Self-service firewall configuration
A novel method for managing firewall configuration of a software defined data center is provided. Such a firewall configuration is divided into multiple sections that each contains a set of firewall rules. Each tenant of the software defined data center has a corresponding set of sections in the firewall configuration. The method allows each tenant to independently access and update/manage its own corresponding set of sections. Multiple tenants or users are allowed to make changes to the firewall configuration simultaneously.
1. A method for managing firewall configuration of a multi-tenant software defined data center (SDDC) that provides computing and networking resources to a plurality of tenants, the method comprising:
storing a firewall rule configuration comprising a plurality of firewall-rule sections, each firewall-rule section comprising a set of firewall rules, wherein each tenant has a set of machines deployed in the SDDC and a set of one or more firewall-rule sections in the plurality of firewall-rule sections that is not accessible by other tenants;
through a firewall configuration interface comprising a plurality of interfaces, providing each tenant access to the tenant's set of sections through a particular interface associated with the tenant in the plurality of interfaces while preventing access to another tenant's firewall-rule sections through the particular interface associated with the tenant; and
concurrently processing access to different sections by different tenants through the different interfaces.
2. The method of claim 1 , wherein the plurality of firewall-rule sections are prioritized, wherein applying firewall service to a packet comprises identifying an applicable firewall rule by examining a higher priority firewall-rule section before examining a lower priority firewall-rule section.
3. The method of claim 2 , wherein the plurality of firewall-rule sections comprises a highest priority firewall-rule section and a lowest priority firewall-rule section that include rules that are applicable to all tenants of the software defined data center.
4. The method of claim 1 wherein each tenant-specific set of firewall-rule sections comprises rules that are not applicable to other tenants.
5. The method of claim 1 , wherein each interface in the plurality of interfaces comprises a user interface element for inserting a firewall-rule section to, and removing a firewall-rule section from, the corresponding set of firewall-rule sections for the tenant.
6. The method of claim 1 , wherein each interface in the plurality of interfaces comprises an application programming interface (API) that complies with REST (representational state transfer).
7. The method of claim 1 , wherein each interface in the plurality of interfaces comprises a user interface element for inserting a rule to, and removing a rule from, a firewall-rule section belonging to the tenant.
8. The method of claim 5 , wherein inserting or removing a new firewall-rule section to the firewall rule configuration comprises changing the priority assignment of a set of firewall-rule sections already in the firewall rule configuration.
9. The method of claim 8 , wherein the tenant is a first tenant, wherein when the first tenant inserts or removes a firewall-rule section of the firewall rule configuration a second, different tenant is prevented from inserting or removing a firewall-rule section in the firewall rule configuration while the first tenant is changing the priority assignment of the set of firewall-rule sections already in the firewall rule configuration.
10. A computing device for managing firewall configuration of a multi-tenant software defined data center (SDDC) that provides computing and networking resources to a plurality of tenants, the computing device comprising:
a set of hardware processing units; and
a non-transitory computer readable storage medium storing a program for execution by the set of processing units, the program comprising sets of instructions for:
storing a firewall rule configuration comprising a plurality of firewall-rule sections, each firewall-rule section comprising a set of firewall rules, wherein each tenant has a set of machines deployed in the SDDC and a set of one or more firewall-rule sections in the plurality of firewall-rule sections that is not accessible by other tenants;
through a firewall configuration interface comprising a plurality of interfaces, providing each tenant access to the tenant's set of sections through a particular interface associated with the tenant in the plurality of interfaces while preventing access to another tenant's firewall-rule sections through the particular interface associated with the tenant; and
concurrently processing access to different sections by different tenants through the different interfaces.
11. The computing device of claim 10 , wherein the plurality of firewall-rule sections are prioritized, wherein applying firewall service to a packet comprises identifying an applicable firewall rule by examining a higher priority firewall-rule section before examining a lower priority firewall-rule section.
12. The computing device of claim 11 , wherein the plurality of firewall-rule sections comprises a highest priority firewall-rule section and a lowest priority firewall-rule section that include rules that are applicable to all tenants of the software defined data center.
13. The computing device of claim 10 wherein each tenant-specific set of firewall-rule sections comprises rules that are not applicable to other tenants.
14. The computing device of claim 10 , wherein each interface in the plurality of interfaces comprises a user interface element for inserting a firewall-rule section to, and removing a firewall-rule section from, the corresponding set of firewall-rule sections for the tenant.
15. The computing device of claim 10 , wherein each interface in the plurality of interfaces comprises an application programming interface (API) that complies with REST (representational state transfer).
16. The computing device of claim 10 , wherein each interface in the plurality of interfaces comprises a user interface element for inserting a rule to, and removing a rule from, a firewall-rule section belonging to the tenant.
17. The computing device of claim 14 , wherein inserting or removing a new firewall-rule section to the firewall rule configuration comprises changing the priority assignment of a set of firewall-rule sections already in the firewall rule configuration.
18. The computing device of claim 17 , wherein the tenant is a first tenant, wherein the set of instructions for allowing the first tenant to insert or to remove a section of the firewall configuration further comprises a set of instructions for preventing a second, different tenant from inserting or removing a section in the firewall configuration while the first tenant is changing the priority assignment of the set of sections already in the firewall configuration.
19. The method of claim 5 , wherein inserting or removing a firewall-rule section of a firewall rule configuration comprises sending an instruction to a network manager that updates the firewall rule configuration.
20. The computing device of claim 14 , wherein inserting or removing a firewall-rule section of a firewall rule configuration comprises sending an instruction to a network manager that updates the firewall rule configuration.
21. The method of claim 1 , wherein rules defined for a first tenant in a firewall-rule section of the first tenant cannot supersede rules for a second tenant defined in a firewall-rule section of the second tenant because rules of the first tenant cannot apply to packets of the second tenant.