Method for data center network segmentation

A firewall management device for network segmentation of a data center, the data center comprising servers and firewalls of different types, a firewall management device to manage the firewalls, and a network configured to connect the servers using software-defined networking (SDN), the network being arranged in subnetworks, the different types including physical and virtual, the firewall management device comprising:

• a hardware processor to implement:
• logic to detect traffic over the network between two servers in different ones of the subnetworks from among the servers;
• logic to determine a type of each of the two servers;
• logic to, in response to a determination that the two server types are physical, use the SDN to direct the traffic through a physical one of the firewalls;
• logic to, in response to a determination that the two server types are virtual, use the SDN to direct the traffic through a virtual one of the firewalls;
• logic to, in response to a determination that the two servers comprise a physical server and a virtual server, with the traffic comprising the physical server sending information to the virtual server, use the SDN to direct the traffic through a physical one of the firewalls;
• and
• logic to, in response to a determination that the two server types comprise the physical server and the virtual server, with the traffic comprising the virtual server sending information to the physical server, use the SDN to direct the traffic through a virtual one of the firewalls, wherein at least one of:
• the firewalls comprise two or more physical firewalls, and the logic to direct the traffic through a physical one of the firewalls comprises logic to direct the traffic through a nearest one of the physical firewalls;
• and
• the firewalls comprise two or more virtual firewalls, and the logic to direct the traffic through a virtual one of the firewalls comprises logic to direct the traffic through a nearest one of the virtual firewalls.

A non-transitory computer-readable medium (CRM) storing instructions that, when executed on a computer processor of a firewall management device, cause the firewall management device to carry out a process for network segmentation of a data center, the data center comprising servers and firewalls of different types, a firewall management device to manage the firewalls, and a network configured to connect the servers using software-defined networking (SDN), the network being arranged in subnetworks, the different types including physical and virtual, the process comprising:

• detecting traffic over the network between two servers in different ones of the subnetworks from among the servers;
• determining a type of each of the two servers;
• in response to a determination that the two server types are physical, using the SDN to direct the traffic through a physical one of the firewalls;
• in response to a determination that the two server types are virtual, using the SDN to direct the traffic through a virtual one of the firewalls;
• in response to a determination that the two servers comprise a physical server and a virtual server, with the traffic comprising the physical server sending information to the virtual server, using the SDN to direct the traffic through a physical one of the firewalls;
• and
• in response to a determination that the two servers comprise the physical server and the virtual server, with the traffic comprising the virtual server sending information to the physical server, using the SDN to direct the traffic through a virtual one of the firewalls, wherein at least one of:
• the firewalls comprise two or more physical firewalls, and wherein the firewall management device directs the traffic through a physical one of the firewalls by directing the traffic through a nearest one of the physical firewalls;
• and
• the firewalls comprise two or more virtual firewalls, and wherein the firewall management device directs the traffic through a virtual one of the firewalls by directing the traffic through a nearest one of the virtual firewalls.