Distributed Firewall Routing to Avoid OpenStack Network Congestion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing network bandwidth and security in Openstack-based private cloud platforms face challenges in efficiently allocating bandwidth and ensuring security, leading to issues like network congestion and inadequate security protection isolation.
Innovation Solution
A distributed firewall system that monitors firewall events in real time, converts configuration data into strategy routes, and distributes these routes to OVN controllers for processing and storage in OVS daemon modules, enabling distributed firewall functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If iptables rules are added to the native Virtual Router to control data package filtering, then traffic filtering is concentrated on L3agent, but network security protection isolation is insufficient and network congestion occurs when traffic suddenly increases
Solution Approach 1:
The patent segments the firewall function from the centralized L3agent and distributes it to multiple OVN controllers across different compute nodes. Each OVN controller independently manages firewall rules for its local virtual machines, dividing the centralized security management into multiple parallel distributed units, thereby eliminating the single point of congestion while maintaining comprehensive security coverage.
Solution Approach 2:
The patent transitions from a two-dimensional centralized architecture (L3agent controlling all traffic) to a three-dimensional distributed architecture where firewall decisions are made at multiple levels: centralized policy definition, regional OVN controller processing, and local OVS daemon execution. This dimensional expansion allows traffic to be processed in parallel across multiple nodes rather than funneling through a single bottleneck.
2Ease of operation
If centralized firewall control is implemented through L3agent, then policy management is simplified, but network bandwidth becomes a bottleneck when traffic increases
Solution Approach 1:
The patent segments the firewall processing workload across multiple OVN controllers distributed throughout the cloud infrastructure. Instead of all traffic passing through a single L3agent, each compute node's OVN controller locally processes firewall rules for its associated virtual machines, dividing the bandwidth bottleneck into multiple parallel processing paths that collectively handle the full traffic load.
Solution Approach 2:
The distributed OVN controllers autonomously process and enforce firewall policies for their local virtual machines without requiring constant intervention from a centralized management system. Each controller self-manages its local security rules, making rapid decisions about traffic filtering independently, thereby reducing the bandwidth burden on centralized systems while maintaining consistent security enforcement.
Data Source
AI summary
The present application provides method for defining distributed firewall and electronic device. The method comprises: monitoring, by firewall assembly, firewall event in real time, and sending firewall configuration data corresponding to currently monitored firewall event to OVN database; converting, by the OVN database, the firewall configuration data into corresponding strategy route, performing processing corresponding to the firewall event on the data stored in the OVN database according to the strategy route, and sending, changed data in the data stored in the OVN database caused by performing processing corresponding to the firewall event on the data stored in the OVN database to OVN controllers located on every compute node respectively; and sending, by the OVN controller, the received data to an OVS daemon module on the compute node that the OVN controller is located, and storing, by the OVS daemon module, the received data in memory to realize forwarding a message.