LinkedIn's Distributed Firewall
summary
LinkedIn shifts firewall enforcement from big‑iron choke points to per‑host rules that are generated from a central ACL DB and applied via iptables and ipset, using CFEngine-driven JSON from ACL DB to compute and atomically swap sets. A spine‑and‑leaf rollout (about 2400 switches supporting 100,000 bare metals) removes CRT bottlenecks, adds IPv6 without TCAM expansion, enables live black‑holing and QoS, and lets operations decommission a data center in days instead of weeks.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:22Script Kiddie Hacking: Easy network attack vectors
- 2:51Production Network Security
- 5:22The Vertical Network Architecture
- 9:29The Horizontal Network Architecture
related talks
22mDos and Don’ts: Designing an XDS Backend for the LinkedIn Scale
52mFirewalls, and where to put them
40mImplementing the SPDY Protocol in the LinkedIn Social Network
29mDNS: Old Solution for Modern Problems
05mHow Configuring a Firewall has Changed Over the Last 15 Years
22mFirewalld Changes Coming to Your OS
30mClusterlink: Enabling Fine-Grained and High-Speed Application-Level Connectivity...
04mFirewalls for the Gaming Industry