firewall rules for a distributed firewall of a logical network, the method comprising:
- identifying a firewall policy for network traffic of the logical network, the firewall policy comprising a set of firewall rules;
- generating a set of data for implementing the firewall policy on a set of managed forwarding elements that implement the logical network;
- simulating a set of potential network traffic that would be processed by the managed forwarding elements while implementing the logical network by generating representations of packet headers of the potential network traffic;
- analyzing the representations of the packet headers of the potential network traffic based on the generated set of data to identify a subset of unnecessary data;
- and
- identifying a subset of unnecessary firewall rules of the set of firewall rules that corresponds to the subset of unnecessary data.
A non-transitory machine readable medium storing a program which when executed by at least one processing unit identifies unnecessary firewall rules for a distributed firewall of a logical network, the program comprising sets of instructions for:
- identifying a firewall policy for network traffic of the logical network, the firewall policy comprising a set of firewall rules;
- generating a set of data for implementing the firewall policy on a set of managed forwarding elements that implement the logical network;
- simulating a set of potential network traffic that would be processed by the managed forwarding elements while implementing the logical network by generating representations of packet headers of the potential network traffic;
- analyzing the representations of the packet headers of the potential network traffic based on the generated set of data to identify a subset of unnecessary data;
- and
- identifying a subset of unnecessary firewall rules of the set of firewall rules that corresponds to the subset of unnecessary data.
Dependencies are inferred from the claim text.