Providing a virtual security appliance architecture to a virtual cloud infrastructure
A method in an embodiment includes detecting a change for a virtual machine in a virtual server of a virtual network infrastructure, determining whether a virtual security appliance is configured in the virtual server, and sending a request to create the virtual security appliance in the virtual server. The method further includes allowing the virtual machine to initiate when the virtual security appliance is created in the virtual machine. The virtual security appliance performs security inspections on network packets sent from the virtual machine. In more specific embodiments, the method further includes creating an intercept mechanism in the virtual server to intercept the network packets from the virtual machine. In further embodiments, one or more security policies identify one or more virtual security appliances to process the network packets from the virtual machine.
1. A method implemented by a virtual server, the method comprising:
detecting a change for a first virtual machine in the virtual server;
determining whether a virtual security appliance is configured in the virtual server;
sending a request to create the virtual security appliance in the virtual server;
allowing the first virtual machine to initiate when the virtual security appliance is created in the virtual server, wherein the virtual security appliance performs security inspections on network packets;
routing, by a physical network interface card, a first packet from a first virtual network interface card (vNIC) of the first virtual machine to a second vNIC of a second virtual machine in the virtual server, the first packet routed through a distribution manager, the distribution manager implemented using a third virtual machine;
determining, at the distribution manager, whether the first packet is subject to a security policy;
determining, at the distribution manager, that no security inspection is needed for network packets sent from the first vNIC to the second vNIC; and
configuring the physical network interface card to route subsequent packets from the first vNIC to the second vNIC, the subsequent packets not routed through the distribution manager.
2. The method of claim 1 , wherein the physical network interface card receives the first packet from the first virtual machine at a layer 2 switch via a first virtual function, and the first packet is routed to the second virtual machine via a second virtual function.
3. The method of claim 2 , wherein the first packet is routed through the virtual security appliance via a third virtual function and further including determining if the layer 2 switch received the first packet from the virtual security appliance.
4. The method of claim 1 , wherein a two-way direct memory access (DMA) channel is implemented, in the physical network interface card, directly to the second virtual machine.
5. The method of claim 1 , wherein a virtual function is implemented directly to the second virtual machine.
6. The method of claim 1 , wherein the security policy identifies one or more virtual security appliances to process the network packets from the first virtual machine.
7. The method of claim 1 , further including sending a request to create the virtual security appliance in the virtual server.
8. An apparatus, comprising:
a physical network interface card;
machine-readable instructions; and
at least one processor circuit to be programmed by the machine-readable instructions to:
detect a change for a first virtual machine in a virtual server;
determine whether a virtual security appliance is configured in the virtual server;
send a request to create the virtual security appliance in the virtual server;
allow the first virtual machine to initiate when the virtual security appliance is created in the virtual server, wherein the virtual security appliance performs security inspections on network packets;
configure the physical network interface card to route a first packet from a first virtual network interface card (vNIC) of the first virtual machine to a second vNIC of a second virtual machine in the virtual server, through a distribution manager, the distribution manager implemented using a third virtual machine;
determine, at the distribution manager, whether the first packet is subject to a security policy;
determine, at the distribution manager, that no security inspection is needed for network packets sent from the first vNIC to the second vNIC; and
configure the physical network interface card to route subsequent packets from the first vNIC to the second vNIC, and not to the distribution manager.
9. The apparatus of claim 8 , wherein one or more of the at least one processor circuit is to create an intercept mechanism in the virtual server to intercept the network packets from the first virtual machine.
10. The apparatus of claim 9 , wherein one or more of the at least one processor circuit is to reconfigure logic of a virtual switch connected to the first virtual machine to force the network packets from the first virtual machine to the physical network interface card.
11. The apparatus of claim 9 , wherein the intercept mechanism includes a hardware interception of network packets based on the Single Root Input/Output Virtualization (SR-IOV) specification.
12. The apparatus of claim 8 , wherein the security policy identifies one or more virtual security appliances to process the network packets from the first virtual machine.
13. The apparatus of claim 8 , wherein one or more of the at least one processor circuit is to send a request to create the virtual security appliance in the virtual server.
14. At least one non-transitory machine-readable medium comprising instructions to cause at least one processor circuit to at least:
detect a change for a first virtual machine in a virtual server;
determine whether a virtual security appliance is configured in the virtual server;
send a request to create the virtual security appliance in the virtual server;
allow the first virtual machine to initiate when the virtual security appliance is created in the virtual server, wherein the virtual security appliance performs security inspections on network packets; and
configure a physical network interface card to route a first packet from a first virtual network interface card (vNIC) on the first virtual machine to a second vNIC of a second virtual machine in the virtual server via a distribution manager, the distribution manager implemented by a third virtual machine;
determine, at the distribution manager, whether the first packet is subject to a security policy;
determine, with the distribution manager, that no security inspection is needed for packets sent from the first vNIC to the second vNIC; and
configure the physical network interface card to route subsequent packets from the first vNIC to the second vNIC, and not to the distribution manager.
15. The at least one non-transitory medium of claim 14 , wherein the machine-readable instructions are to cause one or more of the at least one processor circuit to create an intercept mechanism in the virtual server to intercept the network packets from the first virtual machine.
16. The at least one non-transitory medium of claim 15 , wherein the machine-readable instructions are to cause one or more of the at least one processor circuit to reconfigure logic of a virtual switch connected to the first virtual machine to force the network packets from the first virtual machine to the physical network interface card.
17. The at least one non-transitory medium of claim 15 , wherein the intercept mechanism includes a hardware interception of network packets based on the Single Root Input/Output Virtualization (SR-IOV) specification.
18. The at least one non-transitory medium of claim 14 , wherein the machine-readable instructions are to cause one or more of the at least one processor circuit to send a request to create the virtual security appliance in the virtual server.