Validation of layer 3 bridge domain subnets in in a network

• US 10,341,184 B2
• Filed: 07/28/2017
• Issued: 07/02/2019
• Est. Priority Date: 06/19/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Harneja, Sanchay, Pani, Ayas, Sundaresan, Sanjay, Jagannati, Harsha
• Primary Examiner(s): Whipple, Brian
• Application Number:
  US15/663,609
• Publication Number:
  US 20180367391A1
• Time in Patent Office: 704 Days
• Field of Search: None
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0266 using meta-data, objects or commands for formatting management information, e.g. using eXtensible markup language [XML]
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities

Abstract

Disclosed are systems, methods, and computer-readable media for assuring tenant forwarding in a network environment. Network assurance can be determined in layer 1, layer 2 and layer 3 of the networked environment including, internal-internal (e.g., inter-fabric) forwarding and internal-external (e.g., outside the fabric) forwarding in the networked environment. The network assurance can be performed using logical configurations, software configurations and/or hardware configurations

Claims

1. A system for performing a network assurance check of proper deployment of a configuration in a fabric, comprising:

at least one memory configured to store data; and

at least one processor operable to execute instructions associated with the data, which when executed by the at least one processor, causes the processor to;

receive, from a controller, a global logical model in a first format, the global logical model containing instructions on how endpoints connected to a network fabric communicate within the fabric, the global logical model including at least one virtual routing and forwarding instance (VRF);

receive, from one or more network devices within the fabric, a software model being at least a subset of instructions from the global logical model in a second format executable on the one or more network devices, the subset of instructions being instructions from the global logical model that are specific to operability of the one or more network devices;

convert, for each network device, the global logical model into a local logical model in the first format, the local logical model being at least a portion of the received global logical model that is specific to operability of the corresponding each network device;

create a container for each VRF of the at least one VRF in the received global logical model;

populate each of the created containers with the local logical model and the software model for each of the network devices associated with the VRF; and

confirm bridge domain (BD) subnets in the populated containers match.

2. The system of claim 1, wherein in the populated container a software model without a corresponding local logical model represents an improper extra item.

3. The system of claim 1, wherein in the populated container a local logical model without a corresponding software model represents an error in deployment of the global logical model.

4. The system of claim 1, wherein the population comprises a set union, such that the populated VRF container does not contain any duplicative BD subnets.

5. The system of claim 1, further comprising instruction which when executed by the at least one processor, causes the at least one processor to:

subtract one of the software models from a corresponding local logical hardware model;

subtract the corresponding local logical model from the one of the software models;

wherein a mismatch between the subtractions represents a discrepancy.

6. The system of claim 5, further comprising instructions, which when executed by the at least one processor, causes the at least one processor to generate an error event in response to a mismatch between the subtractions.

7. The system of claim 1, further comprising instructions, which when executed by the at least one processor, causes the at least one processor to generate an error event in response to a mismatch in the bridge domain (BD) subnets in the populated container.

8. A method for performing a network assurance check of proper deployment of a configuration in a fabric, comprising:

receiving, from a controller, a global logical model in a first format, the global logical model containing instructions on how endpoints connected to a network fabric communicate within the fabric, the global logical model including at least one virtual routing and forwarding instance (VRF);

receiving, from one or more network devices within the fabric, a software model being at least a subset of instructions from the global logical model in a second format executable on the one or more network devices, the subset of instructions being instructions from the global logical model that are specific to operability of the one or more network devices;

converting, for each network device, the global model into a local logical model in the first format, the local logical model being at least a portion of the received global logical model that is specific to operability of the corresponding each network device;

creating a container for each VRF of the at least one VRF in the received global logical model;

populating each of the created VRF containers with the local logical model and the software model for each of the network devices associated with the VRF; and

confirming bridge domain (BD) subnets in the populated VRF container match.

9. The method of claim 8, wherein in the populated container a software model without a corresponding local logical model represents an improper extra item.

10. The method of claim 8, in the populated VRF container a local logical model without a corresponding software model represents an error in deployment of the global logical model.

11. The method of claim 8, wherein the populating comprises a set union, such that the populated VRF container does not contain any duplicative BD subnets.

12. The method of claim 8, wherein the method further comprises, in the container:

subtracting one of the software models from a corresponding local logical hardware model;

subtracting the corresponding local logical model from the one of the software models;

wherein a mismatch between the subtractions represents a discrepancy.

13. The method of claim 12, further comprising generating an error event in response to a mismatch between the subtractions.

14. The method of claim 8, further comprising generating an error event in response to a mismatch in the bridge domain (BD) subnets in the populated VRF.

15. At least one non-transitory computer readable medium storing instructions, which when executed by a processor causes the processor to:

receive, from a controller, a global logical model in a first format, the global logical model containing instructions on how endpoints connected to a network fabric communicate within the fabric, the global logical model including at least one virtual routing and forwarding instance (VRF);

receive, from one or more network devices within the fabric, a software model being at least a subset of instructions from the global logical model in a second format executable on the one or more network devices, the subset of instructions being instructions from the global logical model that are specific to operability of the one or more network devices;

convert, for each network device, the global model into a local logical model in the first format, the local logical model being at least a portion of the received global logical model that is specific to operability of the corresponding each network device;

create a container for each VRF of the at least one VRF in the received global logical model;

populate each of the created containers with the local logical model and the software model for each of the network devices associated with the VRF; and

confirm bridge domain (BD) subnets in the populated containers match.

16. The at least one non-transitory computer readable medium of claim 15, wherein in the populated container a software model without a corresponding local logical model represents an improper extra item.

17. The at least one non-transitory computer readable medium of claim 15, in the populated container a local logical model without a corresponding software model represents an error in deployment of the global logical model.

18. The at least one non-transitory computer readable medium of claim 15, wherein the population comprises a set union, such that the populated VRF container does not contain any duplicative BD subnets.

19. The at least one non-transitory computer readable medium of claim 15, further comprising instructions to, in the container:

subtract one of the software models from a corresponding local logical hardware model;

subtract the corresponding local logical model from the one of the software models,

wherein a mismatch between the subtractions represents a discrepancy.

20. The at least one non-transitory computer readable medium of claim 15, further comprising instructions, which when executed by the at least one processor, causes the at least one processor to generate an error event in response to a mismatch in the bridge domain (BD) subnets in the populated container.