# US 11,310,277 B2 · Network policy migration in a federated hybrid cloud > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,277 B2 - Document ID: US11310277B2 - Status: Granted - Kind: B2 - Application number: 16/248,828 - Filed: 2019-01-16 - Published: 2020-02-20 - Granted: 2022-04-19 - Earliest claimed: 2018-08-20 - Assignees: VMware, Inc. - Applicants: Vmware, Inc. - Inventors: Bhaskar Subramanyam Annadata; Abhinav Vijay Bhagwat; Sachin Thakkar; Debashis Basak - Web page: https://patentgrep.com/patent/US11310277B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 9/4856: {resumption being on a different machine, e.g. task migration, virtual machine migration (G06F9/5088 takes precedence)} - G06F 9/5072: {Grid computing} - H04L 63/0263: {Rule management} - G06F 9/45545: {Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract One or more embodiments provide a firewall policy between a first virtual data center and a second virtual data center. A method includes: establishing a communication link between a first firewall server in the first virtual data center and a second firewall server in the second virtual data center over a network, the first firewall server having a first firewall defined by polices applied to groups of objects in the first virtual data center; obtaining, at the first firewall server, an inventory of objects in the second virtual data center from the second firewall server; determining firewall rule tuples by mapping the policies of the first firewall to groups of objects in the inventory of the second virtual data center; and sending the firewall rule tuples to enforcement points in the second virtual data center. ## Claims ### Claim 1 A method of migrating a firewall policy between a first virtual data center and a second virtual data center, comprising: establishing a communication link between a first firewall server in the first virtual data center and a second firewall server in the second virtual data center over a network, the first firewall server having a first firewall defined by policies applied to groups of objects in the first virtual data center; obtaining, at the first firewall server, an inventory of objects in the second virtual data center from the second firewall server; determining firewall rule tuples by mapping the policies of the first firewall to groups of objects in the inventory of the second virtual data center; sending the firewall rule tuples from the first firewall server to enforcement points in the second virtual data center; and sending the first firewall from the first firewall server to the second firewall server. ### Claim 2 (depends on 1) The method of claim 1, further comprising: setting the first firewall server as a master server; and setting the second firewall server as a slave server. ### Claim 3 (depends on 1) The method of claim 1, wherein at least a portion of the objects in the inventory of the second virtual data center are migrated from the first virtual data center, and wherein the method further comprises: obtaining migration information at the first firewall server from the second firewall server. ### Claim 4 (depends on 3) The method of claim 3, wherein the firewall rule tuples are further determined based on the migration information. ### Claim 5 (depends on 1) The method of claim 1, wherein the first firewall is defined by a plurality of policies dynamically applied to one or more objects of the groups of objects in the first virtual data center according to a membership of each of the one of more objects to a corresponding policy, and wherein the determining the firewall rule tuples further comprises removing the dynamic applicability of the plurality of policies to each of the one of more objects according to a corresponding membership. ### Claim 6 (depends on 1) The method of claim 1, further comprising: modifying the first firewall at the second firewall server to generate a second firewall. ### Claim 7 (depends on 1) The method of claim 1, further comprising: removing the communication link between the first and second firewall servers after sending the firewall rule tuples to the enforcement points in the second virtual data center. ### Claim 8 (depends on 1) The method of claim 1, further comprising sending the firewall rule tuples from the first firewall server to enforcement points in the first virtual data center, wherein the enforcement points in the first virtual data center are outside of the first firewall server, and wherein the enforcement points in the second virtual data center are outside of the second firewall server. ### Claim 9 A non-transitory computer readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method of migrating a firewall policy between a first virtual data center and a second virtual data center, the method comprising: establishing a communication link between a first firewall server in the first virtual data center and a second firewall server in the second virtual data center over a network, the first firewall server having a first firewall defined by policies applied to groups of objects in the first virtual data center; obtaining, at the first firewall server, an inventory of objects in the second virtual data center from the second firewall server; determining firewall rule tuples by mapping the policies of the first firewall to groups of objects in the inventory of the second virtual data center; sending the firewall rule tuples from the first firewall server to enforcement points in the second virtual data center; and sending the first firewall from the first firewall server to the second firewall server. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, the method further comprising: setting the first firewall server as a master server; and setting the second firewall server as a slave server. ### Claim 11 (depends on 9) The non-transitory computer readable medium of claim 9, wherein at least a portion of the objects in the inventory of the second virtual data center are migrated from the first virtual data center, and wherein the method further comprises: obtaining migration information at the first firewall server from the second firewall server. ### Claim 12 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the firewall rule tuples are further determined based on the migration information. ### Claim 13 (depends on 9) The non-transitory computer readable medium of claim 9, the method further comprising: modifying the first firewall at the second firewall server to generate a second firewall. ### Claim 14 (depends on 9) The non-transitory computer readable medium of claim 9, the method further comprising: removing the communication link between the first and second firewall servers after sending the firewall rule tuples to the enforcement points in the second virtual data center. ### Claim 15 A computing system, comprising: a first data center having a first firewall server and a first plurality of virtual machines; a second data center having a second firewall server and a second plurality of virtual machines migrated from the first data center, wherein the first firewall server is configured to: establish a communication link with the second firewall server over a network, the first firewall server having a first firewall defined by policies applied to groups of objects in the first data center; obtain an inventory of objects in the second data center from the second firewall server; determine firewall rule tuples by mapping the policies of the first firewall to groups of objects in the inventory of the second data center; send the firewall rule tuples from the first firewall server to enforcement points in the second data center; and send the first firewall from the first firewall server to the second firewall server. ### Claim 16 (depends on 15) The computing system of claim 15, wherein the first firewall server is a master server and the second firewall server is a slave server. ### Claim 17 (depends on 15) The computing system of claim 15, wherein the first firewall server is configured to obtain migration information from the second firewall server. ### Claim 18 (depends on 17) The computing system of claim 17, wherein the firewall rule tuples are further determined based on the migration information. ### Claim 19 (depends on 15) The computing system of claim 15, wherein the second firewall server is configured to modify the first firewall to generate a second firewall.