Distributed Logical Firewall Configuration for VM Mobility and Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network management systems struggle to balance scalability, mobility, and multi-tenancy in large enterprise networks, particularly in the context of virtual machine migration and dynamic workloads, often requiring extensive network knowledge and complicating user isolation.
Innovation Solution
A system that allows multiple logical firewalls to be specified across shared firewall elements, distributed across physical machines hosting virtual machines, with each machine operating virtualized firewall instances and managed switching elements for logical forwarding, utilizing a network control system to configure and manage these elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional low-level configuration of individual network components is used, then network control is achieved, but network management complexity increases and scalability is hampered
Solution Approach 1:
The patent introduces a network controller as an intermediary component that centralizes the management of network switching elements. The controller maintains a view of network state and provides an API for management applications, eliminating the need for low-level manual configuration of individual components. This mediator approach simplifies network management operations while maintaining control over complex network infrastructure.
Solution Approach 2:
The network controller serves multiple functions: it maintains network state information, provides management APIs, controls forwarding behavior of switching elements, and supports various management applications. This multi-functional approach consolidates what would otherwise require multiple separate systems, reducing overall system complexity while improving ease of operation.
2Adaptability or versatility
If virtual machine migration and dynamic workloads are supported, then network mobility is improved, but maintaining user isolation becomes more complicated
Solution Approach 1:
The network controller acts as a mediator that handles the complexity of maintaining user isolation during virtual machine migration. It tracks network state and manages the coordination between switching elements to ensure isolation is maintained even as workloads move dynamically across the network infrastructure.
Solution Approach 2:
The system implements feedback mechanisms where the network controller continuously monitors network state and adjusts forwarding behavior accordingly. This feedback loop ensures that user isolation policies are dynamically enforced even as virtual machines migrate, with the controller receiving updates about network state and responding by adjusting control logic at switching elements.
3Ease of operation
If network controller maintains comprehensive network state view, then management decision-making is improved, but system resource consumption increases
Solution Approach 1:
The patent extracts and maintains only the essential network state information needed for management decisions in the network controller, rather than maintaining complete detailed state of all network components. This selective extraction approach provides sufficient information for effective management decision-making while reducing the resource consumption associated with maintaining comprehensive network state.
Data Source
AI summary
Some embodiments provide a method for configuring a logical firewall in a hosting system that includes a set of nodes. The logical firewall is part of a logical network that includes a set of logical forwarding elements. The method receives a configuration for the firewall that specifies packet processing rules for the firewall. The method identifies several of the nodes on which to implement the logical forwarding elements. The method distributes the firewall configuration for implementation on the identified nodes. At a node, the firewall of some embodiments receives a a packet, from a managed switching element within the node, through a software port between the managed switching element and the distributed firewall application. The firewall determines whether to allow the packet based on the received configuration. When the packet is allowed, the firewall the packet back to the managed switching element through the software port.