Methods and apparatus to provide a distributed firewall in a network

1. A method, comprising:

identifying, by executing an instruction with a processor, at a control plane, a network traffic rule to implement in a network, the network traffic rule including at least one of a traffic routing rule, a traffic filtering rule, and a traffic load balancing rule;

determining, by executing an instruction with the processor, at the control plane, a distributed firewall for a first firewall in the network to enforce the network traffic rule;

instructing, using the control plane, a first software-defined networking node to use a virtual machine to implement a firewall software application, the first virtual machine to operate as the first firewall of the distributed firewall;

configuring, by executing an instruction with the processor, a second software-defined networking node to route network traffic through the first firewall;

instructing, by executing an instruction with the processor, a third software defined networking node to implement a second firewall of the distributed firewall by modifying a first firewall policy of the second firewall at the third software-defined networking node to apply the network traffic rule to network traffic that reaches the second firewall; and

instructing, by executing an instruction with the processor, the first software-defined networking node to enforce the network traffic rule by executing the first firewall using a second firewall policy, the first firewall policy being independent from the second firewall policy.

2. The method as defined in claim 1 , wherein the first and second firewalls are part of the distributed firewall.

3. The method as defined in claim 1 , further including:

identifying, at the control plane, a change to the network traffic rule to implement in the network;

identifying, at the control plane, a set of software-defined networking nodes on which firewalls of the distributed firewall are implemented; and

transmitting instructions from the control plane to the set of software-defined networking nodes to cause the firewalls to implement the change to the network traffic rule, the instructions to the software-defined networking nodes in the set being respectively customized for the firewall to which the instructions are transmitted.

4. The method as defined in claim 1 , wherein determining the distributed firewall for the network to enforce the network traffic rule includes:

determining, at the control plane, a portion of the network to which the network traffic rule is to be applied;

identifying, at the control plane, software-defined networking nodes in the network to serve the portion of the network;

transmitting instructions to a first portion of the identified software-defined networking nodes to cause the first portion of the identified software-defined networking nodes to instantiate respective firewall software applications; and

transmitting instructions to the identified software-defined networking nodes to cause the identified software-defined networking nodes to implement the traffic rule via respective firewall software applications.

5. A software-defined networking node, comprising:

a processor; and

memory storing computer readable instructions which, when executed, cause the processor to perform operations, the operations including:

identifying a network traffic rule to implement in a network, the network traffic rule including at least one of a traffic routing rule, a traffic filtering rule, and a traffic load balancing rule;

determining a distributed firewall for a first firewall in the network to enforce the network traffic rule;

instructing a first software-defined networking node to instantiate the first firewall using a virtual machine, the virtual machine to implement a firewall software application;

configuring a second software-defined networking node to route network traffic through the first firewall;

instructing a third software-defined networking node to execute a second firewall of the distributed firewall by modifying a first firewall policy of the second firewall at the third software-defined networking node to apply the network traffic rule to network traffic that reaches the second firewall; and

instructing the first software-defined networking node to execute the first firewall using a second firewall policy, the first firewall policy being independent from the second firewall policy.

6. The networking node as defined in claim 5 , wherein instructing the first software-defined networking node includes instructing an edge network node.

7. The networking node as defined in claim 5 , wherein the instructions are further to cause the processor to:

identify a change to the network traffic rule to implement in the network;

identify a set of software-defined networking nodes on which firewalls of the distributed firewall are implemented; and

transmit instructions to the set of software-defined networking nodes to cause the firewalls to implement the change to the network traffic rule, the instructions to the software-defined networking nodes in the set being respectively customized for the firewall to which the instructions are transmitted.

8. The networking node as defined in claim 5 , wherein the instructions are to cause the processor to determine the distributed firewall for the network to enforce the network traffic rule by:

determining a portion of the network to which the network traffic rule is to be applied;

identifying software-defined networking nodes in the network to serve the portion of the network;

transmitting instructions to a first portion of the identified software-defined networking nodes to cause the first portion of the identified software-defined networking nodes to instantiate respective firewall software applications; and

transmitting instructions to the identified software-defined networking nodes to cause the identified software-defined networking nodes to implement the traffic rule via respective firewall software applications.

9. A non-transitory computer readable storage medium comprising computer readable instructions which, when executed, cause a processor of a software-defined networking node to perform operations including:

identifying a network traffic rule to implement in a network;

determining a distributed firewall for a first firewall in the network to enforce the network traffic rule;

instructing a first software-defined networking node to instantiate the first firewall using a virtual machine, the virtual machine to implement a firewall software application;

configuring a second software-defined networking node to route network traffic through the first firewall;

instructing a third software-defined networking node to execute a second firewall of the distributed firewall by modifying a first firewall policy of the second firewall at the third software-defined networking node to apply the network traffic rule to network traffic that reaches the second firewall; and

instructing the first software-defined networking node to execute the first firewall using a second firewall policy, the first firewall policy being independent from the second firewall policy.

10. The non-transitory computer readable storage medium as defined in claim 9 , wherein the instructions are further to cause the processor to:

identify a change to the network traffic rule to implement in the network;

identify a set of software-defined networking nodes on which firewalls of the distributed firewall are implemented; and

transmit instructions to the set of software-defined networking nodes to cause the firewalls to implement the change to the network traffic rule, the instructions to the software-defined networking nodes in the set being respectively customized for the firewall to which the instructions are transmitted.

11. The non-transitory computer readable storage medium as defined in claim 9 , wherein the instructions are to cause the processor to determine the distributed firewall for the network to enforce the network traffic rule by:

determining a portion of the network to which the network traffic rule is to be applied;

identifying software-defined networking nodes in the network to serve the portion of the network;

transmitting instructions to a first portion of the identified software-defined networking nodes to cause the first portion of the identified software-defined networking nodes to instantiate respective firewall software applications; and

transmitting instructions to the identified software-defined networking nodes to cause the identified software-defined networking nodes to implement the traffic rule via respective firewall software applications.