In-service software upgrade of virtual router with reduced packet loss

• US 10,534,601 B1
• Filed: 06/30/2017
• Issued: 01/14/2020
• Est. Priority Date: 06/30/2017
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Venkata, Suresh Kumar Vinapamula, Sivaramakrishnan, Rajagopalan, Bansal, Sachin, K V, Praveen, Killi, Hari Prasad
• Primary Examiner(s): Myers, Eric
• Application Number:
  US15/639,556
• Time in Patent Office: 928 Days
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/656 while running
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/56 Routing software
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/74 Address processing for routing

Abstract

Techniques are disclosed for performing an In-Service Software Upgrade (“ISSU”) of a first packet forwarding component (PFC) of a virtual router configured to forward traffic flows for a plurality of session instances within a cloud-based data center. The techniques described herein may retain flow state information throughout the ISSU process without interrupting network traffic flow. In one example, a processor of a plurality of compute nodes within the data center receives a request to perform an ISSU of the first PFC. The processor spawns a second virtual routing agent and a second PFC. The second virtual routing agent synchronizes flow state information with a first virtual routing agent for the virtual router. After synchronizing the flow state information, the virtual router switches from forwarding traffic flows by the first PFC to forwarding traffic flows by the second PFC. The ISSU process deactivates the first virtual router and the first PFC.

Claims

1. A method comprising:

receiving, by at least one processor of a plurality of compute nodes configured to perform compute functions for a plurality of session instances of a cloud data center, a request to perform an in-services software upgrade (ISSU) of a first packet forwarding component for a virtual router, wherein the first packet forwarding component executes within a kernel space of a memory of the plurality of compute nodes and is configured to forward traffic flows for the plurality of session instances, and wherein a first virtual routing agent for the virtual router executes within a user space of the memory and is configured to maintain flow state information for the traffic flows forwarded by the first packet-forwarding component of the virtual router;

spawning, by the at least one processor, a second packet forwarding component for the virtual router within the kernel space of the memory;

spawning, by the at least one processor, a second virtual routing agent for the virtual router within the user space of the memory, wherein the second virtual routing agent is configured to maintain flow state information for the traffic flows forwarded by the second packet-forwarding component of the virtual router;

synchronizing, by the at least one processor, the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent; and

after synchronizing the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent, directing, by the at least one processor, the traffic flows for the plurality of session instances from the first packet forwarding component of the virtual router to the second packet forwarding component of the virtual router without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.

2. The method of claim 1,

wherein the flow state information is installed within a first memory module for the virtual router, wherein the first memory module is within the kernel space of the memory,

wherein the method further comprises spawning, by the at least one processor, a second memory module for the virtual router within the kernel space of the memory, and

wherein synchronizing the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent comprises installing the flow state information installed within the first memory module within the second memory module.

3. The method of claim 2, further comprising:

after directing the traffic flows for the plurality of session instances from the first packet forwarding component to the second packet forwarding component, deactivating the first packet forwarding component, the first memory module, and the first virtual routing agent without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.

4. The method of claim 1, wherein directing the traffic flows for the plurality of session instances from the first packet forwarding component to the second packet forwarding component without interrupting traffic flow forwarding for the plurality of session instances by the virtual router comprises:

forwarding, by the first packet forwarding component, traffic flows for the plurality of session instances, and

switching to forwarding, by the second packet forwarding component, traffic flows for the plurality of session instances, without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.

5. The method of claim 1, further comprising after directing the traffic flows for the plurality of session instances from the first packet forwarding component to the second packet forwarding component without interrupting traffic flow forwarding for the plurality of session instances by the virtual router, permitting at least one traffic flow of the traffic flows for the plurality of session instances to age out, wherein the at least one traffic flow is associated with an in-flight connection termination of the first packet forwarding component.

6. The method of claim 1, further comprising forwarding, by the second packet forwarding component, traffic flows for the plurality of session instances.

7. The method of claim 6, wherein forwarding, by the second packet forwarding component, traffic flows for the plurality of session instances comprises:

receiving, by the second packet forwarding component, a first packet of a traffic flow for the plurality of session instances;

determining, by the second packet forwarding component, that a path for the first traffic flow is not within the second memory module;

directing, by the second packet forwarding component, the first packet to the second virtual routing agent;

installing, by the second virtual routing agent, a path for the traffic flow in the second memory module; and

after installing the path, forwarding, by the second packet forwarding component, subsequent packets for the traffic flow for the plurality of session instances.

8. The method of claim 1, wherein the first packet forwarding component configured to forward traffic flows for the plurality of session instances is configured to:

process the traffic flows to construct aggregate tunnel packets; and

forward the aggregate tunnel packets to respective virtual machines of a plurality of virtual machines executed by the plurality of compute nodes.

9. The method of claim 1, wherein the first packet forwarding component configured to forward traffic flows for the plurality of session instances is configured to perform layer-3 forwarding of the traffic flows for the plurality of session instances.

10. At least one processor of a plurality of compute nodes configured to perform compute functions for a plurality of session instances of a cloud data center, the at least one processor configured to:

receive a request to perform an in-services software upgrade (ISSU) of a first packet forwarding component for a virtual router, wherein the first packet forwarding component executes within a kernel space of a memory of the plurality of compute nodes and is configured to forward traffic flows for the plurality of session instances, and wherein a first virtual routing agent for the virtual router executes within a user space of the memory and is configured to maintain flow state information for the traffic flows forwarded by the first packet-forwarding component of the virtual router;

spawn a second packet forwarding component for the virtual router within the kernel space of the memory;

spawn a second virtual routing agent for the virtual router within the user space of the memory, wherein the second virtual routing agent is configured to maintain flow state information for the traffic flows forwarded by the second packet-forwarding component of the virtual router;

synchronize the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent; and

after synchronizing the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent, direct the traffic flows for the plurality of session instances from the first packet forwarding component of the virtual router to the second packet forwarding component of the virtual router without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.

11. The at least one processor of claim 10,

wherein the flow state information is installed within a first memory module for the virtual router, wherein the first memory module is within the kernel space of the memory,

wherein the at least one processor is further configured to spawn a second memory module for the virtual router within the kernel space of the memory, and

wherein, to synchronize the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent, the at least one processor is further configured to install the flow state information installed within the first memory module within the second memory module.

12. The at least one processor of claim 11, further configured to:

after directing the traffic flows for the plurality of session instances from the first packet forwarding component to the second packet forwarding component, deactivate the first packet forwarding component, the first memory module, and the first virtual routing agent without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.

13. The at least one processor of claim 10, wherein, to direct the traffic flows for the plurality of session instances from the first packet forwarding component to the second packet forwarding component without interrupting traffic flow forwarding for the plurality of session instances by the virtual router, the at least one processor is further configured to:

forward, via the first packet forwarding component executed by the at least one processor, traffic flows for the plurality of session instances, and

switch from forwarding, via the first packet forwarding component, traffic flows for the plurality of session instances to forwarding, by the second packet forwarding component, traffic flows for the plurality of session instances, without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.

14. The at least one processor of claim 10, wherein, after directing the traffic flows for the plurality of session instances from the first packet forwarding component to the second packet forwarding component without interrupting traffic flow forwarding for the plurality of session instances by the virtual router, the at least one processor is further configured to permit at least one traffic flow of the traffic flows for the plurality of session instances to age out, wherein the at least one traffic flow is associated with an in-flight connection termination of the first packet forwarding component.

15. The at least one processor of claim 10, wherein the at least one processor is further configured to forward, via the second packet forwarding component, traffic flows for the plurality of session instances.

16. The at least one processor of claim 15, wherein to forward, via the second packet forwarding component, traffic flows for the plurality of session instances, the at least one processor is further configured to:

receive, via the second packet forwarding component, a first packet of a traffic flow for the plurality of session instances;

determine, via the second packet forwarding component, that a path for the first traffic flow is not within the second memory module;

direct, via the second packet forwarding component, the first packet to the second virtual routing agent;

install, via the second virtual routing agent, a path for the traffic flow in the second memory module; and

after installing the path, forward, via the second packet forwarding component, subsequent packets for the traffic flow for the plurality of session instances.

17. A non-transitory computer-readable medium comprising instructions that, when executed, cause at least one processor of a plurality of compute nodes configured to perform compute functions for a plurality of session instances of a cloud data center to:

receive a request to perform an in-services software upgrade (ISSU) of a first packet forwarding component for a virtual router, wherein the first packet forwarding component executes within a kernel space of a memory of the plurality of compute nodes and is configured to forward traffic flows for the plurality of session instances, and wherein a first virtual routing agent for the virtual router executes within a user space of the memory and is configured to maintain flow state information for the traffic flows forwarded by the first packet-forwarding component of the virtual router;

spawn a second packet forwarding component for the virtual router within the kernel space of the memory;

spawn a second virtual routing agent for the virtual router within the user space of the memory, wherein the second virtual routing agent is configured to maintain flow state information for the traffic flows forwarded by the second packet-forwarding component of the virtual router;

synchronize the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent; and

after synchronizing the flow state information of the first virtual routing agent and the flow state information of the second virtual routing agent, direct the traffic flows for the plurality of session instances from the first packet forwarding component of the virtual router to the second packet forwarding component of the virtual router without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.

18. The computer-readable medium of claim 17,

wherein the flow state information is installed within a first memory module for the virtual router, wherein the first memory module is within the kernel space of the memory,

wherein the at least one processor is further configured cause the at least one processor to spawn a second memory module for the virtual router within the kernel space of the memory;

and

wherein, to synchronize the flow state information of the first virtual routing agent with the second virtual routing agent, the at least one processor is further configured to install the flow state information installed within the first memory module within the second memory module.

19. The at least one processor of claim 18, further configured cause the at least one processor to:

after directing the traffic flows for the plurality of session instances from the first packet forwarding component to the second packet forwarding component, deactivate the first packet forwarding component, the first memory module, and the first virtual routing agent without interrupting traffic flow forwarding for the plurality of session instances by the virtual router.