PNIC-Level Firewall Rules for Virtualized Ingress Packet Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional firewall rules in virtualized computing environments are inefficient, particularly for ingress packets, as they require processing by virtual switches before being dropped, wasting computing resources and affecting host performance.
Innovation Solution
Implementing PNIC-level firewall rules, which are generated from VNIC-level rules and applied at the physical network interface controller level, reducing processing overhead and improving host performance by dropping packets before they reach the virtual switch, and configuring destination-associated firewall rules at the source to prevent unwanted egress packets from being sent, thereby reducing network bandwidth waste.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional VNIC-level firewall rules are applied to ingress packets, then security protection is provided, but processing overhead increases and host performance deteriorates
Solution Approach 1:
The patent applies firewall rules at the PNIC level before packets reach the virtual switch, performing security filtering in advance. This preliminary action prevents unwanted packets from entering the virtualization stack, thereby maintaining security while reducing the processing burden on virtual switches and improving overall host performance.
Solution Approach 2:
The patent introduces a firewall engine that operates at the PNIC level as an intermediary between the physical network interface and the virtual switch. This intermediary component filters packets before they reach the virtualization layer, providing security protection without impacting the performance of the virtual switch and virtual machines.
2Productivity
If PNIC-level firewall rules are applied to ingress packets, then processing overhead is reduced and host performance improves, but rule management complexity increases
Solution Approach 1:
The firewall engine is designed to handle both VNIC-level and PNIC-level firewall rules universally. It can translate high-level VNIC-level rules into appropriate PNIC-level rules, providing a unified rule management interface that simplifies administration while enabling efficient PNIC-level packet filtering.
Solution Approach 2:
The patent copies and adapts existing VNIC-level firewall rules to create corresponding PNIC-level rules. This copying mechanism allows administrators to manage familiar VNIC-level rules while automatically generating the optimized PNIC-level rule set, reducing management complexity while achieving performance benefits.
3Loss of energy
If destination-associated firewall rules are configured at the source, then network bandwidth waste is reduced, but configuration complexity increases
Solution Approach 1:
The centralized firewall controller implements feedback mechanisms to learn from actual network traffic patterns and security requirements. It automatically adjusts and optimizes destination-associated firewall rules at source hosts based on observed traffic flows, reducing bandwidth waste while minimizing configuration complexity through automated adaptation.
Solution Approach 2:
The system enables source hosts to automatically apply destination-associated firewall rules without manual configuration. The firewall controller pushes optimized rules to source hosts, which then self-serve by filtering egress packets locally, reducing network bandwidth waste while eliminating complex manual configuration requirements.
Data Source
AI summary
Example methods are provided for a destination host to implement a firewall in a virtualized computing environment that includes the destination host and a source host. The method may comprise receiving, via a physical network interface controller (PNIC) of the destination host, an ingress packet sent by the source host. The ingress packet may be destined for a destination virtualized computing instance that is supported by the destination host and associated with a destination virtual network interface controller (VNIC). The method may further comprise retrieving a PNIC-level firewall rule associated with the destination virtualized computing instance, the PNIC-level firewall rule being applicable at the PNIC and generated by based on a VNIC-level firewall rule applicable at the destination VNIC. In response to determination that the PNIC-level firewall rule blocks the ingress packet from passing through, the ingress packet may be dropped such that the ingress packet is not sent to the destination VNIC.