Global objects for federated firewall rule management

A non-transitory machine readable medium storing a program that when executed by at least one processing unit of a computer in a first datacenter defines and distributes firewall rules for a plurality of data compute nodes (DCNs) executing in a plurality of datacenters, the program comprising sets of instructions for:

• associating a unique identifier, for a DCN, in a second datacenter with a security tag, wherein the unique identifier for the DCN is a globally unique identifier across the first and second datacenters;
• defining a firewall rule with a reference to the security tag;
• and
• distributing the firewall rule with the reference to the security tag from the first datacenter to a network controller at the second datacenter,
• wherein the network controller at the second datacenter uses the security tag referenced by the distributed firewall rule to identify the unique identifier for the DCN, maps the unique DCN identifier to a local network address associated with the DCN at the second datacenter, uses the local network address to define a matching attribute of a local firewall rule, and defines an action of the distributed firewall rule as an action of the local firewall rule,
• wherein a firewall enforcing machine at the second datacenter uses the local firewall rule to process packets associated with the DCN in accordance with a firewall action specified by the local firewall rule.

A non-transitory machine readable medium storing a program that when executed by at least one processing unit of a computer in a first datacenter translates firewall rules for a set of data compute nodes (DCNs) operating in the first datacenter, the program comprising sets of instructions for:

• receiving, from a second datacenter, a distributed firewall rule that is defined with a reference to a security tag that is associated with a unique identifier for a DCN in the first datacenter, wherein the unique identifier for the DCN is a globally unique identifier across the first and second datacenters;
• and
• translating the distributed firewall rule by using the security tag referenced by the distributed firewall rule to identify the unique identifier for the DCN, mapping the unique DCN identifier to a local network address associated with the DCN at the first datacenter, using the local network address to define a matching attribute of a local firewall rule, and defining an action of the distributed firewall rule as an action of the local firewall rule,
• wherein a firewall enforcing machine at the first datacenter uses the local firewall rule to process packets associated with the DCN in accordance with a firewall action specified by the local firewall rule.