Context-aware distributed firewall
AssigneeNicira, Inc.
InventorsJingmin Zhou, Anirban Sengupta
Life of this patent
Estimating the term…
Abstract
A context-aware distributed firewall scheme is provided. A firewall engine tasked to provide firewall protection for a set of network addresses applies a reduced set of firewall rules that are relevant to the set of addresses associated with the machine. A hypervisor implements a search structure that allows each virtual machine's filter to quickly identify relevant rules from all of the received rules. The search structure is constructed as a binary prefix tree, each node corresponding to an IP CIDR (Classless Inter-Domain Routing) block. A query for relevant rules traverses nodes of the search structure according to a queried IP address and collect all rules that are associated with the traversed nodes.
Claims19
1-21. (canceled)
A network manager computer operating in a datacenter, the datacenter comprising a plurality of host computers executing a plurality of data compute nodes (DCNs), the network manager computer comprising:
- a set of processing units;
- and
- a non-transitory machine readable medium storing a program for execution by at least one processing unit in the set of processing units, the program comprising sets of instructions for:
- receiving, from a host computer in the plurality of host computers, an identification of a particular DCN executing on the host computer;
- identifying a set of firewall rules relevant to the particular DCN for which the network manager computer received an identification, wherein the set of firewall rules comprises firewall rules identified by the network manager computer from a plurality of firewall rules for protecting a set of DCNs in the datacenter, the relevant firewall rules for a particular DCN comprising firewall rules that specify either a source or destination address that matches an address of the particular DCN;
- and
- sending the identified set of rules to the host computer, wherein the host computer performs firewall operations on packets to or from the particular DCN by examining the relevant set of firewall rules for the particular DCN.
For a network manager computer operating in a datacenter comprising a plurality of host computers executing a plurality of data compute nodes (DCNs), a method comprising:
- receiving, from a host computer in the plurality of host computers, an identification of a particular DCN executing on the host computer;
- identifying a set of firewall rules relevant to the particular DCN for which the network manager computer received an identification, wherein the set of firewall rules comprises firewall rules identified by the network manager computer from a plurality of firewall rules for protecting a set of DCNs in the datacenter, the relevant firewall rules for a particular DCN comprising firewall rules that specify either a source or destination address that matches an address of the particular DCN;
- and
- sending the identified set of rules to the host computer, wherein the host computer performs firewall operations on packets to or from the particular DCN by examining the relevant set of firewall rules for the particular DCN.
Dependencies are inferred from the claim text.