Location criteria for security groups
AssigneeVMware, Inc.
InventorsBhagyashree Gujar, Ujwala Kawalay, Prayas Gaurav
Life of this patent
Estimating the term…
Abstract
Some embodiments provide a method for distributing a group definition for a group of machines. The method receives the group definition, which includes (i) a span of the group that specifies a set of sites at which the group is to be used and (ii) a set of criteria for machines to be included in the group. The set of criteria includes at least a location criteria specifying one or more sites. The method distributes the group definition to each site in the set of sites. At each site in the set of sites, a local network control system of the site determines a set of machines in the group based on the set of criteria. Only machines in the one or more sites specified by the location criteria are determined to be in the group.
Claims21
A method for distributing a group definition for a group of machines, the method comprising:
- receiving the group definition comprising (i) a span of the group that specifies a set of sites at which the group is to be used and (ii) a set of criteria for machines to be included in the group, the set of criteria comprising at least a location criteria specifying one or more sites, wherein each site is a different datacenter comprising a respective plurality of computing devices for hosting the machines;
- and
- distributing the group definition to each site in the set of sites,
- wherein at each site in the set of sites a local network control system of the site determines a set of machines in the group based on the set of criteria and provides the determined set of machines in the group to a set of computing devices that enforce security rules that use the group, wherein only machines in the one or more sites specified by the location criteria are determined to be in the group, wherein the group is used to define security rules that are enforced by computing devices at sites that belong to the set of sites including at least one site that is not in the one or more sites specified by the location criteria.
A non-transitory machine readable medium storing a program which when executed by at least one processing unit distributes a group definition for a group of machines, the program comprising sets of instructions for:
- receiving the group definition comprising (i) a span of the group that specifies a set of sites at which the group is to be used and (ii) a set of criteria for machines to be included in the group, the set of criteria comprising at least a location criteria specifying one or more sites, wherein each site is a different datacenter comprising a respective plurality of computing devices for hosting the machines;
- and
- distributing the group definition to each site in the set of sites,
- wherein at each site in the set of sites a local network control system of the site determines a set of machines in the group based on the set of criteria and provides the determined set of machines in the group to a set of computing devices that enforce security rules that use the group, wherein only machines in the one or more sites specified by the location criteria are determined to be in the group, wherein the group is used in security rules that are enforced by computing devices at sites that belong to the set of sites including at least one site that is not in the one or more sites specified by the location criteria.
Dependencies are inferred from the claim text.