System and method for distribution of policy enforcement point

• US 9,215,177 B2
• Filed: 06/24/2013
• Issued: 12/15/2015
• Est. Priority Date: 06/24/2013
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Jain, Jayant, Sengupta, Anirban, Basak, Debashis, Maskalik, Serge, Wu, Weiqing, Srinivasan, Aravind, Sabin, Todd
• Primary Examiner(s): Chung, Hoon J
• Application Number:
  US13/925,483
• Publication Number:
  US 20140376367A1
• Time in Patent Office: 904 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

The disclosure herein describes an edge device of a network for distributed policy enforcement. During operation, the edge device receives an initial packet for an outgoing traffic flow, and identifies a policy being triggered by the initial packet. The edge device performs a reverse lookup to identify at least an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node. The edge device translates the policy based on the traffic parameters at the intermediate node, and forwards the translated policy to the intermediate node, thus facilitating the intermediate node in applying the policy to the traffic flow.

Claims

1. A computer-implemented method for distributed policy enforcement in a network, comprising:

receiving, at an edge device, an initial packet for a traffic flow going out of the network;

determining that the initial packet triggers an edge policy maintained at the edge device;

performing a reverse lookup to identify at least;

an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node;

translating the edge policy based on the traffic parameters at the identified intermediate node; and

forwarding the translated edge policy to the identified intermediate node, thereby facilitating the identified intermediate node in applying the edge policy to the traffic flow.

2. The method of claim 1, wherein the network includes a tenant network in a multi-tenant datacenter.

3. The method of claim 1, wherein the reverse lookup involves at least one of:

identifying a network address translation (NAT) rule; and

looking up a NAT translation table.

4. The method of claim 1, wherein the edge policy includes one or more of:

firewall rules;

access-control policies; and

quality of service policies.

5. The method of claim 1, further comprising:

determining that the intermediate node is not immediately adjacent to a destination of the initial packet; and

forwarding the translated edge policy to a second intermediate node that is closer to the destination than the intermediate node.

6. The method of claim 1, further comprising allowing remaining packets of the traffic flow to pass through the edge device.

7. The method of claim 1, further comprising:

receiving an incoming packet; and

forwarding a second edge policy associated with the incoming packet to a next-hop node.

8. The method of claim 7, further comprising:

identifying changes to traffic parameters associated with the incoming packet before the incoming packet reaches the next-hop node; and

translating the second edge policy based on the identified changes.

9. The method of claim 1, wherein the traffic parameters include one or more of:

a source address;

a destination address;

a source port number; and

a destination port number.

10. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for distributed policy enforcement in a network, the method comprising:

receiving, at an edge device, an initial packet for a traffic flow going out of the network;

determining that the initial packet triggers an edge policy maintained at the edge device;

performing a reverse lookup to identify at least;

an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node;

translating the edge policy based on the traffic parameters at the identified intermediate node; and

forwarding the translated edge policy to the identified intermediate node, thereby facilitating the identified intermediate node in applying the edge policy to the traffic flow.

11. The non-transitory computer-readable storage medium of claim 10, wherein the network includes a tenant network in a multi-tenant datacenter.

12. The non-transitory computer-readable storage medium of claim 10, wherein the reverse lookup involves at least one of:

identifying a network address translation (NAT) rule; and

looking up a NAT translation table.

13. The non-transitory computer-readable storage medium of claim 10, wherein the edge policy includes one or more of:

firewall rules;

access-control policies; and

quality of service policies.

14. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises:

determining that the intermediate node is not immediately adjacent to a destination of the initial packet; and

forwarding the translated edge policy to a second intermediate node that is closer to the destination than the intermediate node.

15. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises allowing remaining packets of the traffic flow to pass through the edge device.

16. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises:

receiving an incoming packet;

forwarding a second edge policy associated with the incoming packet to a next-hop node.

17. The non-transitory computer-readable storage medium of claim 16, wherein the method further comprises:

identifying changes to traffic parameters associated with the incoming packet before the incoming packet reaches the next-hop node; and

translating the second edge policy based on the identified changes.

18. The non-transitory computer-readable storage medium of claim 10, wherein the traffic parameters include one or more of:

a source address;

a destination address;

a source port number; and

a destination port number.

19. An edge device for distributed policy enforcement in a network, comprising:

a receiving mechanism configured to receive an initial packet for a traffic flow going out of the network;

a determination mechanism configured to determining that the initial packet triggers an edge policy maintained at the edge device;

a lookup mechanism configured to perform a reverse lookup to identify at least;

an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node;

a policy translator configured to translate the edge policy based on the traffic parameters at the identified intermediate node; and

a policy-forwarding mechanism configured to forward the translated edge policy to the identified intermediate node, thereby facilitating the identified intermediate node in applying the edge policy to the traffic flow.

20. The edge device of claim 19, wherein while performing the reverse lookup, the lookup mechanism is configured to perform one of:

identifying a network address translation (NAT) rule; and

looking up a NAT translation table.