Migrating firewall connection state for a firewall service virtual machine

A firewall rule processing apparatus for a host that executes a plurality of guest virtual machines (GVMs), the apparatus comprising:

• a firewall service virtual machine (SVM) executing on the host for processing firewall rules;
• a firewall process executing on the host for sending sets of attributes of GVM packets to the firewall SVM to process the firewall rules and for storing connection state data regarding the actions that the firewall SVM returns for each sent set of packet attributes;
• and
• an SVM interface (SVMI) through which the SVM and firewall process communicate, and through which the SVM configures the firewall process to gather connection state data for a GVM that migrates from the host to another host.

A method of migrating firewall connection state data as a guest virtual machine (GVM) migrates from a first host computing device to a second host computing device, the first and second hosts executing respectively first and second firewall service virtual machines (SVMs), each SVM performing firewall rule processing for one or more of the GVMs executing on the SVM's host, the method comprising:

• receiving indication that a particular GVM is migrating from the first host to the second host;
• gathering connection state data relating to the first SVM's firewall rule processing for the particular GVM;
• and
• transferring the gathered connection state data to the second host, wherein the transferred, gathered connection state data allows the second SVM to process packets from the migrated particular GVM without losing the connection state data that the first SVM generated for the particular GVM before the GVM's migration.