Context-aware distributed firewall
AssigneeNicira, Inc.
InventorsJingmin Zhou, Anirban Sengupta
Life of this patent
Estimating the term…
Abstract
A context-aware distributed firewall scheme is provided. A firewall engine tasked to provide firewall protection for a set of network addresses applies a reduced set of firewall rules that are relevant to the set of addresses associated with the machine. A hypervisor implements a search structure that allows each virtual machine's filter to quickly identify relevant rules from all of the received rules. The search structure is constructed as a binary prefix tree, each node corresponding to an IP CIDR (Classless Inter-Domain Routing) block. A query for relevant rules traverses nodes of the search structure according to a queried IP address and collect all rules that are associated with the traversed nodes.
Claims21
1-21. (canceled)
A computing device serving as a host machine operating a plurality of data compute nodes (DCNs), the computing device comprising:
- a set of processing units;
- and
- a non-transitory machine readable medium storing a program for execution by at least one processing unit, the program comprising sets of instructions for:
- receiving, from a network manager computer, a plurality of sets of firewall rules corresponding to a plurality of DCNs executed by the host machine, wherein each set of firewall rules comprises firewall rules identified as relevant to a corresponding particular DCN in the plurality of DCNs, the relevant firewall rules for a particular DCN comprising firewall rules that specify either a source or destination address that matches an address of the particular DCN;
- and
- performing firewall operations on packets to or from each of the plurality of DCNs by examining the corresponding set of firewall rules.
A non-transitory machine readable medium storing a program for execution by at least one processing unit of a computing device serving as a host machine operating a plurality of data compute nodes (DCNs), the program comprising sets of instructions for:
- receiving, from a network manager computer, a plurality of sets of firewall rules corresponding to a plurality of DCNs executed by the host machine, wherein each set of firewall rules comprises firewall rules identified as relevant to a corresponding particular DCN in the plurality of DCNs, the relevant firewall rules for a particular DCN comprising firewall rules that specify either a source or destination address that matches an address of the particular DCN;
- and
- performing firewall operations on packets to or from each of the plurality of DCNs by examining the corresponding set of firewall rules.
Dependencies are inferred from the claim text.