Scalable policy management for virtual networks
AssigneeJuniper Networks, Inc.
InventorsPrasad Miriyala, Anish Mehta
Life of this patent
Estimating the term…
Abstract
Techniques are disclosed for implementing scalable policies across a plurality of categories that support application workloads. In one example, a policy controller assigns to the plurality of categories tags specifying one or more of a plurality of dimensions. The policy controller distributes a plurality of policies to policy agents for the plurality of categories. Each policy includes one or more policy rules, and each policy rule includes one or more tags specifying one or more of the plurality of dimensions. For each policy rule, the policy agents allow or deny a traffic flow between objects that belong to categories of the plurality of categories described by the one or more dimensions of a respective tag of the policy rule.
Claims26
A method comprising:
- assigning, by a policy controller and to a plurality of categories that support application workloads, tags specifying one or more dimensions of a plurality of dimensions for the application workloads, wherein the application workloads are executed by one or more computing devices, and wherein the one or more computing devices include the plurality of categories;
- and
- distributing, by the policy controller and to respective policy agents of the one or more computing devices, a plurality of policies, wherein each policy of the plurality of policies includes one or more policy rules, wherein each policy rule of the one or more policy rules specifies one or more tags specifying one or more dimensions of the plurality of dimensions, and wherein each policy rule of the one or more policy rules causes the respective policy agents to allow or deny a traffic flow between objects that belong to categories of the plurality of categories described by the one or more dimensions of a tag of the policy rule.
A method comprising:
- receiving, by a policy agent for one or more computing devices and from a policy controller, a plurality of policies, wherein each policy of the plurality of policies includes one or more policy rules, and wherein each policy rule of the one or more policy rules specifies one or more tags specifying one or more dimensions of a plurality of dimensions;
- and
- for each policy rule of the one or more policy rules, allowing or denying, by the policy agent, a traffic flow between objects that belong to categories of the plurality of categories described by the one or more dimensions of a tag of the policy rule, wherein the plurality of categories support application workloads and are assigned tags specifying one or more dimensions of a plurality of dimensions for the application workloads, wherein the application workloads are executed by the one or more computing devices, and wherein the one or more computing devices include the plurality of categories.
A policy controller configured to:
- assign, to a plurality of categories that support application workloads, tags specifying one or more dimensions of a plurality of dimensions for the application workloads, wherein the application workloads are executed by one or more computing devices, and wherein the one or more computing devices include the plurality of categories;
- and
- distribute, to respective policy agents of the one or more computing devices, a plurality of policies, wherein each policy of the plurality of policies includes one or more policy rules, wherein each policy rule of the one or more policy rules specifies one or more tags specifying one or more dimensions of the plurality of dimensions, and wherein each policy rule of the one or more policy rules causes the respective policy agents to allow or deny a traffic flow between objects that belong to categories of the plurality of categories described by the one or more dimensions of a tag of the policy rule.
A policy agent for one or more computing devices, configured to:
- receive, from a policy controller, a plurality of policies, wherein each policy of the plurality of policies includes one or more policy rules, and wherein each policy rule of the one or more policy rules specifies one or more tags specifying one or more dimensions of a plurality of dimensions;
- and
- for each policy rule of the one or more policy rules, allow or deny a traffic flow between objects that belong to categories of the plurality of categories described by the one or more dimensions of a tag of the policy rule, wherein the plurality of categories support application workloads and are assigned tags specifying one or more dimensions of a plurality of dimensions for the application workloads, wherein the application workloads are executed by the one or more computing devices, and wherein the one or more computing devices include the plurality of categories.
Dependencies are inferred from the claim text.