The data plane is the core component for network data forwarding and policy enforcement. It uses OpenFlow to implement data forwarding and policy control based on Open vSwitch (OVS). This model supports flexible orchestration of security rules at L3 and L4 layers, as well as traffic filtering for TCP, UDP, and ICMP protocols.
The data plane executes the forwarding and security rules generated by the control plane. It provides an IP address discovery mechanism through ARP (IPv4) and NDP (IPv6) address learning, dynamically updating the mapping between policy objects and IP addresses in real time. If VMTools is installed on the virtual machine, the data plane also retrieves the actual configured IP address from inside the virtual machine.
The data plane primarily undertakes the following responsibilities:
Virtual network traffic forwarding
Endpoint IP address discovery
VM network isolation
Stateful security rule enforcement
A distributed firewall operates in two modes: stateful forwarding and stateless forwarding. ANS provides a stateful distributed firewall function that filters network traffic based on connection state. Compared with network security policies that use ACL-based stateless packet filtering, the stateful distributed firewall function provided by ANS is more secure.
Policy log
Collects security policy information matching virtual machine traffic, generates policy logs, and maintains security policy hit counts.
