Systems and methods for applying policies in a datacenter environment
A method is described herein comprising one or more applications running on at least one processor for segmenting applications in a networked environment, the one or more applications communicatively coupled with the applications, the one or more applications providing receiving network flow information of the applications from at least one source, using the network flow information to discover a plurality of policies in a first policy enforcement environment, receiving the discovered plurality of policies in a first format according to a first policy naming convention, mapping the discovered plurality of policies from the first format to a second format following a second policy naming convention, enforcing at least a portion of the discovered plurality of policies in the first policy enforcement environment using the first format, and enforcing at least a portion of the discovered plurality of policies in a second policy enforcement environment using the second format.
1 . A method comprising,
one or more applications running on at least one processor for performing segmentation of a plurality of applications in a networked environment, the one or more applications communicatively coupled with the plurality of applications, the one or more applications for providing,
receiving network flow information of the plurality of applications from at least one source;
using the network flow information to discover a plurality of policies in a first policy enforcement environment,
wherein the discovering the plurality of policies comprises applying a Cisco Secure Workload (CSW) application dependency mapping (ADM) to the plurality of applications using the network flow information,
wherein the discovering includes prioritizing the plurality of applications for segmentation, wherein each application corresponds to a runtime environment in the networked environment;
wherein the prioritizing comprises assigning application metrics to each application/runtime environment (app/env) combination,
wherein the application metrics comprise application breadth for each respective app/env combination, wherein the application breadth indicates dependence of other applications of the plurality of applications upon the respective app/env combination;
receiving the discovered plurality of policies in a first format according to a first policy naming convention;
mapping the discovered plurality of policies from the first format to a second format following a second policy naming convention;
enforcing at least a portion of the discovered plurality of policies in the first policy enforcement environment using the first format, wherein the enforcing comprises allowing first network traffic in the first policy enforcement environment to be forwarded only to the plurality of applications as permitted by the at least a portion of the discovered plurality of policies using the first format; and
enforcing at least a portion of the discovered plurality of policies in a second policy enforcement environment using the second format, wherein the enforcing comprises allowing second network traffic in the second policy enforcement environment to be forwarded only to the plurality of applications as permitted by the at least a portion of the discovered plurality of policies using the second format.
2 . The method of claim 1 , wherein the first policy enforcement environment comprises a CSW environment.
3 . The method of claim 2 , wherein the second policy enforcement environment comprises an Application Centric Infrastructure (ACI) environment.
4 . The method of claim 3 , wherein CSW agents are deployed to servers hosting at least a portion of the plurality of applications, wherein the at least one source comprises the CSW agents.
5 . The method of claim 4 , wherein the network flow information comprises network activity of applications reported by corresponding CSW agents.
6 . The method of claim 5 , wherein the ACI environment comprises network switches, wherein an Encapsulated Remote Switch Port Analyzer (ERSPAN) resides on and monitors traffic of each network switch, wherein the at least one source comprises the ERSPANs.
7 . The method of claim 6 , wherein the segmentation proceeds until Ternary Content Addressable Memory resources of the ACI environment switches are exhausted.
8 . The method of claim 7 , further comprising analyzing the plurality of discovered policies prior to enforcement in the second policy enforcement environment.
9 . The method of claim 8 , wherein the analyzing comprises applying the plurality of discovered policies to historical netflow data in the second policy enforcement environment and identifying unexpected drops.
10 . The method of claim 6 , wherein the network flow information comprises an export from the ERSPANs.
11 . The method of claim 10 , wherein the ADM discovers and visualizes dependencies among groupings of the plurality of applications.
12 . The method of claim 11 , wherein the CSW agents enforce at least a portion of the discovered plurality of policies at a host firewall level.
13 . The method of claim 12 , wherein the first format comprises a CSW environment naming convention.
14 . The method of claim 13 , wherein the second format comprises an ACI environment naming convention.
15 . The method of claim 14 , wherein the mapping comprises translating the discovered plurality of policies from the first naming convention to the second naming convention, wherein the second naming convention defines contracts in the ACI environment.
16 . The method of claim 15 , wherein the contracts comprise filters defining protocols and ports of permitted network traffic among groupings of the plurality of applications.
17 . The method of claim 1 , wherein the application metrics comprise application criticality (ACM), wherein the ACM indicates on a scale one to five how critical the app/env is to an enterprise served by the plurality of applications, with a score of one indicating the highest criticality.
18 . The method of claim 17 , wherein the application metrics comprise an application server count (ASC), wherein the ASC comprises a number of servers corresponding to the app/env combination.
19 . The method of claim 18 , wherein the application metrics comprise an application address count (AAC), wherein the AAC comprises a number of internet protocol addresses assigned to the app/env combination.
20 . The method of claim 19 , wherein the application breadth comprises a scale of one to five with a score of one indicating the greatest dependency.
21 . The method of claim 20 , wherein the prioritizing comprises grouping app/env combinations by the ACM score.
22 . The method of claim 21 , wherein the prioritizing comprises selecting a most critical grouping according to the ACM score.
23 . The method of claim 22 , wherein the prioritizing comprises further subgrouping applications in the selected grouping according to environment.
24 . The method of claim 23 , wherein the prioritizing comprises selecting a most critical environment subgrouping according to a priority.
25 . The method of claim 24 , wherein the prioritizing comprises ranking applications in the environment subgrouping from lowest to highest ASC score.
26 . The method of claim 25 , wherein the prioritizing comprises further ranking applications in the environment subgrouping with a common ASC score from lowest to highest AAC score.
27 . The method of claim 26 , wherein the prioritizing comprises further ranking applications in the environment subgrouping with a common AAC score from lowest to highest application breadth score.
28 . The method of claim 27 , wherein the prioritizing comprises iteratively selecting the next most critical environment subgrouping of applications and performing the further ranking of applications in that environment subgrouping.
29 . The method of claim 28 , wherein the prioritizing comprises iteratively selecting the next most critical grouping according to the ACM score and performing the further ranking of applications in the corresponding subgroupings.