Flow-based forwarding element configuration

A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of flow-based forwarding element configuration in a network environment that includes the computer system, a flow-based forwarding element, and a group of workloads, wherein the method comprises:

• obtaining a set of security policies associated with the group of workloads, wherein the set of security policies allows communication between a destination and a first workload from the group, but blocks communication between the destination and a second workload from the group;
• based on the set of security policies, identifying an allowed forwarding path between the destination and the first workload;
• configuring a whitelist set of flow entries that:
• includes a first flow entry that specifies match fields and a first action to allow communication over the allowed forwarding path, but
• excludes flow entries, associated with actions to block communications between the destination and the workloads, such that a second flow entry, which specifies a second action to block communication over a forbidden forwarding path between the destination and the second workload, is absent in the whitelist set and so communication between the destination and the second workload is automatically blocked due to the second flow entry being absent in the whitelist set,
• wherein the flow entries included in the whitelist set are non-hierarchical and are configured based on the set of security policies prior to packet detection, and wherein the match fields include transport layer information and network layer information;
• and
• sending configuration information to the flow-based forwarding element to cause the flow-based forwarding element to apply the whitelist set to:
• in response to detecting a first packet that is addressed from the first workload to the destination and that matches with the match fields specified by the first flow entry, perform the first action to forward the first packet to the destination;
• and
• in response to detecting a second packet that is addressed from the second workload to the destination and that does not match with any flow entry in the whitelist set, drop the second packet.

A computer system configured to perform flow-based forwarding element configuration in a network environment that includes the computer system, a flow-based forwarding element, and a group of workloads, the computer system comprising:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that, in response to execution by the processor, cause the processor to:
• obtain a set of security policies associated with the group of workloads, wherein the set of security policies allows communication between a destination and a first workload from the group, but blocks communication between the destination and a second workload from the group;
• based on the set of security policies, identify an allowed forwarding path between the destination and the first workload;
• configure a whitelist set of flow entries that:
• includes a first flow entry that specifies match fields and a first action to allow communication over the allowed forwarding path, but
• excludes flow entries, associated with actions to block communications between the destination and the workloads, such that a second flow entry, which specifies a second action to block communication over a forbidden forwarding path between the destination and the second workload, is absent in the whitelist set and so communication between the destination and the second workload is automatically blocked due to the second flow entry being absent in the whitelist set,
• wherein the flow entries included in the whitelist set are non-hierarchical and are configured based on the set of security policies prior to packet detection, and wherein the match fields include transport layer information and network layer information;
• and
• send configuration information to the flow-based forwarding element to cause the flow-based forwarding element to apply the whitelist set to:
• in response to detecting a first packet that is addressed from the first workload to the destination and that matches with the match fields specified by the first flow entry, perform the first action to forward the first packet to the destination;
• and
• in response to detecting a second packet that is addressed from the second workload to the destination and that does not match with any flow entry in the whitelist set, drop the second packet.