# US 2020/0396206 A1 · Implementing logical network security on a hardware switch > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396206 A1 - Document ID: US20200396206A1 - Status: Published application - Kind: A1 - Application number: 16/877,155 - Filed: 2020-05-18 - Published: 2020-12-17 - Earliest claimed: 2016-06-29 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Benjamin Basler - Web page: https://patentgrep.com/patent/US20200396206A1 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 63/101: {Access control lists [ACL]} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments provide a method for applying a security policy defined for a logical network to an MHFE that integrates physical workloads (e.g., physical machines connected to the MHFE) with the logical network. The method applies the security policy to the MHFE by generating a set of ACL rules based on the security policy's definition and configuring the MHFE to apply the ACL rules on the network traffic that is forwarded to and/or from the physical machines. In order to configure an MHFE to implement the different LFEs of a logical network, some embodiments propagate an open source database stored on the MHFE, using an open source protocol. Some embodiments propagate a particular table of the database such that each record of the table creates an association between a port of an LFE stored in a logical forwarding table and one or more ACL rules stored in an ACL table. ## Claims ### Claim 1 A method for configuring a managed hardware forwarding element (MHFE) to implement a security policy for a logical network, the method comprising: receiving, a plurality of security rules to be applied to network traffic of a logical network that logically connects a plurality of data compute nodes executing on a set of host machines to a physical machine that is connected to the MHFE; generating a plurality of access control list (ACL) rules based on the plurality of security rules; and configuring the MHFE to apply the generated ACL rules network traffic forwarded to and from the physical machine. ### Claim 2 (depends on 1) The method of claim 1, wherein at least one security rule in the plurality of security rules comprises a particular field that specifies the rule has to be applied at a logical switch to which the physical machine is logically coupled. ### Claim 3 (depends on 2) The method of claim 2, wherein the MHFE implements the logical switch by mapping a logical port of the logical switch to a physical port of the MHFE to which the physical machine is connected. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of security rules comprises firewall rules that are applied to a set of logical forwarding elements of the logical network in a distributed manner by a logical firewall. ### Claim 5 (depends on 4) The method of claim 4, wherein the logical firewall comprises a set of firewall instances that is instantiated in the set of host machines to apply the firewall rules on the set of logical forwarding elements ### Claim 6 (depends on 5) The method of claim 5, wherein the set of logical forwarding elements is implemented by a set of managed forwarding elements, each managed forwarding element executing on a host machine in the set of host machines, wherein each firewall instance is also implemented by a managed forwarding element. ### Claim 7 (depends on 1) The method of claim 1, wherein at least one security rule in the plurality of security rules comprises a security group as a source or destination address, the security group comprising a plurality of network elements. ### Claim 8 (depends on 7) The method of claim 7, wherein the plurality of network elements comprises a plurality of data compute nodes that share a common property. ### Claim 9 (depends on 8) The method of claim 8, wherein the common property in the plurality of data compute nodes comprises implementing a common web server. ### Claim 10 (depends on 7) The method of claim 7, wherein the plurality of network elements comprises at least the physical machine. ### Claim 11 (depends on 1) The method of claim 1, wherein configuring the MHFE comprises populating an ACL table stored on the MHFE with the plurality of ACL rules. ### Claim 12 (canceled) ### Claim 13 A non-transitory machine readable medium storing a program for configuring a managed hardware forwarding element (MHFE) to implement a security policy for a logical network, the program executable by at least one processing unit, the program comprising sets of instructions for: receiving, a plurality of security rules to be applied to network traffic of a logical network that logically connects a plurality of data compute nodes executing on a set of host machines to a physical machine that is connected to the MHFE; generating a plurality of access control list (ACL) rules based on the plurality of security rules; and configuring the MHFE to apply the generated ACL rules network traffic forwarded to and from the physical machine. ### Claim 14 (depends on 13) The non-transitory machine readable medium of claim 13, wherein at least one security rule in the plurality of security rules comprises a particular field that specifies the rule has to be applied at a logical switch to which the physical machine is logically coupled. ### Claim 15 (depends on 14) The non-transitory machine readable medium of claim 14, wherein the MHFE implements the logical switch by mapping a logical port of the logical switch to a physical port of the MHFE to which the physical machine is connected. ### Claim 16 (depends on 13) The non-transitory machine readable medium of claim 13, wherein the plurality of security rules comprises firewall rules that are applied to a set of logical forwarding elements of the logical network in a distributed manner by a logical firewall. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the logical firewall comprises a set of firewall instances that is instantiated in the set of host machines to apply the firewall rules on the set of logical forwarding elements ### Claim 18 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the set of logical forwarding elements is implemented by a set of managed forwarding elements, each managed forwarding element executing on a host machine in the set of host machines, wherein each firewall instance is also implemented by a managed forwarding element. ### Claim 19 (canceled) ### Claim 20 (depends on 19) The non-transitory machine readable medium of claim 19, wherein the plurality of network elements comprises at least the physical machine.