Providing a virtual security appliance architecture to a virtual cloud infrastructure
A method in an embodiment includes detecting a change for a virtual machine in a virtual server of a virtual network infrastructure, determining whether a virtual security appliance is configured in the virtual server, and sending a request to create the virtual security appliance in the virtual server. The method further includes allowing the virtual machine to initiate when the virtual security appliance is created in the virtual machine. The virtual security appliance performs security inspections on network packets sent from the virtual machine. In more specific embodiments, the method further includes creating an intercept mechanism in the virtual server to intercept the network packets from the virtual machine. In further embodiments, one or more security policies identify one or more virtual security appliances to process the network packets from the virtual machine.
1. At least one machine readable storage medium comprising instructions stored thereon, wherein the instructions, when executed by at least one processor, cause the at least one processor to:
detect a change for a guest virtual machine (VM) associated with a first virtual server of a virtual network infrastructure, wherein the guest VM is associated with a policy, the policy specifies a security control for the guest VM, and the policy is maintained by a distribution manager on the first virtual server;
determine whether a first virtual security appliance (VSA) for applying the security control to the guest VM is present in the first virtual server;
block the guest VM from running in the first virtual server, and send a request to create the first VSA in the first virtual server, wherein the blocking and the sending are based, at least in part, on a determination that the first VSA is not present in the first virtual server;
configure, based, at least in part, on a detection of the change, an intercept mechanism in the first virtual server to intercept network packets from the guest VM, wherein the configuring the intercept mechanism includes virtually wiring a virtual network interface card (vNIC) of another guest VM to a physical switch on a physical network interface card (pNIC) of the first virtual server via a first virtual function (VF) on the pNIC;
receive a signal indicating the first VSA is present in the first virtual server and the intercept mechanism is configured;
subsequent to receiving the signal, allow the guest VM to initiate in the first virtual server; and
configure the first VF as a two-way direct memory access (DMA) channel, wherein the physical switch routes a first network packet received from the guest VM via a second VF to flow through the pNIC to route the first network packet to the distribution manager via a third VF on the pNIC, the distribution manager routes the first network packet to the first VSA, and
the configuring the first VF causes a second network packet from the first VSA to flow through a virtual switch and the third VF to route the second network packet to the other guest VM.
2. The at least one machine readable storage medium of claim 1 , wherein the change is the guest VM being moved from a second virtual server in the virtual network infrastructure to the first virtual server in the virtual network infrastructure.
3. The at least one machine readable storage medium of claim 2 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
delete from the second virtual server an existing VSA for applying the security control; and
reconfigure logic of a virtual switch in the second virtual server to communicate via a virtual network interface card, wherein the existing VSA applied the security control to the guest VM at the second virtual server prior to the guest VM being moved to the first virtual server.
4. The at least one machine readable storage medium of claim 1 , wherein the change is updating the policy or adding the policy.
5. The at least one machine readable storage medium of claim 1 , wherein the change is adding the guest VM to the first virtual server, and the guest VM is new in the virtual network infrastructure.
6. The at least one machine readable storage medium of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
determine a second security control for the guest VM;
identify a second VSA present in the first virtual server, wherein the second VSA is for applying the second security control to the guest VM;
generate a route for network packets, the route including the first VSA and the second VSA; and
sending network packets to the first VSA and the second VSA according to the route.
7. The at least one machine readable storage medium of claim 6 , wherein the route includes a sequential order for the first VSA and the second VSA to process network packets from the guest VM, and the sequential order is specified in at least one policy associated with the guest VM.
8. The at least one machine readable storage medium of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
cause network packets received by a virtual switch from the guest VM to flow through the pNIC by reconfiguring logic of the vNIC to prevent network packets from passing through the vNIC.
9. The at least one machine readable storage medium of claim 1 , wherein the change is detected through an application programming interface (API) of a cloud manager.
10. The at least one machine readable storage medium of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
query the first VSA on the first virtual server to determine a utilization rate of the first VSA;
receive a response to the query indicating the first VSA is over-utilized; and
send a request to create a second VSA in the first virtual server based on the response.
11. The at least one machine readable storage medium of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
query the first VSA on the first virtual server to determine a utilization rate of the first VSA;
receive a response to the query indicating the first VSA is under-utilized;
identify an existing VSA on the first virtual server for applying the security control to the guest VM; and
prevent a further network packet from being sent to the first VSA and delete the first VSA based on the response indicating the first VSA is under-utilized and the identification of the existing VSA.
12. The at least one machine readable storage medium of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
query the first VSA on the first virtual server to determine a utilization rate of the first VSA;
receive a response to the query indicating the first VSA is over-utilized; and
send a request to allocate more resources to the first VSA based on the response, wherein the resources comprise one or more of processor and memory resources.
13. The at least one machine readable storage medium of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
route a packet stream through the first VSA in the first virtual server.
14. The at least one machine readable storage medium of claim 1 , wherein the security control is an intrusion prevention system, a firewall, or data loss prevention.
15. The at least one machine readable storage medium of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
send information identifying a VSA for applying a security control to a second guest VM; and
configure, based, at least in part, on a detection of a change for the second guest VM, an intercept mechanism selected from a group of intercept mechanisms consisting of an OpenFlow switch in the first virtual server and an application programming interface (API) of a virtual switch in the first virtual server, wherein the change comprises one of updating a policy for the second guest VM, adding the policy for the second guest VM, moving the second guest VM to the first virtual server, or adding the second guest VM to the first virtual server.
16. The at least one machine readable storage medium of claim 1 , wherein the distribution manager routes the second network packet to the third virtual function.
17. An apparatus, comprising:
at least one processor; and
at least one memory element including instructions for execution by the at least one processor to
detect a change for a guest virtual machine (VM) associated with a first virtual server of a virtual network infrastructure, wherein the guest VM is associated with a policy, the policy specifies a security control for the guest VM, and the policy is maintained by a distribution manager on the first virtual server;
determine whether a first virtual security appliance (VSA) for applying the security control to the guest VM is present in the first virtual server;
block the guest VM from running in the first virtual server, and send a request to create the first VSA in the first virtual server, wherein the blocking and the sending are based, at least in part, on a determination that the first VSA is not present in the first virtual server;
configure, based, at least in part, on a detection of the change, an intercept mechanism in the first virtual server to intercept network packets from the guest VM, wherein configuring the intercept mechanism includes virtually wiring a virtual network interface card (vNIC) of another guest VM to a physical switch on a physical network interface card (pNIC) of the first virtual server via a first virtual function (VF) on the pNIC;
receive a signal indicating the first VSA is present in the first virtual server and the intercept mechanism is configured;
subsequent to receiving the signal, allow the guest VM to initiate in the first virtual server; and
configure the first VF as a two-way direct memory access (DMA) channel, wherein the physical switch routes a first network packet received from the guest VM via a second VF to flow through the pNIC to route the first network packet to the distribution manager via a third VF on the pNIC, the distribution manager routes the first network packet to the first VSA, and
the configuring the first VF causes a second network packet from the first VSA to flow through a virtual switch and the third VF to route the second network packet to the other guest VM.
18. The apparatus of claim 17 , wherein the instructions are for execution by the at least one processor to:
determine a second security control for the guest VM;
identify a second VSA present in the first virtual server, wherein the second VSA is for applying the second security control to the guest VM;
generate a route for network packets, the route including the first VSA and the second VSA; and
send network packets to the first VSA and the second VSA according to the route.
19. The apparatus of claim 18 , wherein the route includes a sequential order for the first VSA and the second VSA to process network packets from the guest VM, and the sequential order is specified in at least one policy associated with the guest VM.
20. A method, comprising:
detecting a change for a guest virtual machine (VM) associated with a first virtual server of a virtual network infrastructure, wherein the guest VM is associated with a policy, the policy specifies a security control for the guest VM, and the policy is maintained by a distribution manager on the first virtual server;
determining whether a first virtual security appliance (VSA) for applying the security control to the guest VM is present in the first virtual server;
blocking the guest VM from running in the first virtual server, and sending a request to create the first VSA in the first virtual server, wherein the blocking and the sending are based, at least in part, on a determination that the first VSA is not present in the first virtual server;
configuring, based, at least in part, on the detecting the change, an intercept mechanism in the first virtual server to intercept network packets from the guest VM, wherein the configuring the intercept mechanism includes virtually wiring a virtual network interface card (vNIC) of another guest VM to a physical switch on a physical network interface card (pNIC) of the first virtual server via a first virtual function (VF) on the pNIC;
receiving a signal indicating the first VSA is present in the first virtual server and the intercept mechanism is configured;
subsequent to receiving the signal, allowing the guest VM to initiate in the first virtual server; and
configuring the first VF as a two-way direct memory access (DMA) channel, wherein the physical switch routes a first network packet received from the guest VM via a second VF to flow through the pNIC to route the first network packet to the distribution manager via a third VF on the pNIC, the distribution manager routes the first network packet to the first VSA, and
the configuring the first VF causes a second network packet from the first VSA to flow through a virtual switch and the third VF to route the second network packet to the other guest VM.