Assurance of security rules in a network
In some examples, a system creates a requirement including EPG selectors representing EPG pairs, a traffic selector, and a communication operator; determines that EPGs in distinct pairs are associated with different network contexts and, for each pair, which network context(s) contains associated policies; creates first data representing the pair, operator, and traffic selector; when only one network context contains the associated policies, creates second data representing a network model portion associated with the only network context and determines whether the first data is contained in the second data to yield a first check; when both network contexts contain the associated policies, also creates third data representing a network model portion associated with a second network context, and determines whether the first data is contained in the second and/or third data to yield a second check; and determines whether policies for the pairs comply with the requirement based on the checks.
1 . A system comprising:
one or more processors; and
at least one non-transitory computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to:
create a security compliance requirement for a network;
determine that respective groups in one or more pairs of endpoint groups are associated with respective different network contexts, wherein the respective different network contexts comprise one or more of a private network context, a network domain contact, a virtual routing and forwarding instance context, and a bridge domain context;
for a respective pair of endpoint groups of the one or more pairs of endpoint groups, create a first respective data structure representing the respective pair of endpoint groups;
create a second respective data structure representing a first portion of a logical model of the network, the first portion of the logical model containing policies corresponding to one context of the respective different network contexts;
determine whether the first respective data structure is contained in the second respective data structure, by evaluating one or more of a binary decision diagram, a reduced ordered binary decision diagram, or an n-bit vector representing respective policies, to yield a containment check, wherein the first respective data structure and the second respective data structure represent the respective different network contexts;
determine, in response to the containment check, whether policies for traffic between respective groups in the one or more pairs of endpoint groups comply with the security compliance requirement across the respective different network contexts to obtain a policy determination; and
generate, in response to the policy determination, one or more compliance assurance events.
2 . The system of claim 1 , wherein the at least one non-transitory computer-readable storage medium stores additional instructions which, when executed by the one or more processors, cause the system to:
determine that the respective different network contexts contain policies for traffic between the respective groups in the one or more pairs of groups; and
based on the respective different network contexts containing policies for traffic between the respective groups in the one or more pairs of groups, create a third respective data structure representing a second portion of the logical model, the second portion of the logical model containing policies associated with one determined context of the respective different network contexts.
3 . The system of claim 2 , wherein determining whether the first respective data structure is contained in the second respective data structure comprises determining whether the first respective data structure is contained in both the second respective data structure and the third respective data structure.
4 . The system of claim 3 , wherein the first respective data structure, the second respective data structure and the third respective data structure comprise at least one of the binary decision diagram, the reduced ordered binary decision diagram, and the n-bit vector.
5 . The system of claim 1 , wherein the second respective data structure is created in response to a determination that only one of the respective different network contexts contains policies for traffic between the respective groups in the one or more pairs of groups.
6 . The system of claim 1 , wherein the at least one non-transitory computer-readable storage medium stores additional instructions which, when executed by the one or more processors, cause the system to:
determine, for each of the one or more pairs of groups, that at least one of the respective different network contexts contains policies for traffic between the respective groups in the one or more pairs of groups.
7 . The system of claim 1 , wherein the at least one non-transitory computer-readable storage medium stores additional instructions which, when executed by the one or more processors, cause the system to:
compare one or more first data structures representing the security compliance requirement with one or more second data structures representing hardware policy entries configured on network devices in the network to obtain a comparison, the one or more first data structures and the one or more second data structures comprising at least one of the binary decision diagram, the reduced ordered binary decision diagram, and the n-bit vector; and
based on the comparison, determine whether a state of the network complies with the security compliance requirement.
8 . The system of claim 7 , wherein determining whether a state of the network complies with the security compliance requirement comprises determining whether the hardware policy entries configured on the network devices in the network satisfy, violate, or apply the security compliance requirement.
9 . The system of claim 1 , wherein the one or more compliance assurance events indicate that one or more of the policies satisfy, violate, or do not apply the security compliance requirement and wherein the at least one non-transitory computer-readable storage medium stores additional instructions which, when executed by the one or more processors, cause the system to:
present at least one of:
a first indication that the security compliance requirement is satisfied, violated, or not applied by one or more of the policies on the network;
a second indication of a cause for the security compliance requirement being satisfied, violated, or not applied; and
a third indication of at least one of an event severity, a number of security compliance issues, a compliance score, a security compliance issues count by category, and a compliance score by category, wherein the category comprises at least one of a type of security compliance requirement, a type of resource affected, and a policy object affected.
10 . A method comprising:
creating a security compliance requirement for a network;
determining that respective groups in one or more pairs of endpoint groups are associated with different network contexts, wherein the different network contexts comprise one or more of a private network context, a network domain contact, a virtual routing and forwarding instance context, and a bridge domain context;
for a respective pair of endpoint groups of the one or more pairs of endpoint groups, creating a first respective data structure representing the respective pair of endpoint groups;
creating a second respective data structure representing a first portion of a logical model of the network, the first portion of the logical model containing policies corresponding to one context of the different network contexts;
determining whether the first respective data structure is contained in the second respective data structure, by evaluating one or more of a binary decision diagram, a reduced ordered binary decision diagram, or an n-bit vector representing respective policies, to yield a containment check, wherein the first respective data structure and the second respective data structure represent the different network contexts;
determining, in response to the containment check, whether policies for traffic between respective groups in the one or more pairs of endpoint groups comply with the security compliance requirement across the different network contexts to obtain a policy determination; and
generating, in response to the policy determination, one or more compliance assurance events.
11 . The method of claim 10 , further comprising:
determining that the different network contexts contain policies for traffic between the respective groups in the one or more pairs of groups; and
based on the different network contexts containing policies for traffic between the respective groups in the one or more pairs of groups, creating a third respective data structure representing a second portion of the logical model, the second portion of the logical model containing policies associated with one of the different network contexts.
12 . The method of claim 11 , wherein determining whether the first respective data structure is contained in the second respective data structure comprises determining whether the first respective data structure is contained in both the second respective data structure and the third respective data structure.
13 . The method of claim 12 , wherein the first respective data structure, the second respective data structure and the third respective data structure comprise at least one of the binary decision diagram, the reduced ordered binary decision diagram, and the n-bit vector.
14 . The method of claim 10 , wherein the second respective data structure is created in response to a determination that only one of the different network contexts contains policies for traffic between the respective groups in the one or more pairs of groups.
15 . The method of claim 10 , further comprising:
comparing one or more first data structures representing the security compliance requirement with one or more second data structures representing hardware policy entries configured on network devices in the network to obtain a comparison, the one or more first data structures and the one or more second data structures comprising at least one of the binary decision diagram, the reduced ordered binary decision diagram, and the n-bit vector; and
based on the comparison, determining whether the hardware policy entries configured on the network devices in the network satisfy, violate, or apply the security compliance requirement.
16 . The method of claim 10 , wherein the one or more compliance assurance events indicates that one or more of the policies satisfy, violate, or do not apply the security compliance requirement, the method further comprising:
presenting at least one of:
a first indication that the security compliance requirement is satisfied, violated, or not applied by one or more of the policies on the network;
a second indication of a cause for the security compliance requirement being satisfied, violated, or not applied; and
a third indication of at least one of an event severity, a number of security compliance issues, a compliance score, a security compliance issues count by category, and a compliance score by category, wherein the category comprises at least one of a type of security compliance requirement, a type of resource affected, and a policy object affected.
17 . At least one non-transitory computer-readable storage medium having stored therein instructions which, when executed by one or more processors, cause the one or more processors to:
create a security compliance requirement for a network;
determine that respective groups in one or more pairs of endpoint groups are associated with different network contexts, wherein the different network contexts comprise one or more of a private network context, a network domain contact, a virtual routing and forwarding instance context, and a bridge domain context;
for a respective pair of endpoint groups of the one or more pairs of endpoint groups, create a first respective data structure representing the respective pair of endpoint groups; create a second respective data structure representing a first portion of a logical model of the network, the first portion of the logical model containing policies corresponding to one context of the different network contexts;
determine whether the first respective data structure is contained in the second respective data structure, by evaluating one or more of a binary decision diagram, a reduced ordered binary decision diagram, or an n-bit vector representing respective policies, to yield a containment check, wherein the first respective data structure and the second respective data structure represent the different network contexts;
determine in response to the containment check, whether policies for traffic between respective groups in the one or more pairs of endpoint groups comply with the security compliance requirement across the different network contexts to obtain a policy determination; and
generate, in response to the policy determination, one or more compliance assurance events.
18 . The at least one non-transitory computer-readable storage medium of claim 17 , wherein the instructions, when executed by the one or more processors, cause the one or more processors to:
determine that the different network contexts contain policies for traffic between the respective groups in the one or more pairs of groups; and
based on the different network contexts containing policies for traffic between the respective groups in the one or more pairs of groups, create a third respective data structure representing a second portion of the logical model, the second portion of the logical model containing policies associated with one of the different network contexts;
wherein determining whether the first respective data structure is contained in the second respective data structure comprises determining whether the first respective data structure is contained in both the second respective data structure and the third respective data structure.