Enforcing instructions of a segmentation policy on a network midpoint device

An enforcement module operating on a server or on a network midpoint device obtains a management instruction controlling communications of a target workload. The enforcement module configures a firewall of a network midpoint device upstream from the target workload to enforce the management instruction. The configuration mechanism may be dependent on the particular capabilities and characteristics of the network midpoint device.

BACKGROUND

Technical Field

This application relates to managing a segmentation policy that controls communications between workloads.

Description of Related Art

A segmentation policy comprises a set of rules that control which workloads may communicate on a network and may place restrictions on how such workloads may communicate. In conventional implementations, a segmentation server distributes management instructions to host endpoints on which the workloads execute. The host endpoints configure respective firewalls according to the management instructions to enforce the segmentation policy on the individual host endpoints. However, relying exclusively on enforcement at the host endpoints may be insufficient because some host endpoints may have an inadequate enforcement mechanism or may not have any enforcement mechanism. Furthermore, enforcement exclusively at the host endpoints may cause performance issues due to resource constraints on the host endpoints or other network constraints.

SUMMARY

A system, non-transitory computer-readable storage medium, and method configures enforcement of a segmentation policy. In one embodiment, an enforcement module configures a network midpoint device to enforce a management instruction controlling communications of a target workload with a remote workload. Here, an enforcement module obtains a network topology specifying a connectivity of a downstream port of a network midpoint device to a target workload and a connectivity of an upstream port of the network midpoint device to a remote workload. The enforcement module receives the management instruction for permitting communications between the target workload and the remote workload. The enforcement module generates, based on the management instruction, a midpoint device ingress rule permitting the downstream port of the network midpoint device to receive ingress communications to the downstream port of network midpoint device that are sourced from the target workload and destined for the remote workload. The enforcement module configures the network midpoint device to enforce the midpoint device ingress rule for the downstream port.

In an embodiment, configuring the network midpoint device may comprise updating an ingress access control list associated with the downstream port to include the midpoint device ingress rule. Here, the ingress access control list causes the network midpoint device to block ingress communications to the downstream port not specifically permitted by a rule of the ingress access control list.

In an embodiment, the management instruction comprises an inbound management instruction that permits the target workload to receive inbound connection requests from the remote workload but does not permit the target workload to send outbound connection requests to the remote workload. Here, the ingress access control list further causes the downstream port to permit only ingress communications associated with an established connection and to block connection requests from the target workload.

In another embodiment, the management instruction comprises an outbound management instruction that permits the target workload to send outbound connection requests to the remote workload but does not permit the target workload to receive inbound connection requests from the remote workload. In this case, the ingress access control list causes the downstream port to permit connection requests from the target workload to the remote workload and communications associated with an established connection.

In another embodiment, the enforcement module configures the network midpoint device to enforce the management instruction on a network midpoint device that supports egress filtering. Here, the enforcement module generates based on the management instruction, a midpoint device egress rule permitting the downstream port of the network midpoint device to transmit egress communications to the target workload that are sourced from the remote workload and destined to the target workload. The enforcement module configures the network midpoint device to enforce the midpoint device egress rule for the downstream port.

In an embodiment, configuring the network midpoint device comprises updating an egress access control list associated with the downstream port to include the midpoint device egress rule. Here, the egress access control list causes the network midpoint device to block egress communications from the downstream port not specifically permitted by a rule of the egress access control list.

In another embodiment, the enforcement module configures the network midpoint device to enforce the management instruction on a network midpoint device that does not support egress filtering. In this embodiment, the enforcement module generates, based on the management instruction, a midpoint device ingress rule permitting the upstream port of the network midpoint device to receive ingress communications that are sourced from the remote workload and destined to the target workload. The enforcement module furthermore generates, based on the management instruction, midpoint device ingress deny rules denying other ports of the network midpoint device from receiving ingress communications that are destined to the target workload. The enforcement module configures the network midpoint device to enforce the midpoint device ingress rule for the upstream port and the midpoint device ingress deny rules for the other ports.

In an embodiment configuring the network midpoint device comprises updating an ingress access control list associated with the upstream port to include the midpoint device ingress rule. Here, the ingress access control list causes the network midpoint device to block ingress communications to the upstream port not specifically permitted by a rule of the ingress access control list associated with the upstream port. Additionally, configuring the network midpoint device comprises configuring respective ingress access control lists associated with the other ports of the network midpoint device. Here, the respective ingress access control lists associated with the other ports cause the network midpoint device to block ingress communications to the other ports not specifically permitted by a rule of the ingress access control lists associated with the other ports.

DETAILED DESCRIPTION

An enforcement module operating on a server or on a network midpoint device obtains a management instruction for controlling communications of a target workload executing on a host. The enforcement module configures a firewall of a network midpoint device upstream from the target workload to enforce the management instruction. The configuration mechanism may be dependent on the particular capabilities and characteristics of the network midpoint device. Enforcing the management instruction on the network midpoint device instead of on the host beneficially enables enforcement of instructions pertaining to unmanaged workloads executing on hosts that are not capable of directly enforcing the instructions. Furthermore, enforcing the management instruction on the network midpoint device may often be desirable to more efficiently manage resources of the hosts and the network.

FIG. 1is a high-level block diagram illustrating a networked computing environment100. The networked computing environment100includes a segmentation server120, a network110, one or more enforcement modules145, an administrative client160, and an administrative domain150that includes a plurality of hosts130(e.g., hosts130-1,130-2, . . . ,130-N). The administrative domain150can correspond to an enterprise such as, for example, a service provider, a corporation, a university, or a government agency under control of the segmentation server120.

The network110represents the communication pathways between the segmentation server120, the administrative client160, and the hosts130. In one embodiment, the network110uses standard communications technologies and/or protocols and can include the Internet. In another embodiment, the entities on the network110can use custom and/or dedicated data communications technologies. The network110includes network midpoint devices140(e.g., network midpoint devices140-1, . . . ,140-N) that facilitate communications over the network110. The network midpoint devices140may include, for example, routers, switches, access points, firewall devices, or other devices that control communications between the workloads138over the network110. The network midpoint devices140may each include an integrated configurable firewall that enforces a set of firewall rules to permit or block different communications over the network110.

The hosts130may each comprise a physical host device, a virtual machine executing on computer system, or an operating system instance executing on a physical host device or virtual machine capable of hosting one or more workloads138. A single physical or virtual machine may operate a single host130or may operate multiple hosts130. The hosts130each execute one or more workloads138(e.g., one or more workloads138-1, one or more workloads138-2, etc.). The workloads138comprise independently addressable computing units for performing computing tasks. A workload138may comprise, for example, an application or application component, a process, a container, or other sub-component thereof executing on the host130. In some instances, a host130may operate only a single workload138. In other instances, a host130may operate multiple workloads138that may be independently addressable and may perform different independent computing functions. The workloads138on the hosts130may communicate with other workloads138on different hosts130within the administrative domain150to perform various tasks.

The segmentation server120is a computer (or set of computers) that obtains and stores information about the hosts130on the network120and the workloads138executing on the hosts130. The segmentation server120manages a segmentation policy for the administrative domain150that regulates communications between workloads138within the administrative domain150. In an embodiment, the segmentation policy is set forth using permissive rules that specify the communications that are permitted. For example, a rule pertaining to a particular workload138may specify a whitelist of workloads138with which the particular workload138is permitted to communicate. The segmentation policy is enforced by blocking any communications that are not expressly permitted by the rules. For example, the segmentation policy includes a set of rules specifying whether certain workloads138are allowed to provide services to or receive services from other workloads138, and may place restrictions on how those workloads138are allowed to communicate when providing or consuming the services. For example, a segmentation policy may include a rule specifying that a workload138-1operating on a host130-1is allowed to provide a particular service to a workload138-2operating on a host130-2. Absent other rules, the workload138-1will thus be blocked from providing the service to a workload138-N operating on a host130-N. The rule may furthermore specify the type of service that the workload138-1is allowed to provide to workload138-2(e.g., a database service, a web service, etc.). A given rule may comprise an inbound rule or an outbound rule. An inbound rule for a particular workload138allows the particular workload138to accept inbound connections from specified other workloads138and permits the particular workload138to communicate with the specified other workloads bidirectionally over established connections. An outbound rule for a particular workload138allows the particular workload to send outbound connection requests to specified other workloads138and allows the particular workload138to communicate with the specified other workloads bidirectionally over established connections. Additionally, the rule may specify how the workloads138-1,138-2may communicate when providing this service (e.g., using encrypted communication only, using authenticated communication only, etc.). A rule may be specified as a plurality of fields including a “service,” a “provided-by” portion that identifies one or more workloads138that is permitted to provide the service (which may be specified by a port number), a “used-by” portion that identifies one or more workloads138that is permitted to use the service provided by the workloads138in the “provided-by portion,” and a “rule function” that may place one or more restrictions on the communications between the workloads138while facilitating the service. A rule may furthermore specify one or more specific ports and/or protocols that can be used during the permitted communications.

In an embodiment, the segmentation server120may assign one or more labels to each workload138that define one or more high-level characteristics of the workload138. Labels may be multi-dimensional. Here, a label may comprise a “dimension” (a high-level characteristic) and a “value” (the value of that high-level characteristic). For example, one possible label dimension may specify a “role” of the workload138and may have values such as “web,” “API,” or “database” specifying the role of the workload138within the administrative domain150. In another example, a label dimension may specify a “location” of the workload138and may have values such as “United States” or “Europe.” Workloads138may also be labeled based on a user group of a user that is logged into the workload138or the corresponding host130on which the workload138executes. For example, a workload138may have a label with a dimension “user group” and a value “managers.” Each workload138may be assigned labels for one or more dimensions but each workload138does not necessarily have a label assigned for every possible dimension. For example, a workload138may have a label specifying its location but may not necessarily have a label specifying its role. The set of labels assigned to a particular workload138may be referred to herein as a label set for the workload138.

A logical management model specifying the number and types of dimensions available and those dimensions' possible values may be configurable. In one embodiment, the logical management model includes the following dimensions and possible values, as shown in Table 1:

TABLE 1Example of logical management modelDimensionMeaning (M), Values (V)RoleM: The role of the workload within the administrativedomain.V: web, API, databaseEnvironmentM: The lifecycle stage of the workload.V: production, staging, developmentApplicationM: The logical application (higher-level grouping ofmanaged servers) to which the workload belongs.V: trading, human resourcesLine ofM: The business unit to which the workload belongs.BusinessV: marketing, engineeringLocationM: The location of the workload. Can be physical (e.g.,country or geographical region) or logical (e.g., network).Physical is particularly useful for expressing geographiccompliance requirements.V: US or EU (physical), us-west-1 or us-east-2 (logical)User GroupM: The user group containing the user logged onto theworkload.V: Engineers, Contractors, Managers, SystemAdministrators

The segmentation server120may utilize label sets to enable the segmentation policy to be defined at a high level of abstraction by specifying rules based on label sets. Thus, a rule of the segmentation policy may identify a group of workloads138to which a portion of the rule is applicable by referencing one or more label sets. For example, a rule may specify that a first group of workloads138with a label set A may provide a service B to a second group of workloads138with a label set C. Rules may be specified for groups of workloads138identified using only a subset of the label dimensions.

The segmentation server120may retain a repository storing information about the hosts130and the workloads138managed by the segmentation server120. For example, the segmentation server120may store workload identifiers for workloads138, and membership information indicating one or more groups of workloads138to which each workload138belongs (e.g., as defined by the respective label sets for the workloads138).

Table 2 illustrates an example of information stored by the segmentation server120. Here, the workload ID(s) represent the workload identifier for the workload(s)138executing on each host130. The workload identifier may comprise, for example, an IP address or other identifier that uniquely identifies the workload138. The memberships represent groups to which one or more workloads138executing on the host130belongs. Each group may correspond to a unique label set involving one or more dimensions.

The segmentation policy may be enforced by the hosts130, by one or more of the network midpoint devices140, or by a combination thereof. To enable enforcement of at least a portion of segmentation policy on one or more hosts130, the segmentation server120generates a set of management instructions and distributes the management instructions to the hosts130. The management instructions include the rules controlling communications between different groups of workloads138(e.g., specified by their label sets or directly by an identifier of the workload138) and membership information indicating workloads138belonging to each group (e.g., which workloads138have certain label sets). An enforcement agent operating locally on the host130receives the management instructions and configures a local firewall to enforce the management instruction (e.g., by permitting or blocking communications to or from specified workloads138in accordance with the rules).

Some hosts130may comprise “unmanaged hosts” that do not have a local enforcement agent or a local firewall to enforce management instructions. For workloads138executing on these unmanaged hosts, it may be desirable to instead enforce rules at a network midpoint device140upstream from the unmanaged host. Furthermore, due to resource constraints of the hosts130or the network110, it may be preferable to enforce some rules on a network midpoint device140even for workloads138executing on hosts130capable of implementing enforcement. Thus, the segmentation server120may determine to allocate enforcement of certain rules to one or more network midpoint devices140.

To enable enforcement of at least a portion of the segmentation policy at the network midpoint devices140, the segmentation server110obtains a topology of the network110specifying the connections between particular ports of the network midpoint devices140and the hosts130. The topology may furthermore identify which network midpoint devices140are capable of enforcing a segmentation policy with respect to particular workloads138. For example, to enforce a rule pertaining to a particular workload138, the segmentation server110may identify that the particular workload138is coupled to a specific port of a particular network midpoint device140. The segmentation server120then sends a management instructions to an enforcement module145associated with the particular network midpoint device140. The enforcement module145generates a configuration for a firewall of the network device140based on the management instruction and sends the configuration to the network midpoint device140. The configured firewall of the network midpoint device140can then enforce the management instruction by allowing communications between the port of the network midpoint device and the particular workload138consistent with the rule while blocking communications inconsistent with the segmentation policy.

The one or more enforcement modules145may operate on the segmentation server120, on an external enforcement server150, on one or more of the network midpoint devices145, or on a combination thereof. Each enforcement module145may be associated with one or more network midpoint devices140. In an embodiment, an enforcement module145that executes on a network midpoint device140may be associated with only the network midpoint device140on which it executes. Network midpoint devices140lacking an integrated enforcement module145may be associated with an external enforcement module145executing on the segmentation server120, the enforcement server150, or another network midpoint device140. Here, different enforcement modules145may be configured to interoperate with different network midpoint devices140. Furthermore, a particular enforcement module145may be associated with a single network midpoint device140or with multiple network midpoint devices140.

Different enforcement modules145may be configured to interoperate with different types of network midpoint devices140that may have different configuration options and different configuration mechanisms. For example, as will be described below, the configuration may be generated differently for network midpoint devices140having different characteristics and capabilities. For example, the enforcement module145may generate the configuration differently for network midpoint devices140that support both ingress and egress filtering than on network midpoint devices140that support only ingress filtering. Furthermore, the configuration may be generated differently on network midpoint devices140that support a stateful firewall operation than on network midpoint devices140that support only stateless firewall operation.

In an embodiment, an enforcement module145that is external to an associated network midpoint device140configures the associated network midpoint device140by interfacing with an application programming interface (API) of the network midpoint device140via the network110. Alternatively, an enforcement module145may export a configuration for a particular network midpoint device140to the administrative client160to enable an administrator to manually configure the network midpoint device140. Enforcement modules145executing on the network midpoint devices145may configure firewalls of the network midpoint devices140directly based on received management instructions.

For efficiency of distribution, the segmentation server120may send different management instructions to different enforcement modules145so that each enforcement module145gets only the management instructions relevant to the rules it is assigned to enforce. Here, the segmentation server120may determine which rules are relevant to a given enforcement module145and distribute the relevant rules to that enforcement module145. A rule may be deemed relevant to a particular enforcement module145if the rule is assigned to be enforced by a network midpoint device140associated with the enforcement module145and the network midpoint device140controls access to a host130that executes a workload138that belongs to a group (defined by one or more label sets) referenced by the rule. The segmentation server120may furthermore determine which membership information is relevant to each enforcement module145and distribute the relevant membership information to the enforcement module145. Here, membership information may be relevant to a particular enforcement module145if it defines membership of a group referenced by a rule deemed relevant to the particular enforcement module145. For rules assigned to be enforced by hosts130, the segmentation server120may similarly determine relevant management instructions for each host130and distribute only the relevant management instructions to each host130.

The administrative client160comprises a computing device that may be operated by an administrator of the administrative domain150being managed by the segmentation server120. The administrative client160may execute an interface (e.g., via an application or web browser) that enables the administrator to interact with the segmentation server120to configure or view the segmentation policy. The interface may furthermore enable the administrator to obtain various information about the hosts130and workloads138on the network120and view traffic flows between the workloads138.

FIG. 2is a high-level block diagram of an embodiment of a segmentation server120. The segmentation server120comprises a policy generation module202, a topology discovery module204, an allocation decision module206, an instruction distribution module208, and a repository250. The segmentation server120may furthermore optionally include one or more enforcement modules145to control one or more network midpoint devices140. The various modules if the segmentation server120may be implemented as one or more processors and a non-transitory computer-readable storage medium that stores instructions executed by the one or more processors to carry out the functions attributed to the segmentation server120described herein.

The repository250may comprise a workloads database252, a rules database254, and a network topology database256. The workloads database252stores associations between workloads138and their respective label sets. The rules database254stores a segmentation policy as a set of rules The network topology database256stores a network topology for an administrative domain150indicating the connectivity of hosts130to respective network midpoint devices140or between network midpoint devices140.

The policy generation module202generates or updates a segmentation policy comprising a set of rules and generates management instructions for enforcing the rules. The segmentation policy may be generated based on configuration inputs received via the administrative client160providing a desired segmentation strategy. The policy generation module202may generate the segmentation policy at least in part based on observed traffic flows between workloads138. For example, the policy generation module202may observe how workloads138communicate under normal conditions and generate a policy that permits those communications while preventing other communications. Alternatively, the segmentation policy may be manually configured by an administrator via the administrative client160.

The topology discovery module204discovers a topology of the network110and stores it to the network topology database256. For example, the topology discovery module204may detect network midpoint devices140and workloads138on the network110and detect the interconnections between the network midpoint devices140and the hosts130on which the workloads138execute. For example, in an embodiment, the topology discovery module204obtains traffic flow information from different ports of individual network midpoint devices140that includes identifiers for the source and destination workloads138associated with the traffic. Based on these identifiers, the topology discovery module204can detect which workloads138are behind a particular network midpoint device140and to what ports they are connected. By aggregating this information, the topology discovery module204can generate an interconnection graph describing the connections between the traffic midpoint devices140and the hosts130on which the workloads138execute. Alternatively, discovery protocols such as LLDP, CDP, or ARP may be used to discover the topology. The topology discovery module204may furthermore discover and store characteristics and capabilities of the traffic midpoint devices140. For example, the topology discovery module204may determine if a particular network midpoint device140is capable of egress filtering (i.e., blocking outgoing traffic) or whether the particular network midpoint device140is capable of operating as stateful (as opposed to a stateless) firewall. In other alternative embodiments, the topology discovery module204may be omitted and the network topology database256may instead be manually configured by an administrator via the administrative device160.

The allocation decision module206determines an enforcement allocation that specifies whether particular management instructions of the segmentation policy should be enforced by a host130or by a network midpoint device140and which particular network midpoint device140should perform the enforcement. For example, for each management instruction relevant to a particular workload138, the allocation decision module206determines whether to enforce that instruction at the host130that hosts the workload138or on a network midpoint device140upstream from the workload138. The enforcement allocation may be determined based on a configured allocation strategy or may be manually controlled by an administrator.

The instruction distribution module208obtains management instructions from the policy generation module202and distributes the relevant management instructions to the respective enforcement modules145or hosts130according to the determined allocation. For efficiency of distribution, the host configuration module208may transmit to a given host130or enforcement module145, only instructions relevant to the workloads138executing on the given host130or network midpoint device140associated with the enforcement module145in the manner described above.

FIG. 3illustrates an example of logical connections of an example network midpoint device140. The network midpoint device140comprises a plurality of ports330and switching logic310that controls switching of packets between the ports330. The switching logic310includes a firewall315that controls, based on the firewall configuration320, which communications are permitted and are passed between the ports330and which communications are not permitted and are dropped (e.g., filtered) by the firewall315. The connectivity configuration of the network midpoint device140may be obtained from the network topology database256and may specify that the target workload352is coupled to the downstream port332of the network midpoint device140and that the remote workload354is accessible via the upstream port334of the network midpoint device140.

In the example ofFIG. 3, the network midpoint device140is configured to enforce management instructions of a segmentation policy that apply to a target workload352coupled to a downstream port332. The management instructions may specify that the target workload352is permitted to communicate with a remote workload354coupled directly or indirectly via the network110to an upstream port334of the network midpoint device140. The management instructions may be limited to permitting communications over specific ports and/or protocols. For example, the management instructions for the target workload352may limit permitted communications to a specific port of the target workload352and to communications conforming to certain specified protocols (e.g., TCP, UDP, encrypted protocols, etc.) The management instructions may comprise inbound management instructions, outbound management instructions, or a combination of both. For example, an inbound management instruction for the target workload352may permit the target workload352to accept an inbound connection request (e.g., “syn” packets in TCP protocol) from the remote workload354(but does not specifically permit the target workload352to send outbound connection requests) and may permit the target workload352to communicate bidirectionally with the remote workload354over the established connection. An outbound management instruction for the target workload352may permit the target workload352to send an outbound connection request (e.g., “syn” packets in TCP protocol) to the remote workload354(but does not specifically permit the target workload352to accept inbound connection requests) and to communicate bidirectionally with the remote workload354over the established connection. The firewall315may detect whether a particular communication is related to a connection request or is related to an established connection based on metadata included with the communications. Embodiments of processes for configuring the network midpoint device140to enforce inbound and/or outbound management instructions are described in further detail below.

FIG. 4illustrates an example embodiment of a process performed by an enforcement module145to configure a firewall315of a network midpoint device140in response to a management instruction that that permits the target workload352to communicate with the remote workload354in accordance with one or more constraints (e.g., over a specified port and protocol). In the process ofFIG. 4, the network midpoint device140enables both ingress and egress filtering. The enforcement module145receives402the management instruction for the target workload352. The enforcement module145generates404a midpoint device ingress rule for the downstream port332from the management instruction that configures the firewall315to permit ingress communications to the downstream port332that are sourced from the target workload352and destined to the remote workload354and that are in accordance with the specified constraints (e.g., are received from a specified port of the target workload352and are in accordance with a specified protocol). If the management instruction is an inbound management instruction that permits only inbound connection requests from the remote workload354to the target workload352(but not outbound connection requests), then the midpoint device ingress rule may further limit the permitted ingress communications to the downstream port332to communications associated with an established connection between the target workload352and the remote workload354. In this case, the midpoint device ingress rule does not permit communications relating to connection requests received at the downstream port332from the target workload352to the remote workload354or other communications that are not part of an established connection. If the management instruction is an outbound management instruction that permits outbound connection requests from the target workload352to the remote workload354, then the midpoint device ingress rule configures the firewall315to permit ingress communications to the downstream port332relating to connection requests that are sourced from the target workload352and destined to the remote workload354.

The enforcement module145furthermore generates406a midpoint device egress rule for the downstream port332from the management instruction that configures the firewall315to permit egress communications from the downstream port332to the target workload352that are sourced from the remote workload354and that are in accordance with the specified constraints (e.g., are destined to a specified port of the target workload352and are in accordance with a specified protocol). If the management instruction is an outbound management instruction that permits only outbound connection requests from the target workload352to the remote workload354(but not inbound connection requests), then the midpoint device egress rule may further limit the permitted egress communications from the downstream port332to communications associated with an established connection between the remote workload354and the target workload352. In this case, the midpoint device egress rule does not permit connection requests as egress communications from the downstream port332to the target workload352or other communications that are not part of an established connection. If the management instruction is an inbound management instruction that permits inbound connection requests to the target workload352from the remote workload354, then the midpoint device egress rule additionally permits egress communications from the downstream port332relating to connection requests from the remote workload354to the target workload352.

The enforcement module145configures408the firewall315of the network midpoint device140to enforce the midpoint device ingress and egress rules. Particularly, the enforcement module145configures the firewall315to enable the communications permitted by the midpoint device ingress and egress rules while blocking other communications between the target workload352and the downstream port332that are not specifically permitted by another rule associated with the segmentation policy. In an embodiment, the enforcement module145may update an ingress access control list (ACL) associated with the downstream port332to include the midpoint device ingress rule. In operation, the firewall315of the network midpoint device140allows only ingress communications to the downstream port332permitted by the ingress ACL while blocking other communications. Similarly, the enforcement module145may update an egress ACL associated with the downstream port332to include the midpoint device egress rule. In operation, the firewall315of the network midpoint device140allows only egress communications from the downstream port332permitted by the egress ACL while blocking other communications.

FIG. 5illustrates an example embodiment of a process performed by an enforcement module145to configure a firewall315of a network midpoint device140that supports only ingress filtering and does not support egress filtering rules. The enforcement module145receives502a management instruction for the target workload352that specifies a remote workload354from which the target workload352is permitted to receive communications in accordance with specified constraints (e.g., over a specified port of the target workload352and a specified protocol). The enforcement module145generates504a midpoint device ingress rule for the downstream port332from the management instruction that permits the network midpoint device140to receive ingress communications from the target workload352destined to the remote workload354in the same manner described above. The enforcement module145furthermore generates506a midpoint device ingress rule for the upstream port334based on the management instruction that configures the firewall315to permit ingress communications to the upstream port334that are sourced from the remote workload354and destined to the target workload352and that are in accordance with the specified constraints (e.g., are destined to a specified port of the target workload352and are in accordance with a specified protocol). If the management instruction is an outbound management instruction that permits only outbound connection requests from the target workload352to the remote workload354(but not inbound connection requests), then the midpoint device ingress rule for the upstream port334may further limit the permitted ingress communications to the upstream port334to communications associated with an established connection between the remote workload354and the target workload352. In this case, the midpoint device ingress rule for the upstream port334does not permit connection requests as egress communications from the upstream port334that are sourced from the target workload352to the remote workload354or other communications that are not part of an established connection. If the management instruction is an inbound management instruction that permits inbound connection requests to the target workload352from the remote workload354, then the midpoint device ingress rule for the upstream port334configures the firewall315to permit ingress communications to the upstream port334relating to connection requests from the remote workload354to the target workload352.

Additionally, in order to prevent workloads138connected to other ports330of the network midpoint device140from reaching the target workload352, the enforcement module145may also generate508ingress deny rules to deny ingress communications destined for the target workload352on the other ports330unless specifically permitted by another rule.

The enforcement module145configures510the firewall315of the network midpoint device140to enforce the midpoint device ingress rules for the downstream port332and the upstream port334and the ingress deny rules for the other ports330, thus enabling the permitted communications to the target workload352from the remote workload354. Particularly, the enforcement module145configures the firewall315to enable the communications permitted by the midpoint device ingress rules while blocking other ingress communications between the target workload352and the remote workload354received by the downstream port332or the upstream port334that are not specifically permitted by another rule associated with the segmentation policy. For example, the enforcement module145may update ingress ACLs associated with the downstream port332and the upstream port334to include the midpoint device ingress rules. In operation, the firewall315of the network midpoint device140allows only ingress communications to the downstream port332and the upstream port334permitted by the respective ingress ACLs while blocking other communications. Additionally, the enforcement module145may update ingress ACLs associated with the other ports330to cause the other ports330to deny ingress communications sourced from the remote workload354and destined to the target workload352on these ports330absent another rule permitting such communications. The process ofFIG. 5thus beneficially enables bidirectional enforcement of a a management instruction on a network midpoint device140that does not support egress filtering by generating a firewall configuration that uses only midpoint device ingress rules.

The processes ofFIGS. 4-5beneficially enable enforcement of stateful policies using stateless firewall rules. Thus, the network midpoint device140does not necessarily need to be capable of enforcing stateful policies. In an embodiment, the enforcement module145may optionally configure network midpoint devices140capable of enforcing stateful policies by instead directly configuring the firewall based on the management instructions. For example, using stateful firewall rules, the enforcement module140may configure the firewall315to permit inbound or outbound connections between the target workload352and the remote workload354in accordance with the management instruction. The firewall315then uses a connection tracking mechanism to permit only communications consistent with the tracked connection. For network midpoint devices140that do not support stateful policy (or if stateful policy enforcement is optionally disabled), the enforcement module145may apply the above-described processes to effectively convert the stateful policy into bidirectional stateless rules that can be enforced by a stateless firewall315of the network midpoint device140. In an embodiment, the enforcement module145may intelligently determine whether to apply the policy as a stateful firewall configuration or as stateless firewall configuration depending on the capabilities of the network midpoint device140.

In an embodiment, the segmentation server120may determine if a host130of the target workload352has an internal firewall that may interfere with proper enforcement of the segmentation policy enforced by the network midpoint device140. Here, when the host130has a firewall, the segmentation server120may control the host130of the target workload352to configure the firewall to whitelist the connections that are permitted by the policy and enforced on the network midpoint device140. For example, the segmentation server120may cause the host130to disable a connection tracking of its firewall if present (to reduce tracking overhead and improve performance of the host130) and to allow all relevant communications to and from the target workload352that conform to the specified constraints (e.g., port and protocol). In this manner, the policy may be enforced on the network midpoint device140without interference from a host firewall on the host130.