US 12,218,956 B2
Providing a virtual security appliance architecture to a virtual cloud infrastructure
Geoffrey Howard Cooper, Palo Alto, CA (US); Manuel Nedbal, Santa Clara, CA (US); and Hemang Satish Nadkarni, Cupertino, CA (US)
Assigned to Musarubra US LLC, San Jose, CA (US)
Filed by Musarubra US LLC, Plano, TX (US)
Filed on May 13, 2021, as Appl. No. 17/320,129.
Application 17/320,129 is a continuation of application No. 15/400,101, filed on Jan. 6, 2017, granted, now 11,025,647.
Application 15/400,101 is a continuation of application No. 13/656,730, filed on Oct. 21, 2012, granted, now 9,571,507.
Prior Publication US 2021/0344692 A1, Nov. 4, 2021
Int. Cl. G06F 9/455 (2018.01); G06F 21/50 (2013.01); G06F 21/60 (2013.01); H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) [G06F 21/606 (2013.01); H04L 63/205 (2013.01); G06F 2009/45587 (2013.01); G06F 2009/45595 (2013.01); G06F 21/50 (2013.01); H04L 63/105 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method implemented by a virtual server, the method comprising:
detecting a change for a first virtual machine in the virtual server;
determining whether a virtual security appliance is configured in the virtual server;
sending a request to create the virtual security appliance in the virtual server;
allowing the first virtual machine to initiate when the virtual security appliance is created in the virtual server, wherein the virtual security appliance performs security inspections on network packets;
routing, by a physical network interface card, a first packet from a first virtual network interface card (vNIC) of the first virtual machine to a second vNIC of a second virtual machine in the virtual server, the first packet routed through a distribution manager, the distribution manager implemented using a third virtual machine;
determining, at the distribution manager, whether the first packet is subject to a security policy;
determining, at the distribution manager, that no security inspection is needed for network packets sent from the first vNIC to the second vNIC; and
configuring the physical network interface card to route subsequent packets from the first vNIC to the second vNIC, the subsequent packets not routed through the distribution manager.