Dynamic IPSEC policies
Some embodiments provide a method for securing communication of data messages of a particular machine that includes a dynamic first level address. The method identifies a fixed second level address for a particular data. The fixed second level address is associated with an interface of the particular machine. Based on the fixed second level address, the method identifies a set of security policies for securing the communication of the particular data message. The method applies the set of security policies to the particular data message.
1. A method for securing communication of data messages on a host computer executing at least one particular machine, the method comprising:
at the host computer on which the particular machine executes:
storing a plurality of security policies comprising a first security policy associated with a fixed MAC (media access control) address and a second security policy that is associated with an IP address, wherein the first security policy is stored with a higher priority than the second security policy as the first security policy is associated with the fixed MAC address;
receiving a particular data message associated with the particular machine;
comparing a MAC address and an IP address stored in a header of the particular data message with MAC and IP addresses of the security policies stored on the host computer to identify a security policy for securing the communication of the particular data message; and
applying the identified security policy to the particular data message.
2. The method of claim 1 , wherein the IP address is a destination IP address, and the fixed MAC address is the destination MAC address.
3. The method of claim 1 , wherein applying the identified security policy comprises using an encryption key specified by the identified policy to encrypt at least a part of the particular data message.
4. The method of claim 1 , wherein applying the identified security policy comprises using an encryption key specified by the identified policy to decrypt at least a part of the particular data message.
5. The method of claim 1 , wherein the particular machine is a virtual machine comprising a virtual network interface controller (vNIC).
6. The method of claim 1 , wherein the particular data message is one of an Ethernet frame, IP packet, TCP segment, and UDP datagram.
7. The method of claim 1 , wherein the particular data message is sent to or from the particular machine.
8. The method of claim 1 , wherein identifying the security policy comprises a identifying an encryption key.
9. A non-transitory machine readable medium storing a program which when executed by at least one processing unit of a host computer secures communication of data messages on the host computer executing at least one particular machine, the program comprising sets of instructions for:
storing a plurality of security policies comprising a first security policy associated with a fixed MAC (media access control) address and a second security policy that is associated with an IP address, wherein the first security policy is stored with a higher priority than the second security policy as the first security policy is associated with the fixed MAC address;
receiving a particular data message associated with the particular machine;
comparing a MAC address and an IP address stored in a header of the particular data message with MAC and IP addresses of the security policies stored on the host computer to identify a security policy for securing the communication of the particular data message; and
applying the identified security policy to the particular data message.
10. The non-transitory machine readable medium of claim 9 , wherein the address is a source IP address and the fixed MAC address is a source MAC address.
11. The non-transitory machine readable medium of claim 9 , wherein the identified security policy comprises an encryption key, wherein the set of instructions for applying the identified security policy comprises a set of instructions for using the encryption key to encrypt at least a part of the particular data message.
12. The non-transitory machine readable medium of claim 9 , wherein the identified security policy comprises an encryption key, wherein the set of instructions for applying the identified security policy comprises a set of instructions for using the encryption key to decrypt at least a part of the particular data message.
13. The non-transitory machine readable medium of claim 9 , wherein the particular data message is sent to or from the particular machine.