Tag based firewall implementation in software defined networks

1. A method comprising:

maintaining a data plane forwarding configuration for software defined networks in a computing environment based on forwarding rules, wherein the software defined networks comprise a plurality of virtual machines for a plurality of entities that share the computing environment, wherein the forwarding rules define actions to be taken against data packets based at least on a combination of two or more tags associated with each virtual machine in the software defined networks, wherein the two or more tags for each virtual machine comprise an entity tag that identifies an entity of the plurality of entities to which the virtual machine belongs and a security group tag that identifies a type of operation provided by the virtual machine, wherein the data plane forwarding configuration associates one or more addressing attributes identified in a data packet with a corresponding action, and wherein the one or more addressing attributes are associated with at least one virtual machine of the plurality of virtual machines and comprise one or more internet protocol (IP) addresses, one or more logical ports, or one or more media access control (MAC) addresses;

identifying a virtual machine for addition to the software defined networks, the virtual machine having at least an entity tag and a security group tag;

identifying a subset of the forwarding rules that apply to the virtual machine based on at least a combination of the entity tag and the security group tag associated the virtual machine; and

updating the data plane forwarding configuration based on the subset of the forwarding rules that apply to the virtual machine.

2. The method of claim 1 , wherein each forwarding rule in the forwarding rules comprises at least a source security group tag, a destination security group tag, and an action.

3. The method of claim 1 , wherein two or more virtual machines in the plurality of virtual machines share a common security group tag.

4. The method of claim 1 , wherein the virtual machine comprises a web application virtual machine.

5. The method of claim 1 further comprising:

identifying a third tag associated with the virtual machine, and

wherein identifying the subset of forwarding rules that apply to the virtual machine is further based on the third tag.

6. A computing apparatus comprising:

one or more non-transitory computer readable storage media;

a processing system operatively coupled to the one or more non-transitory computer readable storage media; and

program instructions stored on the one or more non-transitory computer readable storage media to manage a configuration of software defined networks that, when read and executed by the processing system, direct the processing system to at least:

maintain a data plane forwarding configuration for software defined networks in a computing environment based on forwarding rules, wherein the software defined networks comprise a plurality of virtual machines for a plurality of entities that share the computing environment, wherein the forwarding rules define actions to be taken against data packets based at least on a combination of two or more tags associated with each virtual machine in the software defined networks, wherein the two or more tags for each virtual machine comprise an entity tag that identifies an entity of the plurality of entities to which the virtual machine belongs and a security group tag that identifies a type of operation provided by the virtual machine, wherein the data plane forwarding configuration associates one or more addressing attributes identified in a data packet with a corresponding action, and wherein the one or more addressing attributes are associated with at least one virtual machine of the plurality of virtual machines and comprise one or more internet protocol (IP) addresses, one or more logical ports, or one or more media access control (MAC) addresses;

identify a virtual machine for addition to the software defined networks, the virtual machine having at least an entity tag and a security group tag;

identify a subset of the forwarding rules that apply to the virtual machine based on at least a combination of the entity tag and the security group tag associated the virtual machine; and

update the data plane forwarding configuration based on the subset of the forwarding rules that apply to the virtual machine.

7. The computing apparatus of claim 6 , wherein each forwarding rule in the forwarding rules comprises at least a source security group tag, a destination security group tag, and an action.

8. The computing apparatus of claim 6 , wherein two or more virtual machines in the plurality of virtual machines share a common security group tag.

9. The computing apparatus of claim 6 , wherein the virtual machine comprises a web application virtual machine.

10. The computing apparatus of claim 6 , wherein the program instructions further direct the processing system to identify a third tag associated with the virtual machine, and wherein identifying the subset of forwarding rules that apply to the virtual machine is further based on the third tag.

11. The computing apparatus of claim 6 , wherein the program instructions further direct the processing system to:

identify a second virtual machine for addition to the software defined networks, the second virtual machine having at least an entity tag and a security group tag;

identify a second subset of the forwarding rules that apply to the second virtual machine based at least on a combination of the entity tag and the security group tag associated with the second virtual machine; and

update the data plane forwarding configuration based on a second subset of the forwarding rules that apply to the second virtual machine.

12. An apparatus comprising:

one or more non-transitory computer readable storage media;

program instructions stored on the one or more non-transitory computer readable storage media to manage a configuration of software defined networks that, when read and executed by a processing system, direct the processing system to at least:

maintain a data plane forwarding configuration for software defined networks in a computing environment based on forwarding rules, wherein the software defined networks comprise a plurality of virtual machines for a plurality of entities that share the computing environment, wherein the forwarding rules define actions to be taken against data packets based at least on a combination of two or more tags associated with each virtual machine in the software defined networks, wherein the two or more tags for each virtual machine comprise an entity tag that identifies an entity of the plurality of entities to which the virtual machine belongs and a security group tag that identifies a type of operation provided by the virtual machine, wherein the data plane forwarding configuration associates one or more addressing attributes identified in a data packet with a corresponding action, and wherein the one or more addressing attributes are associated with at least one virtual machine of the plurality of virtual machines and comprise one or more internet protocol (IP) addresses, one or more logical ports, or one or more media access control (MAC) addresses;

identify a virtual machine for addition to the software defined networks, the virtual machine having at least an entity tag and a security group tag;

identify a subset of the forwarding rules that apply to the virtual machine based on at least a combination of the entity tag and the security group tag associated the virtual machine; and

update the data plane forwarding configuration based on the subset of the forwarding rules that apply to the virtual machine.

13. The apparatus of claim 12 , wherein each forwarding rule in the forwarding rules comprises at least a source security group tag, a destination security group tag, and an action.

14. The apparatus of claim 13 , wherein two or more virtual machines in the plurality of virtual machines share a common security group tag.

15. The apparatus of claim 12 , wherein the virtual machine comprises a web application virtual machine.

16. The apparatus of claim 12 , wherein the program instructions further direct the processing system to identify a third tag associated with the virtual machine, and wherein identifying the subset of forwarding rules that apply to the virtual machine is further based on the third tag.

17. The apparatus of claim 12 , wherein the program instructions further direct the processing system to:

identify a second virtual machine for addition to the software defined networks, the second virtual machine having at least an entity tag and a security group tag;

identify a second subset of the forwarding rules that apply to the second virtual machine based at least on a combination of the entity tag and the security group tag associated with the second virtual machine; and

update the data plane forwarding configuration based on a second subset of the forwarding rules that apply to the second virtual machine.