Distributed Firewall PNIC-Level Filtering for Virtualized Hosts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional firewall rules in virtualized computing environments are inefficient, particularly for handling ingress packets, leading to wasted computing resources and suboptimal host and network performance due to the application of VNIC-level firewall rules, which require unnecessary processing by virtual switches before packet filtering.
Innovation Solution
Implementing PNIC-level firewall rules that are generated from VNIC-level rules and applied at the physical network interface controller level, reducing processing overhead and improving host performance by filtering ingress packets before they reach the virtual switch, and configuring destination-associated firewall rules at the source to drop unwanted egress packets, thereby reducing network bandwidth waste.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VNIC-level firewall rules are applied, then security protection is provided, but processing overhead increases and host performance deteriorates
Solution Approach 1:
The patent applies preliminary action by generating PNIC-level firewall rules in advance from VNIC-level rules, so that packet filtering can be performed at the physical network interface controller level before packets reach the virtual switch. This pre-computed rule set enables efficient inline filtering without requiring complex VNIC-level processing during packet transmission.
Solution Approach 2:
The patent extracts the packet filtering function from the virtual switch layer and moves it to the PNIC level. By taking out the filtering operation from the virtual switch processing path and implementing it at the PNIC level through PNIC-level rules, the system eliminates unnecessary processing overhead while maintaining security protection.
2Reliability
If VNIC-level firewall rules are applied, then security protection is provided, but network bandwidth is wasted
Solution Approach 1:
The system performs preliminary action by pre-computing PNIC-level rules that aggregate VNIC-level filtering requirements. This allows unwanted packets to be dropped at the PNIC level before they are transmitted over the network, preventing bandwidth waste on packets that would be discarded later in the processing path.
Solution Approach 2:
The patent extracts the packet dropping function from the virtual switch and relocates it to the PNIC level. By taking out the filtering operation earlier in the data path at the PNIC level, the system prevents unnecessary network transmission of unwanted packets, thereby reducing network bandwidth waste.
3Productivity
If destination-associated firewall rules are configured at source, then egress packet filtering is improved, but rule complexity increases
Solution Approach 1:
The patent applies merging by combining multiple VNIC-level firewall rules into aggregated PNIC-level rules. This consolidation reduces the number of individual rules that need to be managed and processed, simplifying the rule set while maintaining the filtering effectiveness for egress packets.
Solution Approach 2:
The PNIC-level rules serve multiple functions: they filter packets for multiple VNICs simultaneously, handle both ingress and egress traffic filtering, and provide security protection across multiple virtual machines. This multi-functionality reduces overall system complexity compared to managing separate rules for each function.
Data Source
AI summary
Example methods are provided for a firewall controller to implement a distributed firewall in a virtualized computing environment that includes a source host and a destination host. The method may comprise retrieving a first firewall rule that is applicable at the destination host to an ingress packet destined for a destination virtualized computing instance supported by the destination host; and based on the first firewall rule, generating a second firewall rule that is applicable at the source host to an egress packet destined for the destination virtualized computing instance. The method may further comprise instructing the source host to apply the second firewall rule to, in response to determination that the egress packet is blocked by the second firewall rule, drop the egress packet such that the egress packet is not sent from the source host to the destination host.