SYSTEM AND METHOD FOR DISTRIBUTION OF POLICY ENFORCEMENT POINT

• US 20160191396A1
• Filed: 12/14/2015
• Published: 06/30/2016
• Est. Priority Date: 06/24/2013
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Jain, Jayant, Sengupta, Anirban, Basak, Debashis, Maskalik, Serge, Wu, Weiqing, Srinivasan, Aravind, Sabin, Todd
• Granted Patent: US 9,807,021 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

The disclosure herein describes an edge device of a network for distributed policy enforcement. During operation, the edge device receives an initial packet for an outgoing traffic flow, and identifies a policy being triggered by the initial packet. The edge device performs a reverse lookup to identify at least an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node. The edge device translates the policy based on the traffic parameters at the intermediate node, and forwards the translated policy to the intermediate node, thus facilitating the intermediate node in applying the policy to the traffic flow.

Claims

1. A computer-implemented method for distributed policy enforcement in a network, comprising:

receiving a packet for a traffic flow going out of the network;

performing a reverse lookup to identify an intermediate node and traffic parameters associated with the packet at the identified intermediate node;

translating a policy based on the traffic parameters at the identified intermediate node; and

enabling the identified intermediate node to be apply the policy to the traffic flow.