CloudPatterns.org

Defined as the isolation of a network environment from the rest of a communications network, the logical network perimeter establishes a virtual network boundary that can encompass and isolate a group of related cloud-based IT resources that may be physically distributed.

This mechanism can be implemented to:

• isolate IT resources in a cloud from non-authorized users
• isolate IT resources in a cloud from non-users
• isolate IT resources in a cloud from cloud consumers
• control the bandwidth that is available to isolated IT resources

It is typically established via network devices that supply and control the connectivity of a data center. Specifically, logical network perimeters are commonly deployed as virtualized IT environments that include:

• Virtual Firewall - An IT resource that actively filters network traffic to and from the isolated network while controlling its interactions with the Internet.
• Virtual Network - Usually acquired through VLANs, this IT resource isolates the network environment inside the data center infrastructure.

Figure 1 introduces the notation used for these two new IT resources.

Figure 1 - The symbols used to represent a virtual firewall (left) and a virtual network (right).

Figure 2 depicts a scenario in which one logical network perimeter contains a cloud consumer’s on-premise environment while another contains a cloud provider’s cloud-based environment. These perimeters are connected through a VPN that protects communications during their transit, since the VPN is typically implemented by point-to-point encryption of the data packets sent between the communicating endpoints.

Figure 2 - Two logical network perieters surround the cloud consumer and cloud provider environments.

Related Patterns:

• Bare-Metal Provisioning
• Centralized Remote Administration
• Direct I/O Access
• Elastic Network Capacity
• Hypervisor Clustering
• Load Balanced Virtual Server Instances
• Load Balanced Virtual Switches
• Multipath Resource Access
• Persistent Virtual Network Configuration
• Redundant Physical Connection for Virtual Servers
• Resource Management
• Resource Pooling
• Resource Reservation
• Self-Provisioning
• Shared Resources
• Storage Workload Management
• Workload Distribution
• Zero Downtime