Network Security

Network Security Overview

DCN network security has three dimensions: intra-DC intra-VPC security, intra-DC inter-VPC security, and inter-DC security.

1. Intra-DC intra-VPC security

Traffic in a VPC can be classified by model into north-south traffic, east-west traffic between subnets, and east-west traffic within a subnet. Each type of traffic requires different defenses.

The north-south traffic in a VPC can be protected using the following approaches:

• • A logical firewall is provisioned on the logical network and functions as the default firewall, providing security services for north-south traffic in the VPC. These services include IPsec VPN, SNAT, EIP, security policies, content security detection, anti-DDoS, and bandwidth management.
• • SFC flexibly diverts traffic to multiple security devices and adds multiple security detection and protection services, as illustrated by the solid lines in Figure 8.6.
• • Microsegmentation creates internal and external end point groups (EPGs) and inter-group policies to implement access control and isolation on the north-south traffic, as illustrated by the dotted lines in Figure 8.6.

The east-west traffic between subnets in a VPC can be protected using the following approaches: ^[1]

FIGURE 8.6 SFC and microsegmentation traffic models.

The east-west traffic on the same subnet in a VPC can be protected using the following approaches:

• • Microsegmentation creates EPGs based on discrete IP addresses and VM attributes to implement fine-grained access control and isolation, as illustrated by the dotted lines in Figure 8.6.
• • If the devices do not support microsegmentation, SFC can be used to redirect traffic on the same subnet to security devices in order to implement security detection and protection, as illustrated by the solid lines in Figure 8.6.

FIGURE 8.7 Inter-VPC security policy control.

2. Intra-DC intra-VPC security

There are two scenarios where security policy control applies between VPCs, as shown in Figure 8.7.

• • Scenario 1: By default, the VPCs associated with the same external network are interconnected at Layer 3. The tenant administrator configures security policies to protect north-south traffic that passes through the firewall.
• • Scenario 2: VPC communication instances are created and orchestrated, and traffic can flexibly pass through firewalls (none, one firewall in a VPC, or two firewalls in two VPCs). Specifically, the tenant administrator plans interconnections and security policies between VPCs in each pair.

Table 8.1 compares these two scenarios.

3. Inter-DC security

A multi-DC scenario is further divided into multi-PoD and multisite scenarios. This section describes security protection relating to both scenarios.

In the multi-PoD scenario, as shown in Figure 8.8, the controller cluster remotely manages multiple fabric networks, and a unified VXLAN domain is configured between them.

• • If the centralized egress solution is used, security protection will be the same as that for a single DC.
• • If the active/standby egress solution is used, a group of active/ standby firewalls must be deployed in each fabric. The controller

TABLE 8.1 Comparisons between Scenarios Where Security Policy Control Applies between VPCs

FIGURE 8.8 Multi-PoD scenario.

delivers security configurations to the firewalls in all DCs for synchronization. ^•

If the multi-active egress solution is used, a firewall cluster must be deployed across fabric networks. These clustered firewalls will then synchronize security configurations (such as security policies) as well as data entries (such as firewall sessions).

FIGURE 8.9 Multi-site solution.

In the multi-site scenario, as shown in Figure 8.9, each controller cluster independently manages its own DC, and each DC is an independent VXLAN domain, which uses three-segment VXLAN to implement Layer 2 or Layer 3 interconnections between DCs.

When DCs interconnect at Layer 3, traffic can be orchestrated to flexibly pass through the firewalls in one or more DCs, with security policies deployed for inter-DC traffic.

• [1] SFC, as illustrated by the solid lines in Figure 8.6, enables switchesto use ACLs to implement stateless security access control andisolation (traffic unable to pass through firewalls), and flexiblydivert traffic to multiple VAS devices while utilizing multiplesecurity detection and protection services. • Microsegmentation, as illustrated by the dashed lines inFigure 8.6, uses stateless EPGs and policies for access control andisolation (traffic not passing through firewalls). This approachapplies to scenarios that require moderate security but a highdegree of forwarding efficiency.