Firewall deployment method and apparatus, electronic device, and readable storage medium

Abstract

The present disclosure relates to the technical field of cloud computing, and particularly relates to a firewall deployment method and device, electronic equipment and readable storage medium. The present disclosure defines a special virtual private cloud dedicated to deploying firewall nodes, the firewall nodes are all deployed in the special virtual private cloud, and are completely isolated from the user business VPC. The user has no right to modify any network configuration in the special virtual private cloud, complete isolation of the firewall nodes and the business environment is achieved, the compliance requirements of the firewall are met, the protection path interruption caused by user operation is avoided, and the stability of the firewall function is improved.

Description

Technical Field

[0001] This disclosure relates to the field of cloud computing technology, and in particular to a firewall deployment method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] Firewalls are important security components in cloud computing environments, and their security and operational stability affect the overall security protection capabilities of the cloud environment.

[0003] Currently, firewalls are mainly deployed in the user's virtual private cloud, centrally in a shared network domain, or distributed on the host machine. The firewall's routing configuration is easily modified, leading to protection failure.

[0004] Therefore, current firewall deployment solutions cannot guarantee the security of the firewall itself, and are prone to problems such as abnormal traffic forwarding and service interruption caused by incorrect routing configuration. Summary of the Invention

[0005] To address the aforementioned technical problems, this disclosure provides a firewall deployment method, apparatus, electronic device, and readable storage medium.

[0006] A first aspect of this disclosure provides a method for deploying a firewall, comprising: Create a dedicated virtual private cloud that is isolated from the business virtual private cloud, and the configuration in the dedicated virtual private cloud cannot be changed by the user; In response to the creation request of the firewall node, determine the first virtual private cloud corresponding to the creation request; If the first virtual private cloud is a dedicated virtual private cloud, create a firewall node in the dedicated virtual private cloud.

[0007] A second aspect of this disclosure provides a firewall deployment apparatus, comprising: The first creation module is used to create a dedicated virtual private cloud. The dedicated virtual private cloud is isolated from the business virtual private cloud, and the configuration in the dedicated virtual private cloud cannot be changed by the user. The first determination module is used to determine the first virtual private cloud corresponding to the creation request in response to the creation request of the firewall node. The second determining module is used to create a firewall node in the dedicated virtual private cloud when the first virtual private cloud is a dedicated virtual private cloud.

[0008] A third aspect of this disclosure provides an electronic device, including: processor; Memory, used to store executable instructions; The processor is used to read executable instructions from memory and execute the executable instructions to implement the firewall deployment method provided in the first aspect above.

[0009] A fourth aspect of this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to implement the firewall deployment method provided in the first aspect.

[0010] The technical solution provided in this disclosure has the following advantages compared with the prior art: The firewall deployment method, apparatus, electronic device, and readable storage medium provided in this disclosure define a dedicated virtual private cloud for deploying firewall nodes. All firewall nodes are deployed within this dedicated virtual private cloud and are completely isolated from the user's business VPC. Users have no permission to modify any network configuration within the dedicated virtual private cloud, thus achieving complete isolation between the firewall nodes and the business environment, meeting firewall compliance requirements, avoiding interruptions to the protection path caused by user operations, and improving the stability of firewall functions. Attached Figure Description

[0011] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0012] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a firewall deployment method provided in an embodiment of this disclosure; Figure 2 A schematic diagram of a traffic forwarding architecture provided in an embodiment of this disclosure; Figure 3 This is a schematic diagram of the structure of a firewall deployment device provided in an embodiment of this disclosure; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0014] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0015] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0016] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0017] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0018] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0019] Generally, there are three main deployment and operation schemes for cloud firewalls.

[0020] The first approach is a side-mount deployment within the user's VPC, where the firewall virtual machine node is deployed directly within the user's business VPC, and traffic redirection is achieved by configuring custom routes within the user's VPC. However, with this approach, users can interrupt the firewall's forwarding path by modifying routing, access control lists, security groups, and other configurations, causing the protection to completely fail.

[0021] The second approach is a centralized deployment solution within a shared network domain. This involves deploying firewall nodes within the shared basic network domain of the cloud platform, using physical network configuration to handle traffic redirection and forwarding. However, deploying multi-tenant firewall nodes within a shared network domain poses risks of unauthorized access and data leakage, failing to meet the compliance requirements of network security level protection for the isolated deployment of security components.

[0022] The third approach is a distributed deployment scheme on host machines. This involves deploying the firewall's security detection components as containers or virtual machines on each business host machine, implementing traffic detection and interception at the virtual switch layer on the host machine. In this scheme, users or operations personnel can arbitrarily modify forwarding routing rules, which can easily lead to traffic forwarding anomalies and service interruptions due to incorrect routing configurations. Furthermore, there is no routing protection mechanism, and misoperation can directly cause the entire firewall cluster's protection capabilities to fail, resulting in a wide-ranging impact from the failure.

[0023] To address the aforementioned issues, this disclosure provides a method for deploying a firewall, which will be described below with reference to specific embodiments.

[0024] Figure 1 This is a flowchart of a firewall deployment method provided in an embodiment of the present disclosure. The method can be executed by the control plane of a network service component (Neutron). The control plane can be configured in an electronic device, such as a server or terminal, wherein the terminal specifically includes a mobile phone, computer, or tablet computer.

[0025] The following is about Figure 1 The deployment method of the firewall shown is introduced. For example... Figure 1 As shown, the firewall deployment method provided in this embodiment includes the following steps.

[0026] S101. Create a dedicated virtual private cloud.

[0027] The dedicated virtual private cloud is isolated from the business virtual private cloud, and the configuration in the dedicated virtual private cloud cannot be changed by the user.

[0028] A dedicated virtual private cloud is a private virtual network domain created specifically for hosting firewall nodes within a cloud computing platform. It is used to deploy firewall nodes that provide network security detection, traffic filtering, and attack protection functions. It is isolated from the business virtual private cloud used by users to deploy business systems, store business data, and run applications, and has its own dedicated routing configuration and forwarding rules.

[0029] Specifically, the dedicated virtual private cloud and the business virtual private cloud are isolated from each other, including logical isolation and physical resource isolation, and peer-to-peer connections or other interconnection links between the dedicated virtual private cloud and the business virtual private cloud are prohibited.

[0030] Peer connections are high-speed internal network connection channels between VPCs, used to enable internal network traffic exchange between different VPCs.

[0031] For example, a dedicated virtual private cloud is configured with a special type identifier. When creating a peering connection, the VPC is verified. A rule is added during the verification process. If the VPC has a special type identifier, the verification fails, thus preventing the dedicated VPC from establishing a peering connection with the business VPC.

[0032] S102. In response to the creation request of the firewall node, determine the first virtual private cloud corresponding to the creation request.

[0033] Cloud platform operations and maintenance personnel or automated deployment systems initiate a firewall node creation request to the cloud platform control plane. The creation request carries the identification information of the virtual private cloud where the network interface card (NIC) to which the firewall node is planned to be deployed resides. The control plane determines the first virtual private cloud based on the identification information.

[0034] After receiving a firewall node creation request, the control plane first verifies the validity of the request to ensure that it conforms to the specifications, extracts identification information from the request parameters, and queries the virtual private cloud resource database based on the identification information to determine the first virtual private cloud corresponding to the identification information.

[0035] S103. If the first virtual private cloud is a dedicated virtual private cloud, create a firewall node in the dedicated virtual private cloud.

[0036] If the type identifier of the first virtual private cloud is consistent with the type identifier of the pre-created dedicated virtual private cloud, then a firewall node is created in the dedicated virtual private cloud.

[0037] Optionally, the network interface card (NIC) corresponding to the creation request can be verified. Only if the NIC is not bound to a firewall node can the creation of a firewall node be allowed, ensuring that a single NIC can only serve as a firewall node.

[0038] In this embodiment of the disclosure, a dedicated virtual private cloud is defined for deploying firewall nodes. All firewall nodes are deployed within this dedicated virtual private cloud and are completely isolated from the user's business VPC. Users have no permission to modify any network configuration within the dedicated virtual private cloud. This achieves complete isolation between the firewall nodes and the business environment, meets the compliance requirements of the firewall, avoids interruption of the protection path caused by user operations, and improves the stability of the firewall function.

[0039] In some embodiments, after creating a private virtual private cloud, preset static routing rules are sent to the virtual gateway in the private virtual private cloud, and the modification operation of the routing rules is intercepted.

[0040] Among them, the preset static routing rules are used to define the next hop of public network traffic as the firewall gateway address; the routing rule modification operation includes the modification operation of the preset static routing rules, and / or the operation of associating custom routing rules with a private virtual private cloud.

[0041] A virtual gateway is a network ingress / egress device for a dedicated virtual private cloud (VPN), responsible for receiving, forwarding, and routing network traffic within the VPN. Each dedicated VPN is automatically assigned a virtual gateway upon creation, which is completely independent of the virtual gateway of the business VPN.

[0042] After the cloud platform control plane completes the creation and initialization of the dedicated virtual private cloud, it distributes the preset static routing rules to the virtual gateway, which then makes routing decisions for traffic based on the preset static routing rules.

[0043] A firewall gateway is a gateway device responsible for firewall traffic scheduling, load balancing, and forwarding control. It is used to distribute public network traffic to various firewall nodes for security detection and forward traffic that passes the detection to the target business system, such as virtual machines in a business virtual private cloud.

[0044] Public network traffic includes external access traffic from the Internet, that is, traffic accessing the internal business systems of the cloud platform via public IP addresses, and external access traffic from the internal business systems of the cloud platform to the Internet. The default static routing rules define the next hop for public network traffic as the firewall gateway address, meaning that all forwarding paths for public network traffic must pass through the firewall gateway.

[0045] Routing rule modification operations include adjusting parameters of existing routing rules, deleting existing routing rules, adding new routing rules, or associating custom routing tables with a dedicated virtual private cloud, changing routing configurations by replacing or adding the entire routing table.

[0046] Static routing rules in a private virtual private cloud are only deleted when the private virtual private cloud is deleted. No other operation can modify or delete the routing rule. The control plane interface layer directly intercepts all modification or deletion requests for the route.

[0047] Dedicated virtual private clouds can only use the system's default routing table. All routing configurations are automatically generated and maintained by the control plane, and neither users nor operations and maintenance personnel can manually modify them.

[0048] For example, when associating a virtual private cloud with a routing table, a corresponding interface needs to be called. A validation should be added to this interface. If the virtual private cloud corresponding to the association operation is a dedicated virtual private cloud, the association operation should be rejected and an exception should be thrown.

[0049] This embodiment establishes a correct and stable firewall traffic forwarding path by issuing unified preset static routing rules; by intercepting the modification of routing rules, it ensures that the forwarding path cannot be changed by human operation, thus guaranteeing the controllability and stability of the firewall forwarding path and further improving the stability of the firewall function.

[0050] Optionally, in response to a request to delete a private virtual private cloud, the runtime status information of the firewall nodes in the private virtual private cloud can be obtained.

[0051] If it is determined from the operational status information that there are no running firewall nodes in the dedicated virtual private cloud, delete the dedicated virtual private cloud and the corresponding preset static routing rules.

[0052] Alternatively, if the system determines, based on operational status information, that a firewall node is operating within the dedicated virtual private cloud, the deletion request may be rejected.

[0053] A deletion request for a Private Virtual Private Cloud (PVR) is used to destroy an existing PVR instance and release its associated network resources. The PVR request carries the identification information of the PVR to be deleted.

[0054] The control plane determines the private virtual private cloud to be deleted based on the identification information, and obtains the running status information of each firewall node in the private virtual private cloud to determine whether each firewall node is running and still used to process traffic.

[0055] If all firewall nodes within the private virtual private cloud are in a stopped or destroyed state, and there are no firewall nodes processing public network traffic or capable of providing security protection services, the control plane will execute the deletion operation corresponding to the deletion request, deleting the private virtual private cloud itself and its associated preset static routing rules to avoid residual resource occupation.

[0056] Alternatively, if at least one firewall node within the dedicated virtual private cloud is running, processing public network traffic and providing security protection services, the control plane will refuse to execute the deletion operation corresponding to the deletion request to prevent the firewall node from becoming ineffective.

[0057] This embodiment of the disclosure verifies the operational status of firewall nodes within a dedicated virtual private cloud (VPN) before deletion. The VPN is only deleted if no firewall nodes are running, reducing the risk of accidental deletion and preventing protection malfunctions caused by such errors. Furthermore, the associated preset static routing rules are simultaneously deleted when the VPN is deleted, preventing residual resource occupation and improving the resource utilization of the cloud platform.

[0058] In some embodiments, before creating a dedicated virtual private cloud, the control plane creates a public elastic address and a firewall instance, and the firewall instance is bound to a firewall gateway.

[0059] After creating a dedicated virtual private cloud and its firewall node, the control plane mounts the firewall node to the firewall instance and associates the public IP address with the firewall instance.

[0060] The firewall gateway is used to forward traffic corresponding to public elastic addresses to firewall nodes.

[0061] When the control plane creates a firewall instance, it automatically assigns a firewall gateway to it. All traffic destined for the firewall instance must be forwarded through the firewall gateway it is bound to.

[0062] The control plane establishes a relationship between the firewall node, which has been created and verified during initialization in the dedicated virtual private cloud, and the firewall instance at the logical layer, thus completing the mounting operation. After mounting, the firewall node is added to the node resource pool of the corresponding firewall instance, serving as a service node for that instance. It receives and processes traffic corresponding to the public elastic address bound to the instance. The corresponding configuration information of the firewall node is then sent from the control plane to the firewall gateway, enabling the firewall gateway to forward the traffic that needs to be processed for that firewall node.

[0063] After receiving traffic corresponding to a public elastic address, the firewall gateway distributes the traffic to the firewall nodes mounted under the firewall instance for security testing according to the preset load balancing policy.

[0064] This disclosed embodiment establishes a complete traffic forwarding path through operations such as mounting and association, ensuring that traffic from public elastic addresses is accurately guided to the corresponding firewall nodes for security inspection. Furthermore, it only opens the forwarding channel between the dedicated virtual private cloud and the public network gateway and firewall gateway, achieving network isolation from the business virtual private cloud.

[0065] In some embodiments, the control plane is further configured to receive a creation request for a business virtual machine, and reject the creation request if the second virtual private cloud corresponding to the creation request is a dedicated virtual private cloud.

[0066] A business virtual machine is a virtual computing instance used to run user business systems, store business data, and process business logic. Business virtual machines can be applied for, configured, and managed by users.

[0067] Users or third-party management tools initiate a creation request to the control plane to request the creation of a business virtual machine. The creation request carries the identification information of the business virtual private cloud where the business virtual machine is planned to be deployed. The control plane determines the second virtual private cloud based on the identification information of the business virtual private cloud and determines whether the second virtual private cloud is a dedicated virtual private cloud.

[0068] If the second virtual private cloud is a dedicated virtual private cloud, the request to create a business virtual machine will be rejected, and the creation of a business virtual machine in the dedicated virtual private cloud will be prohibited.

[0069] This disclosure embodiment verifies the creation request of the business virtual machine, avoiding the creation of the business virtual machine in the dedicated virtual private cloud, meeting the compliance requirements of information security level protection, ensuring that the dedicated virtual private cloud is only used to deploy firewall nodes, realizing the isolation between the firewall node and the business system, reducing the risk of configuration changes in the dedicated virtual private cloud, and further improving the reliability and stability of the firewall protection function.

[0070] In some embodiments, when the network configuration corresponding to a firewall node changes, the controller updates the corresponding field in the firewall node table and sends the updated configuration information to the firewall gateway.

[0071] When the network interface card (NIC) corresponding to a firewall node is deleted, and / or the virtual machine corresponding to the firewall node is destroyed, the control plane automatically triggers the node deletion process, calling the `delete_firewall_node` interface to delete the firewall node. The control plane calls the firewall service deployed on the firewall gateway to remove the firewall node from the firewall gateway's resource pool, causing the firewall gateway to stop distributing traffic to that firewall node. After the traffic processing for that firewall node is completed, the field in the firewall node table corresponding to that firewall node is marked as soft-deleted.

[0072] In some embodiments, the firewall service deployed on the firewall gateway periodically collects the health status and traffic statistics of each firewall node, processes the collected data, filters out key indicators such as the online status, health status, traffic bandwidth, and number of sessions of the firewall nodes, writes the key indicators into the Redis cache, and sets a reasonable expiration time to ensure the real-time and validity of the data in the cache.

[0073] The control plane retrieves the real-time health status of firewall nodes from the Redis cache via an interface and displays it on the console. When an abnormal health status of a firewall node is detected, an alarm message is generated to notify operations and maintenance personnel to intervene.

[0074] Optionally, the firewall service will switch traffic on the abnormal firewall node to the normal firewall node for processing and stop distributing traffic to the abnormal firewall node; once the abnormal firewall node recovers, traffic distribution to that node will resume.

[0075] This disclosure improves the efficiency and automation of firewall lifecycle management by automating the lifecycle management of firewall nodes without manual intervention. Furthermore, it enhances the reliability of firewall functionality by ensuring continuous availability through traffic switching strategies.

[0076] In some embodiments, in response to a migration operation of a virtual machine corresponding to a firewall node in a private virtual private cloud, the control plane configures a first routing rule in the firewall gateway based on the migration information corresponding to the migration operation; and after the migration operation is completed, the first routing rule is updated to a second routing rule.

[0077] The migration information includes the original physical machine address and the target physical machine address; the first routing rule is used to route traffic sent to the virtual machine to the original physical machine address and the target physical machine address, and the second routing rule is used to route traffic sent to the virtual machine to the target physical machine address.

[0078] Virtual machine hot migration refers to the operation of migrating a virtual machine from one physical host to another in a cloud computing platform without interrupting business operations.

[0079] When a virtual machine corresponding to a firewall node begins hot migration, the start_migration interface is called. The control plane recognizes the start of hot migration based on this call and updates the configuration information of the virtual machine on the firewall gateway, adding the configuration information corresponding to the target physical machine address.

[0080] At this point, the firewall gateway distributes traffic according to the first routing rule. If it needs to forward traffic to the virtual machine, it will forward the traffic destined for the firewall node to both the original physical machine and the target physical machine, thus achieving dual traffic transmission. During the migration process, the virtual machine can receive traffic regardless of whether it is running on the original physical machine or the target physical machine.

[0081] After the migration operation is completed, the virtual machine has been successfully transferred from the original physical machine to the target physical machine and is running normally on the target physical machine. The first routing rule in the firewall gateway is updated to the second routing rule, and traffic is stopped from being forwarded to the original physical machine.

[0082] This embodiment of the disclosure enables dual traffic transmission during virtual machine migration by configuring a first routing rule, ensuring that the virtual machine can receive traffic during the migration process, performing seamless hot migration of the virtual machine, ensuring uninterrupted firewall functionality, and balancing stability and flexibility.

[0083] Specifically, based on the migration information corresponding to the migration operation, the first routing rule is configured in the firewall gateway, including: filling the target physical machine address corresponding to the migration operation into the first field of the firewall node resource table corresponding to the virtual machine. The firewall node resource table also includes a second field, which is used to record the original physical machine address; and sending the first configuration information corresponding to the firewall node resource table to the firewall gateway, which is used to determine the first routing rule based on the configuration information.

[0084] The firewall node resource table is a data storage unit used by the control plane to uniformly manage the attributes of all firewall nodes. Each firewall node corresponds to one record in the table. In response to migration operations, the control plane adds the target physical machine address configuration to the first field, transfer_vgw_ip, corresponding to the virtual machine, based on the migration information. This configuration is stored together with the original physical machine address already existing in the second field, vgw_ip.

[0085] The control plane generates initial configuration information containing the original physical machine address and the target physical machine address based on the updated firewall node resource table, and sends it to the firewall gateway bound to the firewall instance to which the firewall node belongs. After receiving the initial configuration information, the firewall gateway generates corresponding traffic routing rules and forwards all traffic destined for the firewall node to both physical machine addresses simultaneously, ensuring that the protection function remains effective during virtual machine migration.

[0086] Accordingly, the first routing rule is updated to the second routing rule, including: clearing the content in the first field and updating the content of the second field to the target physical machine address; and sending the second configuration information corresponding to the firewall node resource table to the firewall gateway, which is used to determine the second routing rule based on the second configuration information.

[0087] After receiving the notification that the virtual machine migration is complete, the cloud platform control plane deletes the original physical machine address stored in the first field, updates the original physical machine address in the second field to the target physical machine address, generates second configuration information containing only the target physical machine address based on the firewall node resource table after clearing the original address, and sends it to the firewall gateway.

[0088] After receiving the second configuration information, the firewall gateway changes the previously effective first routing rule to the second routing rule, forwarding all traffic destined for the firewall node only to the target physical machine address.

[0089] This embodiment of the disclosure generates a first routing rule for dual-transmission traffic by adding a target address to a preset field; and generates a second routing rule for normal forwarding by clearing the original address to restore the single-address state. This realizes dynamic management of routing configuration during virtual machine migration, ensures the continuous effectiveness of firewall functions, and improves the maintainability and reliability of the firewall system.

[0090] Optionally, if the virtual machine is migrated offline, the control plane will automatically detect changes in the network configuration information of the firewall node after the offline migration is completed, delete the network configuration of the firewall node before the migration, recreate the new network configuration, and send it to the firewall gateway.

[0091] When the network interface card corresponding to a firewall node is unbound or deleted, the control plane detects the operation and triggers the firewall node deletion process, removing the firewall node configuration from the firewall gateway to avoid abnormal traffic forwarding caused by residual configuration.

[0092] In some embodiments, in response to the first firewall node's call to the subnet interface, the third virtual private cloud where the first firewall node is located is determined; if the third virtual private cloud is a dedicated virtual private cloud, the call is rejected.

[0093] The first firewall node refers to the firewall node that initiates the subnet interface call operation. The control plane monitors operation requests for the network interfaces of the firewall node, and when a subnet interface call operation is detected, it obtains the attribute information of the virtual private cloud to which the first firewall node belongs.

[0094] When it is confirmed that the first firewall node initiating the subnet operation is deployed in a dedicated virtual private cloud, its operation is rejected, and changes to the firewall node's subnet configuration are prohibited. This ensures that the network access point and routing prefix of the firewall node remain stable, thereby guaranteeing the stability and reliability of the firewall's forwarding path.

[0095] Optionally, when adding a firewall node within a dedicated virtual private cloud, the control plane automatically synchronizes the full firewall configuration for the new node, enabling it to automatically join the cluster and take over traffic distributed by the firewall gateway. When a firewall node goes offline, the control plane automatically updates the configuration and sends it to the firewall gateway, switching traffic to other firewall nodes before removing the node configuration, ensuring the firewall functionality remains effective.

[0096] In some embodiments, each firewall instance and its subordinate firewalls belong to a firewall gateway cluster, and the firewall instance configurations of different clusters are completely isolated and do not affect each other.

[0097] When the primary availability zone cluster fails, traffic can be automatically switched to the backup availability zone cluster, enabling disaster recovery and backup across availability zones and further improving the availability of firewall protection functions.

[0098] Figure 2 This is a schematic diagram of a traffic forwarding architecture provided in an embodiment of this disclosure. Figure 2 As shown, external access traffic destined for an Elastic IP Address (EIP) first reaches the public network gateway. The public network gateway, based on the binding relationship between the EIP and the firewall instance, directs the traffic to the corresponding firewall gateway. Meanwhile, EIP traffic not bound to a firewall instance is directly forwarded to the business virtual machine in the business virtual private cloud (business VPC).

[0099] The firewall gateway receives traffic requiring protection forwarded from the public network gateway and distributes the traffic to firewall nodes in the dedicated virtual private cloud according to the load balancing policy. After the firewall nodes complete the security cleaning, they redirect legitimate traffic back to the public network gateway along the original path, and the public network gateway then forwards it to the target virtual machine within the business VPC.

[0100] Figure 3 This is a schematic diagram of the structure of a firewall deployment device provided in an embodiment of this disclosure.

[0101] In this embodiment of the disclosure, the firewall deployment device can be located within the control plane and can be understood as a part of the functional modules in the control plane.

[0102] like Figure 3 As shown, the firewall deployment device 30 may include a first creation module 31, a first determination module 32, and a second determination module 33. The first creation module 31 is used to create a dedicated virtual private cloud (VPN), which is isolated from the business VPN, and the configuration in the dedicated VPN cannot be changed by the user. The first determination module 32 is used to determine the first VPN corresponding to the creation request in response to the firewall node creation request. The second determination module 33 is used to create a firewall node in the dedicated VPN if the first VPN is a dedicated VPN.

[0103] In some embodiments, the firewall deployment device 30 further includes a first distribution module and an interception module. The first distribution module is used to distribute preset static routing rules to the virtual gateway in the private virtual private cloud. The preset static routing rules are used to define the next hop of public network traffic as the firewall gateway address. The interception module is used to intercept routing rule modification operations. The routing rule modification operations include modification operations of the preset static routing rules and / or operations of associating custom routing rules with the private virtual private cloud.

[0104] In some embodiments, the firewall deployment apparatus 30 further includes a third creation module for creating a public network elastic address and a firewall instance, wherein the firewall instance is bound to a firewall gateway; a mounting module for mounting a firewall node to the firewall instance; and an association module for associating the public network elastic address with the firewall instance, wherein the firewall gateway is used to forward traffic corresponding to the public network elastic address to the firewall node.

[0105] In some embodiments, the firewall deployment device 30 further includes a deletion module, configured to, in response to a deletion request for a private virtual private cloud, obtain the operating status information of the firewall nodes in the private virtual private cloud; if it is determined from the operating status information that there are no operating firewall nodes in the private virtual private cloud, delete the private virtual private cloud and the preset static routing rules corresponding to the private virtual private cloud; and if it is determined from the operating status information that there are operating firewall nodes in the private virtual private cloud, reject the deletion request.

[0106] In some embodiments, the firewall deployment apparatus 30 further includes a hot migration module, configured to, in response to a migration operation of a virtual machine corresponding to a firewall node in a private virtual private cloud, configure a first routing rule in the firewall gateway according to the migration information corresponding to the migration operation; and update the first routing rule to a second routing rule after the migration operation is completed; wherein the migration information includes the original physical machine address and the target physical machine address; the first routing rule is used to route traffic sent to the virtual machine to the original physical machine address and the target physical machine address, and the second routing rule is used to route traffic sent to the virtual machine to the target physical machine address.

[0107] In some embodiments, the hot migration module is used to fill the target physical machine address corresponding to the migration operation into the first field of the firewall node resource table corresponding to the virtual machine. The firewall node resource table also includes a second field, which is used to record the original physical machine address. The module then sends the first configuration information corresponding to the firewall node resource table to the firewall gateway, which is used to determine the first routing rule based on the configuration information.

[0108] In some embodiments, the hot migration module is used to clear the contents of the first field and update the contents of the second field to the target physical machine address; and to send the second configuration information corresponding to the firewall node resource table to the firewall gateway, which is used to determine the second routing rule based on the second configuration information.

[0109] In some embodiments, the firewall deployment device 30 further includes a fourth creation module, configured to receive a creation request for a business virtual machine; and to reject the creation request if the second virtual private cloud corresponding to the creation request is a dedicated virtual private cloud.

[0110] In some embodiments, the firewall deployment apparatus 30 further includes a second determining module, configured to determine the third virtual private cloud where the first firewall node is located in response to the first firewall node's call operation to the subnet interface; and to reject the call operation if the third virtual private cloud is a dedicated virtual private cloud.

[0111] It should be noted that, Figure 3The firewall deployment device 30 shown can execute the various steps in the above method embodiments and achieve the various processes and effects in the above method embodiments, which will not be elaborated here.

[0112] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure.

[0113] In this embodiment of the disclosure, Figure 4 The electronic device shown can be a server or terminal, deployed within the control plane.

[0114] like Figure 4 As shown, the electronic device may include a processor 410 and a memory 420 storing computer program instructions.

[0115] Specifically, the processor 410 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this disclosure.

[0116] Memory 420 may include a large-capacity storage device for information or instructions. For example, and not limitingly, memory 420 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 420 may include removable or non-removable (or fixed) media. Where appropriate, memory 420 may be internal or external to the integrated gateway device. In a particular embodiment, memory 420 is a non-volatile solid-state memory. In a particular embodiment, memory 420 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (Electrically Programmable ROM, EPROM), an electrically erasable programmable PROM (EEPROM), an electrically alterable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0117] The processor 410 reads and executes computer program instructions stored in the memory 420 to perform the steps of the firewall deployment method provided in this disclosure embodiment.

[0118] In one example, the electronic device may also include a transceiver 430 and a bus 440. Wherein, as... Figure 4 As shown, the processor 410, memory 420 and transceiver 430 are connected via bus 440 and communicate with each other.

[0119] Bus 440 may include hardware, software, or both. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 440 may include one or more buses.

[0120] This disclosure also provides a computer-readable storage medium that can store a computer program that, when executed by a processor, causes the processor to implement the firewall deployment method provided in this disclosure.

[0121] The aforementioned storage medium may, for example, include a memory 420 containing computer program instructions, which can be executed by a processor 410 of an electronic device to complete the firewall deployment method provided in this embodiment. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), compact disc ROM (CD-ROM), magnetic tape, floppy disk, and optical data storage device.

[0122] This disclosure also provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a processor, they implement the firewall deployment method provided in this disclosure and can achieve the various processes and effects described in the above embodiments of this disclosure, which will not be elaborated here.

[0123] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for deploying a firewall, characterized in that, include: Create a dedicated virtual private cloud, which is isolated from the business virtual private cloud, and the configuration in the dedicated virtual private cloud cannot be changed by the user; In response to the creation request of the firewall node, determine the first virtual private cloud corresponding to the creation request; In the case where the first virtual private cloud is the dedicated virtual private cloud, a firewall node is created in the dedicated virtual private cloud.

2. The method according to claim 1, characterized in that, After creating the dedicated virtual private cloud, the method further includes: A preset static routing rule is issued to the virtual gateway in the private virtual private cloud. The preset static routing rule is used to define the next hop of public network traffic as the firewall gateway address. The routing rule modification operation is intercepted. The routing rule modification operation includes the modification operation of the preset static routing rule and / or the operation of associating a custom routing rule with the private virtual private cloud.

3. The method according to claim 1, characterized in that, Prior to creating the dedicated virtual private cloud, the method further includes: Create a public elastic IP address and a firewall instance, wherein the firewall instance is bound to a firewall gateway; After creating the firewall node in the dedicated virtual private cloud, the method further includes: Mount the firewall node to the firewall instance; The public elastic address is associated with the firewall instance, and the firewall gateway is used to forward the traffic corresponding to the public elastic address to the firewall node.

4. The method according to claim 1, characterized in that, The method further includes: In response to a deletion request for the private virtual private cloud, obtain the running status information of the firewall nodes in the private virtual private cloud; If it is determined from the operating status information that there is no operating firewall node in the dedicated virtual private cloud, delete the dedicated virtual private cloud and the preset static routing rules corresponding to the dedicated virtual private cloud; If the deletion request is rejected if it is determined, based on the operational status information, that a firewall node is in operation within the dedicated virtual private cloud.

5. The method according to claim 1, characterized in that, The method further includes: In response to the migration operation of the virtual machine corresponding to the firewall node in the dedicated virtual private cloud, a first routing rule is configured in the firewall gateway according to the migration information corresponding to the migration operation; After the migration operation is completed, the first routing rule is updated to the second routing rule; The migration information includes the original physical machine address and the target physical machine address; the first routing rule is used to route traffic sent to the virtual machine to the original physical machine address and the target physical machine address, and the second routing rule is used to route traffic sent to the virtual machine to the target physical machine address.

6. The method according to claim 5, characterized in that, The step of configuring a first routing rule in the firewall gateway based on the migration information corresponding to the migration operation includes: The target physical machine address corresponding to the migration operation is filled into the first field of the firewall node resource table corresponding to the virtual machine. The firewall node resource table also includes a second field, which is used to record the original physical machine address. The first configuration information corresponding to the firewall node resource table is sent to the firewall gateway, and the firewall gateway is used to determine the first routing rule based on the configuration information.

7. The method according to claim 6, characterized in that, The step of updating the first routing rule to the second routing rule includes: Clear the content of the first field and update the content of the second field to the target physical machine address; The second configuration information corresponding to the firewall node resource table is sent to the firewall gateway, and the firewall gateway is used to determine the second routing rule based on the second configuration information.

8. The method according to claim 1, characterized in that, The method further includes: Receive the request to create a business virtual machine; If the second virtual private cloud corresponding to the creation request is the dedicated virtual private cloud, the creation request is rejected.

9. The method according to claim 1, characterized in that, The method further includes: In response to the first firewall node's call to the subnet interface, determine the third virtual private cloud where the first firewall node is located; If the third virtual private cloud is the dedicated virtual private cloud, the invocation operation is rejected.

10. A firewall deployment apparatus, characterized in that, The device includes: The first creation module is used to create a dedicated virtual private cloud, which is isolated from the business virtual private cloud, and the configuration in the dedicated virtual private cloud cannot be changed by the user. The first determining module is used to determine the first virtual private cloud corresponding to the creation request in response to the creation request of the firewall node; The second determining module is used to create a firewall node in the dedicated virtual private cloud when the first virtual private cloud is the dedicated virtual private cloud.

11. An electronic device, characterized in that, include: processor; Memory, used to store executable instructions; The processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the method of any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, causes the processor to implement the method described in any one of claims 1-9.

Images