Method and apparatus for supporting access control lists in a multi-tenant environment

1. A method comprising:

identifying common access control list (ACL) parameters and variable ACL parameters among a plurality of tenants in a network;

mapping parameter values for said variable ACL parameters to said tenants;

generating a multi-tenant access control list for said plurality of tenants, the multi-tenant access control list comprising said common ACL parameters and said variable ACL parameters;

storing the multi-tenant access control list and said mapping at a network device; and

applying the multi-tenant access control list to ports at the network device.

2. The method of claim 1 wherein the network device comprises a virtual switch in communication with virtual machines and the ports comprise virtual ports.

3. The method of claim 1 wherein each of said plurality of tenants is associated with one or more virtual networks or virtual network segments.

4. The method of claim 1 further comprising performing a lookup in a table comprising said mapping.

5. The method of claim 1 further comprising programming said mapping into a port entry.

6. The method of claim 1 wherein said parameter values comprise Internet Protocol (IP) address ranges.

7. The method of claim 1 wherein said parameter values comprise virtual machine attributes.

8. The method of claim 7 wherein the virtual machine attributes comprise addresses for the virtual machines.

9. The method of claim 1 wherein the ports comprise port profiles defined within a virtual switch.

10. The method of claim 1 wherein said parameter values comprise values learned on the network.

11. The method of claim 1 wherein said parameter values comprise user defined values.

12. The method of claim 1 wherein mapping parameter values to said tenants comprises mapping said parameter values to networks or virtual machines associated with said tenants.

13. An apparatus comprising:

a processor for identifying common access control list (ACL) parameters and variable ACL parameters among a plurality of tenants in a network, mapping parameter values for said variable ACL parameters to said tenants, and generating a multi-tenant access control list for said plurality of tenants, the multi-tenant access control list comprising said common ACL parameters and said variable ACL parameters; and

memory for storing the multi-tenant access control list and said mapping;

wherein the multi-tenant access control list is configured for use at a virtual switch.

14. The apparatus of claim 13 wherein each of said plurality of tenants is associated with one or more virtual networks or virtual network segments.

15. The apparatus of claim 13 wherein the processor is further configured to perform a lookup in a table comprising said mapping.

16. The apparatus of claim 13 wherein said mapping is programmed into a port entry.

17. The apparatus of claim 13 wherein said parameter values comprise Internet Protocol (IP) address ranges.

18. The apparatus of claim 13 wherein said parameter values comprise virtual machine attributes.

19. The apparatus of claim 13 wherein mapping parameter values to said tenants comprises mapping said parameter values to networks or virtual machines associated with said tenants.

20. Logic encoded on one or more non-transitory computer readable media for execution and when executed operable to:

identify common access control list (ACL) parameters and variable ACL parameters among a plurality of tenants in a network;

map parameter values for said variable ACL parameters to said tenants;

generate a multi-tenant access control list for said plurality of tenants, the multi-tenant access control list comprising said common ACL parameters and said variable ACL parameters;

store the multi-tenant access control list and said mapping; and

apply the multi-tenant access control list to ports at a network device.