Unified security policies across virtual private clouds with overlapping IP address blocks
The present disclosure generally relates to applying global unified security policies across a plurality of virtual private clouds of a logical network. The logical network is deployed on a software-defined datacenter that constitute one or more private and/or public datacenters. The plurality of virtual private clouds of the logical network may have one or more overlapping internet protocol address blocks, with each virtual private cloud deploying one or more virtual machines and/or containers. A global unified security policy is disseminated to endpoints throughout the logical network using logical ports of the virtual machines and/or containers.
1. A method for enforcing, on a logical network running on a software-defined datacenter, a unified global policy having a plurality of rules to two or more isolated computing systems, the method comprising:
at a central controller, transmitting, to at least a first computing system and a second computing system, the plurality of rules of the unified global policy, wherein the first computing system includes a first set of virtual machines assigned a first internet protocol (IP) address block and the second computing system includes a second set of virtual machines assigned a second IP address block, the first IP address block having an address space that at least partially overlaps an address space of the second IP address block; and
at a first virtual machine of the first computing system:
receiving the plurality of rules of the unified global policy;
identifying a packet to be transmitted from the first virtual machine to a destination virtual machine;
identifying a source logical port corresponding to the first virtual machine and a destination logical port corresponding to the destination virtual machine;
in accordance with a determination, based on the source logical port and the destination logical port, that the packet is prohibited by a first rule of the plurality of rules from being transmitted from the first virtual machine to the destination virtual machine, forgoing transmitting the packet; and
in accordance with a determination, based on the source logical port and the destination logical port, that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine, transmitting a communication using the destination logical port, wherein the communication includes the packet.
2. The method of claim 1 , wherein a first virtual machine in the first set of virtual machines is assigned a first IP address and a logical port identifier, and another virtual machine in the second set of virtual machines is assigned the same first IP address, but a different logical port identifier.
3. The method of claim 1 , further comprising:
translating the plurality of rules from IP addresses to logical port identifiers based on a logical topology of the logical network,
wherein the first virtual machine receiving the plurality of rules comprises receiving the translated plurality of rules.
4. The method of claim 1 , further comprising:
in accordance with the determination that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine:
prior to transmitting the communication from the first virtual machine to the destination virtual machine, encapsulating at least a source logical port identifier with the communication.
5. The method claim 1 , further comprising:
in response to receiving the plurality of rules of the unified global policy, configuring a virtual switch of the first virtual machine to apply the plurality of rules of the unified global policy.
6. The method of claim 5 , wherein identifying the packet to be transmitted from the first virtual machine to the destination virtual machine and identifying the source logical port corresponding to the first virtual machine and the destination logical port corresponding to the destination virtual machine is performed by a local control agent managing the virtual switch.
7. The method of claim 1 , wherein the first computing system includes the destination virtual machine.
8. The method of claim 1 , wherein the first computing system and the second computing system are executing on a public datacenter provided by a first cloud service provider.
9. The method of claim 1 , wherein:
the first computing system is executing on a first public datacenter provided by a first cloud service provider; and
the second computing system is executing on a second public datacenter provided by a second cloud service provider different from the first cloud service provider.
10. The method of claim 1 , wherein the first virtual machine receives the plurality of rules of the unified global policy from the central controller via a control plane.
11. The method of claim 10 , wherein the control plane is a local control plane executing on the first computing system.
12. The method of claim 10 , wherein the control plane is a central control plane of a central computing system executing on a private datacenter.
13. The method of claim 1 , wherein the first virtual machine is executing a single workload of an application type.
14. The method of claim 1 , wherein the first virtual machine is executing a plurality of workloads.
15. The method of claim 1 , wherein the first rule is a unified firewall rule.
16. The method of claim 15 , wherein the unified firewall rule is enforced uniformly across all endpoints of the logical network.
17. One or more non-transitory computer-readable storage media storing one or more programs configured to be executed by one or more processors to enforce, on a logical network running on a software-defined datacenter, a unified global policy having a plurality of rules to two or more isolated computing systems, the one or more programs including instructions for:
at a central controller, transmitting, to at least a first computing system and a second computing system, the plurality of rules of the unified global policy, wherein the first computing system includes a first set of virtual machines assigned a first internet protocol (IP) address block and the second computing system includes a second set of virtual machines assigned a second IP address block, the first IP address block having an address space that at least partially overlaps an address space of the second IP address block; and
at a first virtual machine of the first computing system:
receiving the plurality of rules of the unified global policy;
identifying a packet to be transmitted from the first virtual machine to a destination virtual machine;
identifying a source logical port corresponding to the first virtual machine and a destination logical port corresponding to the destination virtual machine;
in accordance with a determination, based on the source logical port and the destination logical port, that the packet is prohibited by a first rule of the plurality of rules from being transmitted from the first virtual machine to the destination virtual machine, forgoing transmitting the packet; and
in accordance with a determination, based on the source logical port and the destination logical port, that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine, transmitting a communication using the destination logical port, wherein the communication includes the packet.
18. The one or more non-transitory computer-readable storage media of claim 17 , wherein a virtual machine in the first set of virtual machines is assigned a first IP address and a first logical port identifier, and another virtual machine in the second set of virtual machines is assigned the same first IP address, but a different logical port identifier.
19. The one or more non-transitory computer-readable storage media of claim 17 , wherein the one or more programs further include instructions for:
in accordance with the determination that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine:
prior to transmitting the communication from the first virtual machine to the destination virtual machine, encapsulating at least a source logical port identifier with the communication.
20. A system for enforcing, on a logical network running on a software-defined datacenter, a unified global policy having a plurality of rules to two or more isolated computing systems, the system comprising:
a central controller configured to transmit, to at least a first computing system and a second computing system, the plurality of rules of the unified global policy, wherein the first computing system includes a first set of virtual machines assigned a first internet protocol (IP) address block and the second computing system includes a second set of virtual machines assigned a second IP address block, the first IP address block having an address space that at least partially overlaps an address space of the second IP address block; and
a first virtual machine of the first computing system, wherein the first virtual machine of the first computing system is configured to:
receive the plurality of rules of the unified global policy;
identify a packet to be transmitted from the first virtual machine to a destination virtual machine;
identify a source logical port corresponding to the first virtual machine and a destination logical port corresponding to the destination virtual machine;
in accordance with a determination, based on the source logical port and the destination logical port, that the packet is prohibited by a first rule of the plurality of rules from being transmitted from the first virtual machine to the destination virtual machine, forgo transmitting the packet; and
in accordance with a determination, based on the source logical port and the destination logical port, that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine, transmit a communication using the destination logical port, wherein the communication includes the packet.
21. The system of claim 20 , wherein a first virtual machine in the first set of virtual machines is assigned a first IP address and a logical port identifier, and another virtual machine in the second set of virtual machines is assigned the same first IP address, but a different logical port identifier.
22. The system of claim 20 , wherein the first virtual machine of the first computing system is further configured to:
in accordance with the determination that the packet is not prohibited by the plurality of rules, including the first rule, from being transmitted from the first virtual machine to the destination virtual machine:
prior to transmitting the communication from the first virtual machine to the destination virtual machine, encapsulate at least a source logical port identifier with the communication.