AUTO-SECURITY FOR NETWORK EXPANSION USING FORWARD REFERENCES IN MULTI-SITE DEPLOYMENTS

The disclosure provides an approach for managing group membership in a multi-site networking environment. Embodiments include receiving, at a local management component on a networking site of a plurality of networking sites, from a global management component associated with the plurality of networking sites, a definition of a group. Embodiments include determining, by the local management component on the networking site, based on the definition, that the group comprises a networking object with a span that does not include the networking site. Embodiments include storing, by the local management component on the networking site, in a data structure, a reference to the networking object in association with the group, wherein the networking object is excluded from a determination of local membership of the group on the networking site.

RELATED APPLICATIONS

Benefit is claimed under 35 U.S.C. 119(a)-(d) to Foreign Application Serial No. 202141016372 filed in India entitled “AUTO-SECURITY FOR NETWORK EXPANSION USING FORWARD REFERENCES IN MULTI-SITE DEPLOYMENTS”, on Apr. 7, 2021, by VMware, Inc., which is herein incorporated in its entirety by reference for all purposes.

BACKGROUND

A data center in a software defined networking (SDN) environment may comprise a plurality of hosts in communication over a physical network infrastructure. Each host is a physical computer (machine) that may run one or more virtualized endpoints such as virtual machines (VMs), containers, and/or other virtual computing instances (VCIs). In some cases, VCIs are connected to software-defined networks (SDNs), also referred to herein as logical overlay networks, which may span multiple hosts and are decoupled from the underlying physical network infrastructure.

Some SDN environments may include multiple data centers, and may be referred to as multi-site networking environments. It is often useful to define groups of entities in multi-site environments for use in applying policies, such as security policies, to the groups across different data centers. Entities in a group may include, for example, various types of VCIs and/or networking objects, as further discussed herein. Accordingly, if a policy is applied to a group, then the policy may be automatically applied to each entity that is a member of the group automatically, and potentially across multiple data centers, thereby simplifying the process of applying policies to entities.

A group may be defined at a global level, meaning that it is defined not for a particular data center, but rather globally such that it can be applied to any data center in a multi-site networking environment. In some cases, a group may include entities that are not yet defined for a particular data center to which the group is applied. Thus, when such a globally defined group is applied to a particular data center, it may be difficult to determine the membership of the group on the particular data center if the group includes entities that are not implemented on the particular data center. Existing techniques for managing group membership in multi-site networking environments may disregard a group on a given data center if the group includes a member that is not implemented on the given data center, thus causing policies involving the group to not be applied on the given data center.

Accordingly, there is a need in the art for improved techniques for managing group membership in multi-site networking environments.

DETAILED DESCRIPTION

The present disclosure provides an approach for managing group membership in a multi-site networking environment. A global group manager may enable the definition of groups of entities in a multi-site networking environment. For instance, a group may be a security group that is used to combine a plurality of entities for the purpose of defining security policies that are applicable to all of the entities together (e.g., rules restricting communication between members of a first group and members of a second group, limiting access by members of a given group to endpoints outside of a local network, and/or the like). Entities in a group may include, for example, VCIs and/or networking objects such as logical switches and logical ports. A networking object generally refers to a logical construct in an SDN environment that implements functions related to operation of the network, such as connecting VCIs together or facilitating communication between VCIs. A networking object may itself be implemented as one or more VCIs. Logical switches, for example, create logical broadcast domains or segments to which an application or VM can be logically wired. Logical ports provides logical connection points to various types of destinations, such as logical switches, logical routers, and external networks. Logical switches, logical routers, etc., may be implemented on one or more physical devices as one or more virtual switches, virtual routers, etc., as is known in the art. For example, any arbitrary set of VMs in a datacenter may be placed in communication across a logical Layer 2 network by connecting them to a logical switch. Each logical switch corresponds to a virtual network identifier (VNI). A logical switch is collectively implemented by at least one virtual switch on each host that has a VM connected to the logical switch. The virtual switch on each host operates as a managed edge switch implemented in software by the hypervisor on each host.

A data center generally refers to a centralized facility where computers, network, storage, and other equipment that support operations of an organization reside. While data centers are generally physical facilities comprising physical host computers connected over a physical networking infrastructure, a data center may also be a software-defined data center that abstracts physical resources of computing devices. In certain aspects, any networks internal to a given data center are isolated from any networks outside the data center, in that any communication between devices with a data center and devices outside the data center, such as in another data center) occur via one or more gateways associated with the data center. Accordingly, each data center may have one or more respective gateways for communications between the data center and network locations outside of the data center. A data center (accessible by a corresponding gateway) will have its own span, and all entities (e.g., VCIs, networking objects, and the like) created under the data center, such as networking objects, will extend the same span. A span of an entity refers to the set of data centers on which the entity is realized.

A networking object can be added as a member of a group. Similarly policies can be defined with respect to groups and/or networking objects, thus creating dependencies between the spans of the networking objects, groups, and policies.

Certain networking objects may potentially span multiple data centers, and the span of networking objects can change over time. For instance, the span of a logical switch may initially include only a first data center, but may be expanded to include a second data center at a later time. A group may also span multiple data centers, and generally may include networking objects with spans that are less than or equal to the span of the group. Thus, a group spanning a first and second data center may include a networking object that spans only the first data center. When such a group is distributed by the global group manager to a local group manager on the second data center, the local group manager on the second data center will determine that the group includes a networking object that does not exist on the second data center. While conventional techniques would have the group discarded on the second data center when the networking object cannot be resolved, embodiments of the present disclosure provide improved techniques in which a forward reference is used to manage group membership on a given data center in cases where a group includes a member that is not implemented on the given data center.

In certain embodiments, if a local group manager on a given data center receives a definition of a group that spans the given data center and includes a networking object with a span that does not include the given data center, the local group manager stores a forward reference to the networking object in association with the group. A “forward reference” may be a global identifier of the networking object associated with a global identifier of the group, and may be stored in a data structure such as a table. The membership of the group may then be determined for the given data center without considering the networking object, and any policies applicable to the group will then be applied on the given data center based on the local membership of the group. Subsequently, if the local group manager on the given data center determines that the span of the networking object has changed to include the given data center, then the forward reference may be deleted, and the membership of the group on the given data center may be re-determined with the inclusion of the networking object.

Accordingly, embodiments of the present disclosure constitute an improvement over existing techniques for managing group membership in multi-site systems by allowing groups and associated policies to be realized on data centers even if the groups include members that are not currently realized on the data centers. Furthermore, if the span of a networking object expands over time to include additional data centers in the span of a group of which the networking object is a member, any policies applicable to the group will already be applied at the additional data centers according to techniques described herein, thus improving the security and functionality of the networking environment.

FIG. 1depicts example physical and virtual network components with which embodiments of the present disclosure may be implemented.

Networking environment100includes data centers130and160and a global group manager150connected to network110. Network110is generally representative of a network of machines such as a local area network (“LAN”) or a wide area network (“WAN”), a network of networks, such as the Internet, or any connection over which data may be transmitted.

Each of data centers130and160generally represents a set of networked machines and may comprise a logical overlay network. Data center160may include similar components to those depicted in data center130. Data center130includes host(s)105, a gateway134, a data network132, which may be a Layer 3 network, and a management network126. Host(s)105may be an example of machines. Data network132and management network126may be separate physical networks or different virtual local area networks (VLANs) on the same physical network.

It is noted that, while not shown, additional data centers may also be connected to data center130and data center160via network110. Communication between the different data centers may be performed via gateways associated with the different data centers.

Each of hosts105may include a server grade hardware platform106, such as an x86 architecture platform. For example, hosts105may be geographically co-located servers on the same rack or on different racks. Host105is configured to provide a virtualization layer, also referred to as a hypervisor116, that abstracts processor, memory, storage, and networking resources of hardware platform106for multiple virtual computing instances (VCIs)1351to135n(collectively referred to as VCIs135and individually referred to as VCI135) that run concurrently on the same host. VCIs135may include, for instance, VMs, containers, virtual appliances, and/or the like. VCIs135may be an example of machines.

In certain aspects, hypervisor116may run in conjunction with an operating system (not shown) in host105. In some embodiments, hypervisor116can be installed as system level software directly on hardware platform106of host105(often referred to as “bare metal” installation) and be conceptually interposed between the physical hardware and the guest operating systems executing in the virtual machines. In certain aspects, hypervisor116implements one or more logical entities, such as logical switches, routers, etc. as one or more virtual entities such as virtual switches, routers, etc. In some implementations, hypervisor116may comprise system level software as well as a “Domain 0” or “Root Partition” virtual machine (not shown) which is a privileged machine that has access to the physical hardware resources of the host. In this implementation, one or more of a virtual switch, virtual router, virtual tunnel endpoint (VTEP), etc., along with hardware drivers, may reside in the privileged virtual machine.

Gateway134provides VCIs135and other components in data center130with connectivity to network110, and is used to communicate with destinations external to data center130. Gateway134may be implemented as one or more VCIs, physical devices, and/or software modules running within one or more hosts105.

Controller136generally represents a control plane that manages configuration of VCIs135within data center130. Controller136may be a computer program that resides and executes in a central server in data center130or, alternatively, controller136may run as a virtual appliance (e.g., a VM) in one of hosts105. Although shown as a single unit, it should be understood that controller136may be implemented as a distributed or clustered system. That is, controller136may include multiple servers or virtual computing instances that implement controller functions. Controller136is associated with one or more virtual and/or physical CPUs (not shown). Processor(s) resources allotted or assigned to controller136may be unique to controller136, or may be shared with other components of data center130. Controller136communicates with hosts105via management network126.

Manager138represents a management plane comprising one or more computing devices responsible for receiving logical network configuration inputs, such as from a network administrator, defining one or more endpoints (e.g., VCIs and/or containers) and the connections between the endpoints, as well as rules governing communications between various endpoints. In one embodiment, manager138is a computer program that executes in a central server in networking environment100, or alternatively, manager138may run in a VM, e.g. in one of hosts105. Manager138is configured to receive inputs from an administrator or other entity, e.g., via a web interface or API, and carry out administrative tasks for data center130, including centralized network management and providing an aggregated system view for a user. In some embodiments, manager138determines membership of groups, such as security groups, for data center130based on group definitions received from global group manager150and/or based on information received from local group manager139.

Local group manager139performs operations related to managing local group membership for data center130, particularly for groups defined globally (e.g., at global group manager150).

Global group manager150generally represents a centralized management component for groups in a multi-site environment comprising data centers130and160(and, in some embodiments, additional data centers that are not shown). Global group manager150may allow a user to define groups of entities in the networking environment and policies that reference those groups. In an example, global group manager150provides a user interface by which a user is able to indicate one or more conditions for membership in a group and define policies applicable to the group, such as security policies. A group definition may also specify the span of the group, indicating which data centers in the multi-site networking environment the group is to be implemented on. As described in more detail below with respect toFIG. 2, the span of a networking object in a group may potentially be smaller than the span of the group. As such, techniques described herein involve the use of forward references to manage group membership on local group managers.

FIG. 2is a diagram200illustrating management of group membership in a multi-site networking environment. Diagram200includes global group manager150, data centers130and160, local group manager139, and manager138ofFIG. 1. Diagram200also includes local group manager239and manager238, which perform similar functions for data center160to those performed by local group manager139and manager138for data center130.

At global group manager150, a group202is defined to have a span of site 1 (data center130) and site 2 (data center160), and is defined to include as members networking objects204and206. For example, a user may have configured group202via a user interface, and may have directly indicated that networking objects204and206are members of group202or may have specified one or more conditions for membership in group202(conditions which networking objects204and206meet). Networking objects204and206may be any sort of networking object capable of spanning multiple sites. It is noted that while certain embodiments described herein involve networking objects being members of groups, other embodiments may include different types of entities being included in groups. For example, techniques described herein for using forward references to manage group membership in multi-site networking environments may be applied to any sort of entities that may be included in a group and that may potentially span multiple sites.

Networking object204has a span of site 1 (data center230) and networking object206has a span of site 2 (data center160). The spans of networking objects204and206both have the potential of later expanding to include additional data centers.

Networking object204is present on data center130because data center130is in the span of networking object204, while networking object206is not present on data center130. Similarly, networking object206is present on data center160, but networking object204is not present on data center160. When local group manager139in data center130receives the definition of group202from global group manager150, it attempts to locate all members of the group based on identifiers of the members (e.g., which may be paths, as described with respect toFIG. 3). Local group manager139determines that one of the members of group202(networking object206) is not present on data center130(e.g., when it is unable to resolve a path of networking object206, determining that a target of the path does not exist). As such, local group manager139stores a forward reference to networking object206in association with group202. Similarly, when local group manager239in data center160receives the definition of group202from global group manager150, it determines that one of the members of group202(networking object204) is not present on data center160. As such, local group manager239stores a forward reference to networking object204in association with group202. As described in more detail below with respect toFIG. 3, forward references may be stored in a data structure such as a table, and may include global identifiers of networking objects associated with global identifiers of groups.

Thus, at local manager139, the members of group202include networking object204and a forward reference to networking object206. Likewise, at local manager239, the members of group202include a forward reference to networking object204and networking object206.

Group membership on data centers may be resolved at the management plane. Resolving membership of a group generally includes determining all of the individual entities that are members of a group, and may also include, in some embodiments, determining VCIs connected to networking objects included in the membership of a group. In some cases, the management plane resolves group membership by resolving the identifiers of each member of the group and, subsequently, determining any entities (e.g., VCIs connected to a logical switch) that make up the members of the group. For instance, if a group includes a logical switch, the group may also include, by extension, the VCIs that are connected to the logical switch. According to techniques described herein, resolving an identifier may comprise checking the data structure (e.g., the forward reference table) at local group manager139and, if the data structure includes an entry with the identifier, an exception may be thrown indicating that a forward reference was found (e.g., which indicates that the object represented by the identifier is not present on the data center). In the present case, manager138on data center130determines from local group manager139that one of the members of group202(networking object206) is not present on data center130, and is stored only as a forward reference by local group manager139. As such, manager138excludes networking object206from consideration when it resolves the membership of group202. Accordingly, on manager138, the membership of group202includes only networking object204, which may be resolved by manager138to one or more particular VCIs connected to networking object204.

Similarly, manager238on data center160determines from local group manager239that one of the members of group202(networking object204) is not present on data center160, and is stored only as a forward reference by local group manager239. As such, manager238excludes networking object204from consideration when it resolves the membership of group202. Accordingly, on manager238, the membership of group202includes only networking object206, which may be resolved to one or more particular VCIs.

Thus, while conventional techniques may involve manager138discarding group202because it is unable to resolve networking object206and manager238discarding group202because it is unable to resolve networking object204, techniques described herein allow membership of group202to be resolved on both manager138and manager238even though group202includes at least one member that is not present on each of data centers130and160. Policies applicable to group202may then be applied at both data centers130and160, thereby improving security and functionality of the multi-site networking environment.

Subsequently, if the span of networking object204changes to include data center160and/or if the span of networking object206changes to include data center130, local manager138and/or239may delete the applicable forward reference and manager138and/or238may fully resolve the membership of group202with the inclusion of both networking objects204and206. Accordingly, security policies are automatically applied to the added networking objects204and206in data centers160and130, respectively, thereby avoiding a situations where security policies are not applied to added networking objects204and206in data centers160and130.

FIG. 3illustrates a data structure300related to managing group membership in a multi-site networking environment. For example, data structure300may be a forward reference table used by local group manager139and/or local group manager239ofFIG. 2to store forward references.

In each row of data structure300, a global identifier of an entity (e.g., a networking object not present on the data center) is stored in association with a list of one or more groups that are “sources” of the forward reference, the groups being identified by global identifiers as well. Global identifiers may be implemented in a variety of different ways. As an example, data structure300shows paths being used as global identifiers. The first row in data structure300depicts the global identifier “/global-infra/logicalswitches/ls1” associated with a list of global identifiers “[global-infra/groups/g1, /global-infra/groups/g2]”. In this example, “global-infra” represents a root domain of a global group management infrastructure, “logicalswitches” represents a domain beneath the root domain that is associated with logical switches, “ls1” represents a particular logical switch within the “logicalswitches” domain, “groups” represents a domain beneath the root domain that is associated with groups, and “g1” and “g2” represent particular groups within the “groups” domain.

The second row in data structure300depicts the global identifier “/global-infra/logicalports/lp2” associated with a list of global identifiers “[global-infra/groups/g1, /global-infra/groups/g3]”. In this example, “logicalports” represents a domain beneath the root domain that is associated with logical ports, “lp2” represents a particular logical port within the “logicalports” domain, and “g3” represents a particular group within the “groups” domain.

In an example, data structure300is maintained by a local group manager of a given data center on which the logical switch ls1 and the logical port lp2 are not present. Thus, when the local group manager receives definitions of groups g1, g2, and g3, it stores forward references for ls1 and lp2 in data structure300in association with the groups to which each belongs, as shown inFIG. 3. Memberships of groups g1, g2, and g3 will be determined on the given data center with the exclusion of ls1 and lp2.

In an example, if a span of lp2 later changes to include the given data center, the second row of data structure300may be deleted, and memberships of groups g1 and g3 may be re-determined on the given data center with the inclusion of lp2. Likewise, if a span of ls1 later changes to include the given data center, the first row of data structure300may be deleted, and memberships of groups g1 and g2 may be re-determined on the given data center with the inclusion of ls1.

FIG. 4depicts example operations400related to managing group membership in multi-site systems. For example, operations400may be performed by one or more components in networking environment100ofFIG. 1, such as local group manager139and/or manager138.

At step402, a local management component, such as local group manager139, on a networking site of a plurality of networking sites receives, from a global management component, such as global group manager150, associated with the plurality of networking sites, such as data centers130and160, a definition of a group.

At step404, the local management component on the networking site, determines based on the definition, that the group comprises a networking object with a span that does not include the networking site. The networking object may be, for example, a logical switch, a logical port, or the like.

At step406, the local management component on the networking site stores, in a data structure, a reference to the networking object in association with the group, wherein the networking object is excluded from a determination of local membership of the group on the networking site. Storing the reference to the networking object in association with the group may, for example, comprise storing a global identifier of the networking object in association with a global identifier of the group in the data structure. In certain embodiments, the data structure comprises a table that stores the reference to the networking object with a list of all groups of which the networking object is a member.

In some embodiments, the local management component on the networking site notifies a management plane of the networking site that the group comprises the networking object with the span that does not include the networking site, and the management plane performs the determination of the membership of the group on the networking site, excluding the networking object from the determination.

Certain embodiments further include applying, on the networking site, a security rule that relates to the group based on the local membership of the group.

FIG. 5depicts additional example operations500related to managing group membership in multi-site systems. For example, operations500may be performed by one or more components in networking environment100ofFIG. 1, such as local group manager139and/or manager138, and may be performed after operations400ofFIG. 4.

At step502, the local management component on the networking site determines that the span of the networking object has been modified to include the networking site.

At step504, the local management component on the networking site deletes the reference to the networking object from the data structure, wherein the networking object is included in an updated determination of the local membership of the group on the networking site.