软件定义网络中基于流量管理的分布式防火墙策略

Distributed Firewall Policy Based on Traffic Engineering in Software Defined Network

在软件定义网络中将防火墙策略定义为访问控制型规则,并将其分布式地部署在网络中能够提高会话的服务质量。为了减少放置在网络中规则的数量,文中提出多路复用和合并的启发式规则放置算法(HARA)。算法考虑到了商品交换机TCAM存储空间和端点交换机相连链路的流量负载,通过建立以最小化规则放置数量为目标的混合整数线性规划模型,解决不同吞吐量的多路由单播会话的规则放置问题。实验结果表明,与nonRM-CP算法相比,在保证不同会话服务质量的前提下,该算法最多能节省56%的TCAM空间,平均能减少13.1%的带宽资源利用率。

Firewall policy is defined as access control rules in Software Definition Network(SDN),and distributing these ACL(Access Control List)rules across the networks,it can improve the quality of service.In order to reduce the number of rules placed in the network,the Heuristic Algorithm of Rules Allocation(HARA)of rule multiplexing and merging is proposed in this paper.Considering TCAM storage space of commodity switches and connected link traffic load of endpoint switches,a mixed integer linear programming model which minimize the number of rules placed in the network is established,and the algorithm solves the rules placement problem of multiple routing unicast sessions of different throughputs.Compared with the nonRM-CP algorithms,simulations show that HARA can save 18%TCAM at most and reduce the bandwidth utilization rate of 13.1%at average.