Distributed Firewall Configuration for Virtual Machine Bridges
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls in centralized routing technologies are not applicable to network architectures using distributed virtual routing, as they cannot establish connection tracking for packets between virtual machines across different subnets, leading to ineffective access control.
Innovation Solution
A firewall configuration method that delivers firewall policy information to a network access control list associated with each virtual machine bridge, ensuring that both request and response packets belonging to the same flow pass through the firewall, enabling proper access control in distributed routing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized routing architecture is used with a firewall disposed in the router's namespace, then access control can be implemented effectively, but the network node has insufficient processing capability when access traffic increases
Solution Approach 1:
The patent segments the centralized routing function into distributed virtual routers deployed on multiple compute nodes. Each compute node handles its own routing and firewall operations independently, eliminating the single point of bottleneck. The firewall functionality is segmented from the centralized router and distributed to individual virtual machine bridges on each compute node, allowing parallel processing of network traffic across multiple nodes.
Solution Approach 2:
The patent transitions from a single-dimensional centralized routing architecture to a multi-dimensional distributed architecture. By deploying virtual routers and firewalls across multiple compute nodes in parallel, the system adds spatial dimensionality to the routing architecture, enabling simultaneous handling of multiple traffic flows across different subnets without overloading a single node.
2Productivity
If distributed virtual routing is used to overcome insufficient processing capability, then network node processing capability improves, but firewalls cannot establish connection tracking for packets between virtual machines across different subnets
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of integrated bridges that connect virtual machine bridges across different compute nodes. When a virtual machine on one compute node communicates with a virtual machine on another compute node, the packets pass through the integrated bridge which maintains connection tracking state. This intermediary ensures that even in the distributed architecture, connection tracking is preserved for cross-subnet traffic by providing a central point for state management.
Solution Approach 2:
The integrated bridge serves multiple functions: it acts as a network switch for forwarding packets between virtual machines on the same compute node, serves as a gateway for cross-compute node communication, and maintains connection tracking state for firewall operations. This multi-functional design allows the system to maintain centralized routing capabilities while operating in a distributed architecture.
3Adaptability or versatility
If a firewall is deployed in the virtual machine bridge namespace in distributed routing, then the firewall can receive request packets, but it cannot receive response packets and discard request packets
Solution Approach 1:
The patent merges the firewall functionality with the integrated bridge operation. Instead of having separate firewall and routing components, the firewall rules are integrated into the bridge's packet forwarding logic. This ensures that both request packets and response packets are subject to the same firewall rules and connection tracking, preventing the issue where response packets bypass the firewall and cause request packet discarding.
Data Source
AI summary
A firewall configuration method, applied to a cloud computing management platform, includes determining, by a compute node, a subnet associated with firewall policy information, determining that a virtual machine that belongs to the subnet is deployed on the compute node, and delivering the firewall policy information to a network access control list corresponding to the subnet. The network access control list and a local list of a virtual machine bridge of the virtual machine are in a jump relationship.