Reflexive ACL Synchronization on Virtual Switches
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Reflexive access control lists (ACLs) do not function effectively on virtual switches, which are configurations of multiple physical switches acting as a single entity, leading to issues with network traffic filtering and security, as they fail to allow reverse flows and are not synchronized across the physical switches.
Innovation Solution
Implementing a reflexive ACL sync component that forwards packets with set SYN flags across physical switches forming a virtual switch, ensuring that both switches create and maintain synchronized reflexive ACL entries to allow network flows, even if the return packets are received by a different physical switch.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reflexive ACLs are configured on physical switches to filter network traffic, then network security is improved, but the ACLs fail to work on virtual switches composed of multiple physical switches
Solution Approach 1:
The patent segments the virtual switch into multiple physical switches (first physical switch and second physical switch), each maintaining its own reflexive ACL. This allows the ACL functionality to be distributed across the physical components while collectively providing virtual switch security.
Solution Approach 2:
The patent implements a feedback mechanism where the first physical switch monitors packets and creates reflexive ACL entries, then synchronizes these entries to the second physical switch. This feedback loop ensures both switches have consistent ACL states, enabling coordinated security enforcement across the virtual switch.
2Productivity
If multiple physical switches are configured to operate as a single virtual switch, then bandwidth and failover capability are improved, but reflexive ACLs cannot be synchronized across the physical switches
Solution Approach 1:
The first physical switch monitors outgoing packets and creates reflexive ACL entries, then synchronizes these entries to the second physical switch through a feedback mechanism. This ensures both switches maintain consistent ACL states despite operating independently.
Solution Approach 2:
The patent copies reflexive ACL entries from the first physical switch to the second physical switch. This copying mechanism ensures that both switches have identical ACL information, preventing packet dropping due to asymmetric ACL states.
3Reliability
If reflexive ACL entries are created on one physical switch, then traffic filtering is improved, but return packets received by a different physical switch are dropped
Solution Approach 1:
When the first physical switch creates a reflexive ACL entry for outbound traffic, it synchronizes this entry to the second physical switch through feedback. This ensures that when return packets arrive at the second switch, the ACL allows them to pass through, enabling bidirectional traffic flow.
Solution Approach 2:
The patent merges the ACL states of multiple physical switches by synchronizing reflexive ACL entries across them. This creates a unified ACL state that behaves as if a single virtual switch is enforcing the rules, allowing seamless bidirectional traffic flow.
Data Source
AI summary
Techniques for providing a reflexive access control list (ACL) on a virtual switch are provided. Embodiments receive a first packet corresponding to a first network flow and a second packet corresponding to a second network flow. Upon determining that a SYN flag is set within the first packet, a first entry is created in the reflexive ACL for the first network flow. Upon determining that the first packet was received over a client port of the first physical switch, the first packet is forwarded to a second physical switch within virtual switch. Upon determining that the second packet has a SYN flag enabled, a second entry is created in the reflexive ACL. Finally, upon determining that the second packet was received from the second physical switch, the second packet is forwarded over an uplink port to a destination defined by the second packet.