Zone-Based Firewall Policy Model for a Virtualized Data Center

An apparatus comprising:

• one or more virtual interfaces;
• and
• a processor configured to:
• store a set of zone rules that define a security zone having a zone name, the security zone being applicable to each of a plurality of virtual machines (VMs) that satisfy a set of conditions, including VM attributes, specified by the zone rules;
• generate a zone-based virtual firewall policy that applies to the VMs in the security zone, the zone-based virtual firewall policy having a set of one or matching criteria that when met allow an action to be performed with respect to inter-zone traffic, the matching criteria including the zone name such that the security zone itself is part of the zone-based virtual firewall policy;
• associate incoming inter-zone traffic with the security zone based on the incoming inter-zone traffic satisfying the set of the conditions of the zone rules of the security zone;
• and
• allow the action to be performed with respect to the inter-zone traffic associated with the security zone in response to determining that the inter-zone traffic satisfies the matching criteria of the zone-based virtual firewall policy.

One or more non-transitory computer readable media storing instructions that, when executed by a processor, cause the processor to:

• store a set of zone rules that define a security zone having a zone name, the security zone being applicable to each of a plurality of virtual machines (VMs) that satisfy a set of conditions, including VM attributes, specified by the zone rules;
• generate a zone-based virtual firewall policy that applies to the VMs in the security zone, the zone-based virtual firewall policy having a set of one or matching criteria that when met allow an action to be performed with respect to inter-zone traffic, the matching criteria including the zone name such that the security zone itself is part of the zone-based virtual firewall policy;
• associate incoming inter-zone traffic with the security zone based on the incoming inter-zone traffic satisfying the set of the conditions of the zone rules of the security zone;
• and
• allow the action to be performed with respect to the inter-zone traffic associated with the security zone in response to determining that the inter-zone traffic satisfies the matching criteria of the zone-based virtual firewall policy.