US 2023/0146525 A1 · AUTOMATIC POLICY CONFIGURATION FOR PACKET FLOWS

Abstract

Techniques are disclosed for providing automatic policy configuration for packet flows. For example, a computing device comprises a virtual node and one or more virtual execution elements coupled to the virtual node. The computing device may also comprise one or more processors configured to: receive a packet originating from an application workload hosted on the one or more virtual execution elements and destined for a remote destination device; determine the packet is part of a new packet flow; in response, configure, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow; configure, by the kernel, a policy for a reverse packet flow associated with the forward packet flow; and send the packet toward the remote destination device in accordance with the policy for the forward packet flow.

Claims20

Dependent claims

A method comprising:

receiving, by a virtual node implemented by a computing device, a packet originating from an application workload hosted on the computing device and destined for a remote destination device;
determining, by the virtual node, the packet is part of a new packet flow;
in response to determining the packet is part of a new packet flow, configuring, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow;
configuring, by the kernel of the computing device, a policy for a reverse packet flow associated with the forward packet flow;
and
sending, by the computing device, the packet toward the remote destination device in accordance with the policy for the forward packet flow.

3 more elements

A computing device comprising:

a virtual node;
one or more virtual execution elements coupled to the virtual node;
one or more processors, wherein the one or more processors are configured to:
receive a packet originating from an application workload hosted on the one or more virtual execution elements and destined for a remote destination device;
determine the packet is part of a new packet flow;
in response to determining the packet is part of a new packet flow, configure, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow;
configure, with the kernel of the computing device, a policy for a reverse packet flow associated with the forward packet flow;
and
send the packet toward the remote destination device in accordance with the policy for the forward packet flow.

6 more elements

A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to:

receive a packet originating from an application workload hosted on the one or more virtual execution elements and destined for a remote destination device;
determine the packet is part of a new packet flow;
in response to determining the packet is part of a new packet flow, configure, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow;
configure, with the kernel of the computing device, a policy for a reverse packet flow associated with the forward packet flow;
and
send the packet toward the remote destination device in accordance with the policy for the forward packet flow.

3 more elements

Dependencies are inferred from the claim text.

Automatic policy configuration for packet flows

Life of this patent

Automatic policy configuration for packet flows

Life of this patent

Abstract

Claims20