SECURITY POLICY ENFORCEMENT FOR ADDITIONAL INSTANCES OF AN APPLICATION

The disclosure provides an approach for firewall policy management. Embodiments include receiving, at a firewall from a first virtual computing instance (VCI), a registration request comprising a first identifier of the first VCI and a second identifier of a second VCI. Embodiments include determining, at the firewall, based on the second identifier included in the registration request, that the second VCI is associated with a network security policy at the firewall. Embodiments include applying, at the firewall, based on the first identifier included in the registration request, the network policy associated with the second VCI to the first VCI. Additionally, embodiments include allowing or disallowing network activity for the first VCI based on the applied network security policy.

RELATED APPLICATIONS

Benefit is claimed under 35 U.S.C. 119(a)-(d) to Foreign Application Serial No. 202241073579 filed in India entitled “SECURITY POLICY ENFORCEMENT FOR ADDITIONAL INSTANCES OF AN APPLICATION”, on Dec. 19, 2022, by VMware, Inc., which is herein incorporated in its entirety by reference for all purposes.

BACKGROUND

In a data center (e.g., a public or private cloud environment), applications may run on virtual computing instances (VCIs), such as virtual machines (VMs), containers, or other virtualized endpoints. The VCIs may run on physical computing devices (e.g., referred to as host machines) in the data center. Further, multiple instances of an application can be run in the data center, such as by spawning additional VCIs on host machines, each VCI running an instance of the application. Multiple instances of an application can help handle a larger incoming load of requests to the application, as the requests can be load balanced to the multiple instances for parallel processing.

In certain cases, a data center is configured to provide auto scaling of instances of an application, such as based on incoming load on or traffic to the application. For example, additional VCIs running additional instances of the application may be spawned when needed to handle extra load. Further, when the load on the application reduces, some of these spawned VCIs may be terminated. In some cases, due to changing load, spawned VCIs may exist for a relatively short period of time.

In data centers, it is important to protect VCIs running in the data center using security policies, such as firewall policies. In particular, an unprotected VCI may be subject to attack, such as network attacks, that can expose data or bring down the VCI. In an example, VCIs may be protected using a firewall. For example, a firewall agent may be deployed and run in each VCI. The firewall agent is configured to capture network activity in the VCI and hold the network activity until a decision is received from the firewall as to whether the activity is deemed safe or not. The firewall agent passes information regarding the network activity to the firewall and receives a decision from the firewall as whether to allow the network activity or not, and the firewall agent accordingly allows or blocks the network activity within the VCI. The firewall itself may run within the VCI (e.g., as part of the firewall agent) or may run externally from the VCI. For example, the firewall may run within another VCI, such as a service VM, in a hypervisor, in a manager of the data center, etc. It is also possible for the agent to run outside the context of the VCI, somewhere along the datapath of traffic to and from the VCI.

In certain aspects, a VCI is configured to register with the firewall using a registration process. The firewall may further be configured to communicate with a policy manager, as part of the registration process of the VCI, to retrieve a firewall policy to apply to the VCI. The registration process, including the communication between the firewall and the policy manager to retrieve the firewall policy, can take time. Accordingly, during the registration process, the VCI may be unprotected by the firewall, as there is no firewall policy associated with the VCI prior to completion of registration of the VCI. Therefore, either the VCI may handle application requests without protection until registration is complete, which can lead to security issues, or the VCI may wait to handle application requests until registration is complete, which causes delay in availability of the VCI. Delay in availability of the VCI may be problematic where VCIs are spawned and terminated often and quickly. Further, running the VCI without protection may not be an option.

DETAILED DESCRIPTION

The present disclosure describes an improved low-latency approach for applying security policies to VCIs spawned to run additional instances of an application for which the security policies are already applied. In particular, a security policy already applied to a previous VCI running an instance of an application may be instantly applied to a new VCI running another instance of the same application. While the present description relates primarily to firewall policies applied to VCIs, it should be understood that the techniques discussed may similarly be used for applying other types of security and network policies. Likewise, while the present description relates primarily to applying a security policy to a new VCI that is a clone of a previous VCI, it should be understood that the techniques discussed herein may similarly be used with respect to applying a security policy to a new VCI that inherits the security policy of a previous VCI and some data of the previous VCI including VCI identifier information as discussed herein, but the new VCI may not be an exact clone of the previous VCI. For example, the VCI identifier information of the previous VCI may be configured into the new VCI by an automated injection process, or manually. In this case, “cloning” a VCI relates to copying the VCI and then applying a new identity to the copy such as assigning new MAC address, new machine or container identifier, and so forth. It is also possible in some cases to clone a VCI by “forking” the parent, e.g., as described in U.S. Pat. No. 10,977,063, granted Apr. 13, 2021 and titled “Elastic Compute Fabric Using Virtual Machine Templates,” the entirety of which is incorporated herein by reference. As the term is used herein, the word “clone” should be understood to represent a new instance of a parent VCI, generally for horizontal scaling of the application hosted by the parent and clone VCIs, regardless of the manner in which the new instance is created.

The cloned VCIs inherit information from the VCI being cloned (also referred to as a “parent VCI”) to facilitate applying a firewall policy (also referred to as “network security policy”) to the clone VCI. The firewall policy may be enforced on the clone VCI by permitting or denying network traffic to/from the clone VCI based on characteristics of the traffic in accordance with the policy. According to examples described herein, a clone VCI takes advantage of the fact that it is a clone of a parent VCI that has already registered with the firewall and that, as a clone, the same firewall policies that are applied to the parent VCI should be applied to the clone VCI. To do this, for example, a clone VCI, upon being spawned, detects that it is a clone and registers as a clone with the firewall. The firewall may then be able to apply the firewall policy associated with the parent VCI to the clone VCI, without having to retrieve the firewall policy from the policy manager, thereby reducing latency in the registration process.

Further, because of this association between clone VCI and parent VCI, if firewall policies change for the parent VCI, the changes can be automatically applied to any associated clone VCI, thereby simplifying the update of firewall policies for multiple VCIs running the same application.

FIG.1depicts example physical and virtual network components with which embodiments of the present disclosure may be implemented.

A networking environment100includes a data center102connected to a network104. The network104is generally representative of a network of machines such as a local area network (“LAN”) or a wide area network (“WAN”), a network of networks, such as the Internet, or any connection over which data may be transmitted.

The data center102generally represents a set of networked machines and may comprise a logical overlay network. The data center102includes host(s)106, a gateway108, a data network110, which may be a Layer3network, and a management network112. The data network110and management network112may be separate physical networks or different virtual local area networks (VLANs) on the same physical network.

It is noted that, while not shown, additional data centers may also be connected to the data center102via the network104. Communication between the different data centers may be performed via gateways associated with the different data centers.

Each of the hosts106may include a server grade hardware platform114, such as an x86 architecture platform. The hardware platform114of each of the hosts106includes components of a computing device such as one or more processors (CPUs)116, a system memory118, a network interface120, a storage system122, a host bus adapter (HBA)124, and other I/O devices such as, for example, a mouse and keyboard (not shown). The CPU116is configured to execute instructions, for example, executable instructions that perform one or more operations described herein and that may be stored in the memory118and/or in the storage122. The network interface120enables the host106to communicate with other devices via a communication medium, such as the data network110and/or the management network112. The network interface120may include one or more network adapters or ports, also referred to as Network Interface Cards (NICs), for connecting to one or more physical networks. In some examples, the hosts106may be connected to each of the data network110and management network112via separate NICs or separate ports on the same NIC.

The gateway108manages external public IP addresses for host(s)106and routes traffic incoming to and outgoing from the data center102and provides networking services, such as, network address translation (NAT), dynamic host configuration protocol (DHCP), and load balancing. The gateway108uses the data network110to transmit data network packets to the hosts106.

The hosts106may be geographically co-located servers on the same rack or on different racks. The hosts106are configured to provide a virtualization layer, also referred to as a hypervisor126that abstracts processor, memory, storage, and networking resources of hardware platform114for multiple virtual computing instances (VCIs)128,130a,130b, and132that run concurrently on the same host106. The VCIs128,130a,130b, and132may include, for instance, VMs, containers, virtual appliances, and/or the like. The hypervisor126may run in conjunction with an operating system (not shown) in the host106. In some examples, the hypervisor126is installed as system level software directly on hardware platform114of host106(often referred to as “bare metal” installation) and be conceptually interposed between the physical hardware and the guest operating systems executing in the VCIs128,130a,130b, and132. The term “operating system,” as used herein, may refer to a hypervisor. The hypervisor126implements one or more logical entities, such as logical switches, routers, etc. as one or more virtual entities such as virtual switches, routers, etc. In some implementations, hypervisor126may comprise system level software as well as a “Domain 0” or “Root Partition” virtual machine (not shown) which is a privileged machine that has access to the physical hardware resources of the host. In this implementation, one or more of a virtual switch, virtual router, virtual tunnel endpoint (VTEP), etc., along with hardware drivers, may reside in the privileged virtual machine.

Controller134generally represents a control plane that manages configuration of the VCIs128,130a,130b, and132within data center102. The controller134may be a computer program that resides and executes in a central server in data center102or, alternatively, controller134may run as a virtual appliance (e.g., a VM) in one of the hosts106. Although shown as a single unit, the controller134may be implemented as a distributed or clustered system. That is, the controller134may include multiple servers or virtual computing instances that implement controller functions. The controller134is associated with one or more virtual and/or physical CPUs (not shown). Processor(s) resources allotted or assigned to the controller134may be unique to the controller134, or may be shared with other components of the data center102. The controller134communicates with the hosts106via the management network112.

A manager136represents a management plane comprising one or more computing devices responsible for receiving logical network configuration inputs, such as from a network administrator, defining one or more endpoints (e.g., VCIs and/or containers) and the connections between the endpoints, as well as rules governing communications between various endpoints. In some examples, the manager136is a computer program that executes in a central server in the networking environment100, or alternatively, the manager136may run in a VCI, for example, in one of hosts106. The manager136is configured to receive inputs from an administrator or other entity, via a web interface or API, and carry out administrative tasks for the data center102, including centralized network management and providing an aggregated system view for a user. In some embodiments, the manager136comprises a virtualization manager, which is an application that provides an interface to the hardware platform114. A virtualization manager is configured to carry out various tasks to manage virtual computing resources. For example, a virtualization manager can deploy VCIs in the data center102and/or perform other administrative tasks with respect to the VCIs.

In the illustrated example, the manager136includes a policy manager138. The policy manager138stores and/or manages security policies (e.g., firewall policies, rules, and/or the like) that are, for example, created by a system administrator, to govern the interactions of applications and/or services operating on the VCIs128,130a,130b, and132with resources of the host106, the gateway108, other endpoints, etc. In certain aspects, the policy manager138stores and/or manages firewall policies that specify traffic handling in and out of the VCIs128,130a, and130b. Firewall policies may be associated with different characteristics of the VCIs128,130b,130b, and132that may be assigned when the VCI128is provisioned. The firewall policies may, for example, define allowed sources of packets, define allowed destinations of packets, define allowed protocols of the traffic, and/or allowable destination ports, etc. Different VCIs128may be associated with different firewall policies based on the applications operating on the VCIs128, the names of the VCIs, a tenants or organizations associated with the VDIs, security tagging associated with the VCIs, or any other characteristic of the VDIs, or combinations thereof. The firewall policies may be expressed as a rule permitting or denying traffic to and/or from a set of VCIs sharing a set of characteristics or as rules permitting or denying traffic to and/or from a set of IP addresses and/or other packet header information corresponding to the VCIs. The translations of “policies” defined at the management layer that are associated with VCIs having a set of characteristics to “rules” associated with a set of IP addresses and/or other packet header information can happen at the management layer, by the firewall, and/or by another component such as a firewall agent. For the purposes of this document, the term “policies” encompass the forgoing types of policies/rules.

In the illustrated example, a parent VCI128is operating on the host106. The parent VCI128may, for example, operate an application (e.g., a service) that receives and processes traffic (e.g., requests to the application in the form of one or more network packets). From time-to-time, to balance the load, manager136may spawn one or more clone VCIs130in data center102that also run the application, such that the traffic for the application can be load balanced between the multiple instances of the application on the multiple VCIs. Such load balancing may be performed by the gateway108for requests received via network104, or other suitable load balancers (not shown). The process of spawning clone VCIs based on load to an application is sometimes referred to as “cloning” or “auto-scaling.” When the load is reduced, manager136may terminate one or more of the clone VCI(s)130. While, in the illustrated example, the clone VCIs130are operating on the same host106as the parent VCI128, the clone VCIs130may be instantiated on any of the host(s)106.

Agents142a,142b, and142c(collectively “agents142”) operate on the VCIs128,130a, and130bto, in part, manage the relationship between the VCIs and the firewall140. For examples, an agent142aoperates on the parent VCI128and may be copied or otherwise installed as agents142band142conto the clone VCIs130aand130bas part of cloning. The agent142a/142b/142c(i) registers the respective VCI128/130a/130bwith the firewall140, and (ii) manages and/or reads/writes to a configuration file on respective VCI128/130a/130b.

The configuration file of each respective VCI, in part, is configured to store a unique identifier (sometimes referred to as a “VCI ID” or “VCI_ID”) associated with the respective VCI. In certain aspects, such as where the VCI is a VM, the unique identifier may be a BIOS identifier of the VM or a MAC address. In certain aspects, the VCI ID may be any value that uniquely identifies the VCI that (i) can be used to distinguish the parent VCI from the clone VCI, and (ii) can be used to register the VCI with the firewall. It should be noted that each VCI has its own unique identifier, such that a parent VCI and a clone of the parent VCI have different unique identifiers. The clone's identifier is typically assigned to the clone as part of the cloning process.

The configuration file is also configured to store a registration identifier (sometimes referred to herein as a “REG_ID”) associated with the respective VCI. For example, when an agent, such as agent142a, registers the VCI, such as parent VCI128, with the firewall140, as further discussed herein, the firewall140returns to the agent a REG_ID associated with that registration.

Where the VCI is not a clone VCI, such as for parent VCI128, agent142acreates the configuration file, determines the VCI ID of the VCI, such as via a call to an operating system associated with the VCI, and stores the VCI ID in the configuration file of parent VCI128. Further, after registration with firewall140, the agent142astores the REG_ID in the configuration file of parent VCI128.

Where the VCI is a clone VCI, such as for clone VCI130a, the configuration file of parent VCI128is copied onto the clone VCI130aas part of the cloning process. Accordingly, this copied configuration file on clone VCI130aincludes the VCI ID of the parent VCI128from which it was cloned, as well as the REG_ID of the parent VCI128from which it was cloned. As described below, after clone VCI130ais instantiated (e.g., after being cloned), the agent142bcompares the VCI_ID of clone VCI130ato the VCI_ID recorded in the configuration file of clone VCI130ato determine whether the current VCI is a clone. As the agent142bdetermines the clone VCI130ais a clone, the agent142bstores the VCI ID of parent VCI128in the configuration file of clone VCI130aas a parent VCI ID instead, and stores the VCI ID of clone VCI130aas the VCI ID in the configuration file of clone VCI130a. Similarly, the agent142stores the REG ID of parent VCI128in the configuration file of clone VCI130aas a parent REG ID instead, and after registering clone VCI130awith firewall140, stores the REG ID of clone VCI130aas the REG ID in the configuration file of clone VCI130a.

In the illustrated example, a security VCI132operates on the host106. The security VCI132is a VCI that operates applications and services that protect the VCIs128,130a, and130boperating on the hosts106. In the illustrated example, a firewall140operates on the security VCI132. In some examples, the agents142a,142b, and142coperating on the VCIs128,130a, and130bmay intercept network activity at the respective VCIs128,130a, and130b(e.g., ingress and/or egress packets) and not allow the network activity to continue until receiving a security determination from the firewall140based on firewall policy. For example, the agent142a/142b/142csends information regarding network activity at the corresponding VCI128/130a/130bto the firewall140, and the firewall140communicates a response of whether to allow the network activity or not to the agent142a/142b/142c. The agent142a/142b/142c, based on the response, allows or does not allow the network activity. Though firewall140is shown running in the security VCI132, it may run in any suitable location, such as within the same VCI128/130a/130bas the agent142a/142b/142c, on hypervisor126, on another host106, etc.

Further, another implementation of firewall140may be within a data path of network traffic of a VCI128/130a/130b. For example, the firewall140may operate in conjunction with a virtual switch (not shown) on the hypervisor126to which VCI128/130a/130bis connected, a physical switch, or another network entity in a data path of the VCI128/130a/130b. In such an implementation, the agent142a/142b/142citself may not be the component in the host106that holds network activity at the corresponding VCI128/130a/130b, but rather firewall policies are enforced on traffic with the VCI128/130a/130bas a source or destination by the firewall140at the network entity in the data path of VCI128,130a, and130b, such as at a virtual or physical switch within the host106.

In certain aspects, the firewall140communicates with the policy manager138to receive or otherwise retrieve firewall policy for parent VCI128in response to parent VCI128registering with the firewall140.

FIG.2illustrates a block diagram of an example dataflow to and from the firewall140to apply firewall policies to the network traffic of VCIs128and130a. For example, the parent VCI128may be operating in the network environment100and, at a future point, the manager136may instantiate the clone VCI130ain response to increased network traffic and/or processing load on the parent VCI128. In the illustrated example ofFIG.2, VCI128and VCI130amaintain (e.g., via the agent142aand142b, respectively) configuration file204aand configuration file204b, respectively, as discussed.

Initially, upon instantiation of parent VCI128, the agent142aoperating on parent VCI128determines whether a configuration file204aalready exists on parent VCI128, and if so, whether the actual VCI ID of the parent VCI128is the same as the VCI ID stored in configuration file204a. In the illustrated example, the configuration file204adoes not yet exist or the two VCI IDs are the same for the parent VCI128because parent VCI128is not a clone. Where the configuration file204adoes not exists, agent142acreates the configuration file204aand writes the VCI ID of parent VCI128to the configuration file204a.

The agent142athen proceeds to register parent VCI128with firewall140. As an example first step in the example dataflow, the agent142asends a registration message206ato the firewall140. Based on the parent VCI128not being a clone VCI, the registration message206aincludes the actual VCI ID of parent VCI128and may not include other VCI IDs or REG_IDs.

The firewall140receives the registration message206aand determines that it does not currently have a firewall policy associated with parent VCI128, such as based on the registration message not including another VCI ID or REG ID. Accordingly, at a second step, firewall140sends a request for a firewall policy associated with the VCI ID of parent VCI128to the policy manager138. In particular, the firewall140sends a request message to the policy manager138including the VCI ID of parent VCI128from the registration message206a.

Based on receiving the request message from firewall140, policy manager138determines a firewall policy associated with the VCI ID of parent VCI128included in the request message. For example, the policy manager may have access to sets of firewall policies associated with VCI IDs, the association being defined by an administrator, for example. As an example third step in the example dataflow, the policy manager138sends the firewall policy associated with the VCI ID of parent VCI128to firewall140in response to the request message. The policy manager138may further include the VCI ID, included in the request message, in the response message to allow firewall140to determine to which VCI ID the firewall policy applies.

The firewall140registers the parent VCI128with the firewall140(e.g., associates the firewall policy with the parent VCI128). Subsequently, as a fourth step in the example dataflow, the firewall140sends a response message208ato the agent142awith a REG_ID that uniquely identifies the parent VCI128with the firewall140. The agent142asubsequently stores the REG_ID in the configuration file204a.

As an example fifth step in the example dataflow, a clone VCI130ais instantiated, such as based on an auto-scaling event. During the cloning process, the clone VCI130ais instantiated with a copy of the configuration file204aof parent VCI128, including the VCI ID and REG ID of parent VCI128. The copy of configuration file204ais shown as configuration file204b.

As an example sixth step in the example dataflow, the agent142boperating on the clone VCI130adetermines whether the actual VCI ID of the clone VCI130ais the same as the VCI ID included in the configuration file204b. In this instance, the two VCI IDs are not the same because the VCI ID currently in the configuration file204bis the VCI ID of the parent VCI128. Because the two VCI IDs are different, the agent142bknows that the clone VCI130ais a clone and that the VCI ID currently stored in the configuration file204bis the VCI ID of the parent VCI128. Accordingly, the agent142bstores the VCI ID of parent VCI128in a different field of the configuration file204b(sometimes referred to as a “parent VCI ID” or “PARENT_VCI_ID”). Further, the agent142bstores the actual VCI ID of clone VCI130ain configuration file204bas the VCI ID. Agent142balso stores the REG ID of parent VCI128in a different field of the configuration file204b(sometimes referred to as a “parent registration identifier” or “PARENT_REG_ID”).

As an example seventh step of the example dataflow, the agent142bsends a registration message206bto the firewall140. Based on the clone VCI130abeing a clone VCI, the registration message206bincludes the VCI ID of clone VCI130aas well as the PARENT_VCI_ID of the parent VCI128(and optionally the PARENT_REG_ID of parent VCI128). Accordingly, in contrast to registration message206afrom parent VCI128, which is not a clone, the registration message206bfrom clone VCI130additionally includes the VCI ID of the parent VCI of the clone.

The firewall140receives the registration message206band determines that it stores a firewall policy associated with the parent VCI identified by the PARENT_VCI_ID (and/or PARENT_REG_ID) including in the registration message206b. For example, firewall140attempts to match the PARENT_VCI_ID (and/or PARENT_REG_ID) to a firewall policy, and finds a stored match, such as based on the registration discussed of parent VCI128. The firewall140, therefore, further associates the clone VCI130awith the same firewall policy as the parent VCI128, and further associates the VCI ID of clone VCI130awith the firewall policy, without retrieving the firewall policy from the policy manager138. Accordingly, the firewall140is configured to apply the same firewall policy to traffic of clone VCI130aas applied to traffic of parent VCI128. At an eight step, the firewall140then sends a response message208bto agent142bwith a REG_ID that uniquely identifies the clone VCI130awith the firewall140.

As an example ninth step of the example dataflow, the agent142bstores the REG_ID associated with clone VCI130ain the configuration file204b. In certain aspects, agent142bmay further delete from the configuration file the PARENT_REG_ID and/or PARENT_VCI_ID.

FIG.3depicts example operations300related to firewall policy management. For example, operations300may be performed by one or more components of network environment100ofFIG.1. Operations300may correspond to certain aspects of the dataflow ofFIG.2, and provide additional detail of the logical operations and decisions performed. Operations300may begin when, for example, a VCI is instantiated, such as VCI128/130a/130bofFIG.1.

Operations300begin at step302with agent142within VCI128/130a/130bcomparing a VCI ID contained in a configuration file204maintained by the VCI128/130a/130bwith the actual VCI ID of the VCI128/130a/130b(e.g., stored within the system files of the VCI128/130a/130b).

Operations300continue at step304with determining, by the agent142, whether the VCI ID in the configuration file204matches the actual VCI ID of the VCI128/130a/130b.

When the two VCI IDs do not match, the VCI ID currently stored in the configuration file204is the VCI ID of a parent VCI of the VCI128/130a/130b. As such, operations300continue to step306where the agent142(a) stores the VCI ID of the parent VCI as the parent VCI ID in the configuration file204, and (b) stores the actual VCI ID of the VCI128/130a/130bas the VCI ID in the configuration file204.

Operations300continue at step308with registering, by the agent142, the VCI128/130a/130bwith the firewall140using information from the configuration file204. To register the VCI128/130a/130b, the agent142may send registration message206to the firewall140with, for example, the VCI_ID of the VCI128/130a/130b, and where the VCI is a clone the PARENT_VCI_ID. Registering the VCI128/130a/130bwith the firewall140causes, for example, the appropriate firewall policies to be applied to traffic with the VCI128/130a/130bas a source or destination by the firewall140. In some examples, the agent140also includes the PARENT_REG_ID in the registration message206as a confirmation that the clone VCI130ais associated with a parent VCI128that is already registered with the firewall140.

Operations300continue at step310the agent142receives a response message208including a registration identifier from the firewall140. The agent142may then store the registration identifier in in the configuration file204.

Operations300continue at step312with determining, by the firewall140, whether to allow network traffic to and/or from VCI128/130a/130bbased on the firewall policies.

FIG.4depicts example operations400related to firewall policy management. For example, operations400may be performed by one or more components of network environment100ofFIG.1. Operations400may correspond to certain aspects of the dataflow ofFIG.2, and provide additional detail of the logical operations and decisions performed.

Operations400begin at step402, with receiving, by firewall140, a registration message206from a VCI128/130a/130b.

Operations400continue at step404with determining, by the firewall140, if the registration message206contains a parent VCI identifier.

When the registration message206does not contain a parent VCI identifier, operations400continue at step406with creating, by the firewall140, a record and/or generating a registration identifier for the VCI128/130a/130bassociated with the VCI ID in the registration message206.

Operations400then continue to step408with retrieving, by the firewall140, firewall policy associated with the VCI ID from policy manager138to apply to the network traffic with the VCI128/130a/130bas a source and/or as a destination.

When it is determined at step404that the registration message206contains a parent VCI ID, operations400continue at step410with determining, by the firewall140, if the parent VCI ID is associated with a record stored by the firewall140.

When the parent VCI ID is not associated with a record stored by the firewall, operations400continue to step406with creating, by the firewall140, a record and/or generating a registration identifier for the VCI associated with the VCI ID in the registration message.

When the parent VCI ID is associated with a record stored by the firewall, operations400continue to step412with creating, by the firewall140, a record and/or generating a registration identifier for the VCI ID and creating an association between the record for the VCI ID and the record for the parent VCI ID.

Operations400continue to step414with applying, by the firewall140, the firewall policy associated with the parent VCI ID to the VCI128/130a/130b(e.g., without retrieving the firewall policy from the policy manager).