Providing firewall rules for workload spread across multiple data centers

A non-transitory machine readable medium storing a program that when executed by at least one processing unit replicates firewall rules for a tenant having a plurality of data compute nodes (DCNs) across a plurality of data centers, each data center comprising a set of hosts and a network manager, each host configured to host one or more DCNs, the program comprising sets of instructions for:

• receiving a first set of firewall rules referencing first and second sets of objects, each of the first set of objects comprising an identifier identifiable by a first network manager in a first data center, each of the second set of objects comprising an identifier not identifiable by the first network manager;
• translating the first set of objects by searching a local inventory of objects, the local inventory of objects mapping the identifiers of the first set of objects into a first set of globally recognized identifiers that are identifiable by the network managers of the plurality of data centers;
• translating the second set of objects by searching a global inventory of objects, the global inventory of objects mapping the identifiers of the second set of objects into a second set of globally recognized identifiers identifiable by the network managers of the plurality of data centers;
• translating the first set of firewall rules into a second set of global firewall rules using the first and second sets of globally recognized identifiers;
• and
• replicating the second set of global firewall rules to the network managers across the plurality of data centers,
• wherein the first and second sets of identifiers comprise at least one of a static Internet protocol (IP) address and a media access control (MAC) address, wherein each global firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, and (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet.

A system comprising:

• a plurality of data centers, each data center comprising:
• a network manager;
• and
• a set of hosts configured to host a set of data compute nodes (DCN);
• each network manager comprising:
• a set of processing units;
• and
• a non-transitory machine readable medium storing a program that when executed by at least one processing unit of the network manager replicates firewall rules for a tenant having a plurality of DCNs across the plurality of data centers, the program comprising sets of instructions for:
• receiving a first set of firewall rules referencing first and second sets of objects, each of the first set of objects comprising an identifier identifiable by a first network manager in a first data center, each of the second set of objects comprising an identifier not identifiable by the first network manager;
• translating the first set of objects by searching a local inventory of objects, the local inventory of objects mapping the identifiers of the first set of objects into a first set of globally recognized identifiers that are identifiable by the network managers of the plurality of data centers;
• translating the second set of objects by searching a global inventory of objects, the global inventory of objects mapping the identifiers of the second set of objects into a second set of globally recognized identifiers identifiable by the network managers of the plurality of data centers;
• translating the first set of firewall rules into a second set of global firewall rules using the first and second sets of globally recognized identifiers;
• and
• replicating the second set of global firewall rules to the network managers across the plurality of data centers,
• wherein the first and second sets of identifiers comprise at least one of a static Internet protocol (IP) address and a media access control (MAC) address, wherein each global firewall rule includes (i) a set of n-tuples for comparing with a set of attributes of a packet to determine whether a firewall rule is applicable to the packet, and (ii) an action identifier that specifies the action to perform on the packet when the firewall rule is applicable to the packet.