Multi-node virtual data storage appliance with internal communications filtering
A storage processor of a set of virtual-machine-implemented storage processors (SPs) of a virtual storage appliance (VSA) is operated to avoid potential mis-communications among non-peer SPs in a virtualized environment having multiple VSAs. An operating method includes receiving a peer-SP identifier that uniquely identifies a peer storage processor of the VSA in network packets sent by the peer storage processor via an internal inter-SP network. The peer-SP identifier, which may be a machine-level network address such as a MAC address, is used to configure a network firewall to accept peer-SP packets and reject non-peer-SP packets from the internal inter-SP network. The network firewall is subsequently operated as configured to accept the peer-SP packets for delivery to the main operating logic of the one storage processor and to reject the non-peer-SP network packets.
1. A method of operating one storage processor of a set of virtual-machine-implemented storage processors of a virtual storage appliance, each storage processor including main operating logic and a network interface, comprising:
receiving a peer-SP identifier uniquely identifying a peer storage processor of the virtual storage appliance in network packets sent by the peer storage processor via an internal inter-SP network;
using the peer-SP identifier to configure a network firewall of the one storage processor to accept peer-SP packets and reject non-peer-SP packets from the internal inter-SP network, the peer-SP packets containing the peer-SP identifier as an identifier of a packet sender, the non-peer-SP packets not containing the peer-SP identifier as an identifier of a packet sender; and
subsequently operating the network firewall as configured to accept the peer-SP packets for delivery to the main operating logic of the one storage processor and to reject the non-peer-SP network packets.
2. The method of claim 1 , wherein the inter-SP network is realized by a virtual network switch configured to forward the network packets sent by the peer storage processor to the one storage processor.
3. The method of claim 2 , wherein the storage processors are executed on respective distinct host computers, and the virtual network switch is a distributed virtual network switch including a physical network switch interconnecting the host computers, along with respective virtual-switch functions within the host computers.
4. The method of claim 1 , wherein the network packets include a network-level address of a packet sender and a machine-level address of the packet sender, the network-level address being a statically assigned network address shared by storage processors of different virtual storage appliances, the machine-level address being unique to each storage processor and serving as the peer-SP identifier identifying the peer-SP packets.
5. The method of claim 4 , wherein the storage appliances include respective pairs of storage processors denoted A and B, the A storage processors of the storage appliances using a first statically assigned network address, and the B storage processors of the storage appliances using a second distinct statically assigned network address.
6. The method of claim 1 , wherein the storage processors have access to a shared storage area to which the storage processors write respective peer-SP identifiers, and wherein receiving a peer-SP identifier includes reading the peer-SP identifier of the peer storage processor from the shared storage area.
7. The method of claim 6 , wherein the network packets include a machine-level address of the packet sender, the machine-level address being unique to each storage processor and serving as the peer-SP identifier written to and read from the shared storage area.
8. The method of claim 7 , wherein using the peer-SP identifier to configure the network firewall includes configuring an instance of iptables network-address filtering.
9. The method of claim 7 , further including statically updating an Address Resolution Protocol table to only send packets to the machine-level address unique to the peer storage processor.
10. The method of claim 7 , further including:
polling the shared storage area for a change of the machine-level address of the peer storage processor; and
upon the polling detecting a change of the machine-level address, updating the configuration of the network firewall to reflect the change of the machine-level address.
11. A non-transitory computer-readable medium storing computer program instructions of a storage processor of a virtual storage appliance, the computer program instructions being executable by a host computer to cause the host computer to perform a method of operating one storage processor of a set of virtual-machine-implemented storage processors of a virtual storage appliance, each storage processor including main operating logic and a network interface, the method including:
receiving a peer-SP identifier uniquely identifying a peer storage processor of the virtual storage appliance in network packets sent by the peer storage processor via an internal inter-SP network;
using the peer-SP identifier to configure a network firewall of the one storage processor to accept peer-SP packets and reject non-peer-SP packets from the internal inter-SP network, the peer-SP packets containing the peer-SP identifier as an identifier of a packet sender, the non-peer-SP packets not containing the peer-SP identifier as an identifier of a packet sender; and
subsequently operating the network firewall as configured to accept the peer-SP packets for delivery to the main operating logic of the one storage processor and to reject the non-peer-SP network packets.
12. The non-transitory computer-readable medium of claim 11 , wherein the inter-SP network is realized by a virtual network switch configured to forward the network packets sent by the peer storage processor to the one storage processor.
13. The non-transitory computer-readable medium of claim 12 , wherein the storage processors are executed on respective distinct host computers, and the virtual network switch is a distributed virtual network switch including a physical network switch interconnecting the host computers, along with respective virtual-switch functions within the host computers.
14. The non-transitory computer-readable medium of claim 11 , wherein the network packets include a network-level address of a packet sender and a machine-level address of the packet sender, the network-level address being a statically assigned network address shared by storage processors of different virtual storage appliances, the machine-level address being unique to each storage processor and serving as the peer-SP identifier identifying the peer-SP packets.
15. The non-transitory computer-readable medium of claim 14 , wherein the storage appliances include respective pairs of storage processors denoted A and B, the A storage processors of the storage appliances using a first statically assigned network address, and the B storage processors of the storage appliances using a second distinct statically assigned network address.
16. The non-transitory computer-readable medium of claim 11 , wherein the storage processors have access to a shared storage area to which the storage processors write respective peer-SP identifiers, and wherein receiving a peer-SP identifier includes reading the peer-SP identifier of the peer storage processor from the shared storage area.
17. The non-transitory computer-readable medium of claim 16 , wherein the network packets include a machine-level address of the packet sender, the machine-level address being unique to each storage processor and serving as the peer-SP identifier written to and read from the shared storage area.
18. The non-transitory computer-readable medium of claim 17 , wherein using the peer-SP identifier to configure the network firewall includes configuring an instance of iptables network-address filtering.
19. The non-transitory computer-readable medium of claim 17 , further including statically updating an Address Resolution Protocol table to only send packets to the machine-level address unique to the peer storage processor.
20. The non-transitory computer-readable medium of claim 17 , wherein the method performed by execution of the instructions further includes:
polling the shared storage area for a change of the machine-level address of the peer storage processor; and
upon the polling detecting a change of the machine-level address, updating the configuration of the network firewall to reflect the change of the machine-level address.
21. The method of claim 1 , wherein receiving the peer-SP identifier and using it to configure the network firewall include:
the one SP writing its own machine-level address to a shared area and checking whether a machine-level address of the peer SP is available in the shared area;
upon the machine-level address of the peer SP being available in the shared area, using it to configure the network firewall to accept packets from the peer SP by specifying an accept filter using the machine-level address of the peer SP;
subsequently initiating operation of the internal inter-SP network for operation, specifically enabling communications of inter-SP connections via which the inter-SP packets are sent and received;
by the network firewall, first determining whether the network firewall has been configured with the machine-level address of the peer SP, and if not then blocking all internal traffic by not forwarding inter-SP communications to the main operating logic of the one SP, and if so then permitting normal operation including forwarding inter-SP communications from only the peer SP to the main operating logic of the one SP.