# US 11,115,382 B2 · Global objects for federated firewall rule management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,382 B2 - Document ID: US11115382B2 - Status: Granted - Kind: B2 - Application number: 15/197,652 - Filed: 2016-06-29 - Published: 2017-01-05 - Granted: 2021-09-07 - Earliest claimed: 2015-06-30 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Kaushal Bansal; Uday Masurekar - Web page: https://patentgrep.com/patent/US11115382B2 ## CPC - H04L 63/0263: {Rule management} - G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 12/0813: with a network or matrix configuration - G06F 16/25: Integrating or interfacing systems involving database management systems - G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor - H04L 41/0846: {based on copy from other elements} - H04L 41/0894: Policy-based network configuration management - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/1001: for accessing one among a plurality of replicated servers - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - H04L 67/5682: Policies or rules for updating, deleting or replacing the stored data - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2212/154: Networked environment - G06F 2212/60: Details of cache memory - G06F 2212/62: Details of cache specific to multiprocessor cache arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method of defining distributed firewall rules in a group of datacenters is provided. Each datacenter includes a group of data compute nodes (DCNs). The method sends a set of security tags from a particular datacenter to other datacenters. The method, at each datacenter, associates a unique identifier of one or more DCNs of the datacenter to each security tag. The method associates one or more security tags to each of a set of security group at the particular datacenter and defines a set of distributed firewall rules at the particular datacenter based on the security tags. The method sends the set of distributed firewall rules from the particular datacenter to other datacenters. The method, at each datacenter, translates the firewall rules by mapping the unique identifier of each DCN in a distributed firewall rule to a corresponding static address associated with the DCN. ## Claims ### Claim 1 A method of defining and distributing firewall rules for a plurality of data compute nodes (DCNs) executing in a set of two or more datacenters, the method comprising: at a first datacenter: associating a unique identifier, for a DCN in a second datacenter, with a security tag, wherein the unique identifier for the DCN is a globally unique identifier across the first and second datacenters; defining a firewall rule with a reference to the security tag; and distributing the firewall rule with the reference to the security tag from the first datacenter to a network controller at the second datacenter, wherein the network controller at the second datacenter uses the security tag referenced by the distributed firewall rule to identify the unique identifier for the DCN, maps the unique DCN identifier to a local network address associated with the DCN at the second datacenter, uses the local network address to define a matching attribute of a local firewall rule, and defines an action of the distributed firewall rule as an action of the local firewall rule, wherein a firewall enforcing machine at the second datacenter uses the local firewall rule to process packets associated with the DCN in accordance with a firewall action specified by the local firewall rule. ### Claim 2 (depends on 1) The method of claim 1 further comprising: associating the security tag with a security group, wherein the reference to the security tag is a reference to the security group associated with the security tag. ### Claim 3 (depends on 1) The method of claim 1, wherein even after the DCN moves from the second datacenter to a third datacenter in the set of datacenters, the unique identifier does not change for the DCN. ### Claim 4 (depends on 1) The method of claim 1, wherein the unique identifier of the DCN is a universally unique identifier (UUID) of the DCN. ### Claim 5 (depends on 1) The method of claim 1, wherein the network address associated with the DCN comprises one of a layer 2 (L2) network address associated with the DCN and a layer 3 (L3) network address associated with the DCN. ### Claim 6 (depends on 5) The method of claim 5, wherein the L2 network address associated with the DCN is a media access control (MAC) address, wherein the L3 network address associated with the DCN is an Internet protocol (IP) address. ### Claim 7 (depends on 1) The method of claim 1, wherein the distributed firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet, and (iii) an enforcement-node tuple that includes the unique identifier. ### Claim 8 (depends on 1) The method of claim 1 further comprising sending a definition of the security tag from the first datacenter to the network controller of the second datacenter to use to identify the unique identifier for the DCN using the security tag. ### Claim 9 A non-transitory machine readable medium storing a program that when executed by at least one processing unit of a computer in a first datacenter defines and distributes firewall rules for a plurality of data compute nodes (DCNs) executing in a plurality of datacenters, the program comprising sets of instructions for: associating a unique identifier, for a DCN, in a second datacenter with a security tag, wherein the unique identifier for the DCN is a globally unique identifier across the first and second datacenters; defining a firewall rule with a reference to the security tag; and distributing the firewall rule with the reference to the security tag from the first datacenter to a network controller at the second datacenter, wherein the network controller at the second datacenter uses the security tag referenced by the distributed firewall rule to identify the unique identifier for the DCN, maps the unique DCN identifier to a local network address associated with the DCN at the second datacenter, uses the local network address to define a matching attribute of a local firewall rule, and defines an action of the distributed firewall rule as an action of the local firewall rule, wherein a firewall enforcing machine at the second datacenter uses the local firewall rule to process packets associated with the DCN in accordance with a firewall action specified by the local firewall rule. ### Claim 10 (depends on 9) The non-transitory machine readable medium of claim 9, the program further comprising sets of instructions for: associating the security tag with a security group, wherein the reference to the security tag is a reference to the security group associated with the security tag. ### Claim 11 (depends on 9) The non-transitory machine readable medium of claim 9, wherein even after the DCN moves from the second datacenter to a third datacenter, the unique identifier does not change for the DCN. ### Claim 12 (depends on 9) The non-transitory machine readable medium of claim 9, wherein the unique identifier of the DCN is a universally unique identifier (UUID) of the DCN. ### Claim 13 (depends on 9) The non-transitory machine readable medium of claim 9, wherein the network address associated with the DCN comprises one of a layer 2 (L2) network address associated with the DCN and a layer 3 (L3) network address associated with the DCN. ### Claim 14 (depends on 13) The non-transitory machine readable medium of claim 13, wherein the L2 network address associated with the DCN is a media access control (MAC) address, wherein the L3 network address associated with the DCN is an Internet protocol (IP) address. ### Claim 15 (depends on 9) The non-transitory machine readable medium of claim 9, wherein the distributed firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet, and (iii) an enforcement-node tuple that includes the unique identifier. ### Claim 16 A non-transitory machine readable medium storing a program that when executed by at least one processing unit of a computer in a first datacenter translates firewall rules for a set of data compute nodes (DCNs) operating in the first datacenter, the program comprising sets of instructions for: receiving, from a second datacenter, a distributed firewall rule that is defined with a reference to a security tag that is associated with a unique identifier for a DCN in the first datacenter, wherein the unique identifier for the DCN is a globally unique identifier across the first and second datacenters; and translating the distributed firewall rule by using the security tag referenced by the distributed firewall rule to identify the unique identifier for the DCN, mapping the unique DCN identifier to a local network address associated with the DCN at the first datacenter, using the local network address to define a matching attribute of a local firewall rule, and defining an action of the distributed firewall rule as an action of the local firewall rule, wherein a firewall enforcing machine at the first datacenter uses the local firewall rule to process packets associated with the DCN in accordance with a firewall action specified by the local firewall rule. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, wherein: the security tag is associated with a security group at the particular datacenter; and the reference to the security tag is a reference to the security group associated with the security tag. ### Claim 18 (depends on 16) The non-transitory machine readable medium of claim 16, wherein even after the DCN moves from the first datacenter to a third datacenter, the unique identifier does not change for the DCN. ### Claim 19 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the unique identifier of the DCN is a universally unique identifier (UUID) of the DCN. ### Claim 20 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the network address associated with the DCN comprises one of a layer 2 (L2) network address associated with the DCN and a layer 3 (L3) network address associated with the DCN. ### Claim 21 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the distributed firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet, and (iii) an enforcement-node tuple that includes the unique identifier.