US 11,736,443 B2
Enforcing a segmentation policy in co-existence with a system firewall
Daniel Richard Cook, San Jose, CA (US); Anish Vinodkumar Desai, Palo Alto, CA (US); and Thomas Michael McCormick, San Jose, CA (US)
Assigned to Illumio, Inc., Sunnyvale, CA (US)
Filed by Illumio, Inc., Sunnyvale, CA (US)
Filed on Apr. 26, 2022, as Appl. No. 17/730,062.
Application 17/730,062 is a division of application No. 16/224,746, filed on Dec. 18, 2018, granted, now 11,336,620.
Prior Publication US 2022/0255899 A1, Aug. 11, 2022
Int. Cl. H04L 9/40 (2022.01); G06F 9/38 (2018.01); H04L 41/0803 (2022.01); H04L 43/04 (2022.01); G06F 9/448 (2018.01); H04L 41/0894 (2022.01); H04L 41/0895 (2022.01)
CPC H04L 63/0263 (2013.01) [G06F 9/3826 (2013.01); G06F 9/4486 (2018.02); H04L 41/0803 (2013.01); H04L 41/0894 (2022.05); H04L 43/04 (2013.01); H04L 63/0227 (2013.01); H04L 63/0236 (2013.01); H04L 63/0254 (2013.01); H04L 63/20 (2013.01); H04L 41/0895 (2022.05)] 20 Claims
OG exemplary drawing
 
1. A method for generating firewall rules of a segmentation firewall that enforces a segmentation policy and that co-exists with a system firewall, the method comprising:
receiving by a host from a segmentation server, management instructions specifying permitted communications with a workload executing on the host in accordance with the segmentation policy;
generating, based on the management instructions, a configuration of a segmentation firewall for enforcing the management instructions, the configuration comprising a sequence of firewall rules, wherein a segmentation firewall rule of the plurality of firewall rules, when executed, determines if an input packet meets criteria associated with the segmentation policy permitting the input packet, and responsive to determining that the input packet meets the criteria, executes a command to exit the sequence of firewall rules without dropping or accepting the input packet to enable the system firewall to determine whether to drop or accept the input packet, and wherein the sequence of firewall rules includes a default firewall rule to drop the input packet responsive to the input packet failing to meet criteria associated with prior rules in the sequence of firewall rules; and
configuring a segmentation firewall of the host in accordance with the configuration to cause the segmentation firewall to enforce the segmentation policy.