Configuration of logical networking entities

#In software-defined networking (SDN), a network management and control system may have different types of users that provide configuration information to configure the network. The system will often have various different types of configurable entities, with certain entities only available for one of the other types of users to configure. However, the configuration of a first entity that is under the purview of a first type of user might affect entities that are under the purview of a second user that is not allowed to configure the first entity. As such, solutions that enable the first user to affect the first entity without direct access to that entity would be useful.

#Some embodiments provide a method for resolving conflicting configuration settings for logical network entities that pushes the determination of effective configuration for these entities down to the host computers that implement the logical network entities. Specifically, as a result of different ways of receiving configuration data for a logical network entity, a particular entity (e.g., a logical switch, logical port, etc.) may have two or more conflicting configuration settings that need to be resolved. Rather than performing the computation of the actual configuration setting to use for numerous logical entities at a central bottleneck (e.g., a network manager and/or network controller), some embodiments distribute the conflicting configuration settings and their sources to the host computers that implement the logical network entities (e.g., to local controllers executing on these host computers).

#In some embodiments, a network management and control system enables users (e.g., network administrators, security administrators, etc.) to modify configuration settings for entities of a logical network. The logical network may include various entities, such as logical forwarding elements (e.g., logical switches and logical routers), logical ports, network endpoints (e.g., virtual machines (VMs), containers, and/or other data compute nodes (DCNs)), etc. These logical forwarding elements are implemented across one or more datacenters by managed forwarding elements, such as software forwarding elements that execute on host computers (e.g., in virtualization software executing on the host computers).

#The novel features of the invention are set forth in the appended claims. However, for purpose of explanation, several embodiments of the invention are set forth in the following figures.

#FIG. 1 conceptually illustrates a network manager of some embodiments that receives configuration data from users, stores this configuration data, and provides the configuration data to host computers.

#FIG. 2 conceptually illustrates a portion of the security configuration data of some embodiments.

#In the following detailed description of the invention, numerous details, examples, and embodiments of the invention are set forth and described. However, it will be clear and apparent to one skilled in the art that the invention is not limited to the embodiments set forth and that the invention may be practiced without some of the specific details and examples discussed.

#Some embodiments provide a method for resolving conflicting configuration settings for logical network entities that pushes the determination of effective configuration for these logical network entities down to the host computers that implement the entities. Specifically, as a result of different ways of a network management and control system receiving configuration data for the logical network entities, a particular entity (e.g., a logical switch, logical port, etc.) may have two or more conflicting configuration settings that need to be resolved. Rather than performing the computation of the actual configuration setting to use for numerous logical entities at a central bottleneck (e.g., a network manager and/or network controller), some embodiments distribute the conflicting configuration settings and their sources to the host computers that implement the logical network entities (e.g., to local controllers executing on these host computers).

#In some embodiments, a network management and control system enables users (e.g., network administrators, security administrators, etc.) to modify configuration settings for entities of a logical network. The logical network may include various entities, such as logical forwarding elements (e.g., logical switches and logical routers), logical ports, network endpoints (e.g., virtual machines (VMs), containers, and/or other data compute nodes (DCNs), etc. These logical forwarding elements are implemented across one or more datacenters by managed forwarding elements, such as software forwarding elements that execute on host computers (e.g., in virtualization software executing on the host computers).