Method and system for service switching using service tags

• US 10,693,782 B2
• Filed: 05/07/2018
• Issued: 06/23/2020
• Est. Priority Date: 05/09/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Jain, Jayant, Sengupta, Anirban
• Primary Examiner(s): Phan, Man U
• Application Number:
  US15/973,487
• Publication Number:
  US 20180262427A1
• Time in Patent Office: 778 Days
• Field of Search: 370389
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 45/306 Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/20 Support for services
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

The disclosure herein describes a system, which provides service switching in a datacenter environment. The system can include a service switching gateway, which can identify a service tag associated with a received packet. During operation, the service switching gateway determines a source client, a requested service, or both for the packet based on the service tag, identifies a corresponding service portal based on the service tag, and forwards the packet toward the service portal. The service switching gateway can optionally maintain a mapping between the service tag and one or more of: a source client, a required service, the service portal, and a tunnel encapsulation. The service switching gateway can encapsulate the packet based on an encapsulation mechanism supported by the service portal and forward the packet based on the mapping.

Claims

1. A non-transitory machine readable medium storing a program for specifying a service to perform on a received packet, the program for execution by at least one hardware processing unit, the program comprising sets of instructions for:

identifying a source client and a requested service associated with the received packet;

generating a service tag that identifies the source client and the requested service;

storing the service tag in an encapsulation header, and using the encapsulation header with the stored service tag to encapsulate the packet; and

forwarding the encapsulated packet to a service switching gateway that extracts the service tag from the encapsulation header and directs the packet to a service machine by using the extracted service tag to identify the service machine from a mapping structure that maps different service tags to different service machines.

2. The non-transitory machine readable medium of claim 1, wherein as the service tag identifies both the source client and the requested service, the service switching gateway identifies the service machine based on the source client and the requested service associated with the packet.

3. The non-transitory machine readable medium of claim 1, wherein the packet originates from a virtual machine executing on a host computer, and the program is executed by a device that is different than the host computer.

4. The non-transitory machine readable medium of claim 1, wherein the packet originates from a virtual machine executing on a host computer, and the program executes on the host computer.

5. The non-transitory machine readable medium of claim 1, wherein the packet is sent by a machine operating in a multi-tenant datacenter, and the identified source client is a tenant.

6. The non-transitory machine readable medium of claim 1, wherein the service tag comprises one or more of:

a GRE key, an IPSec Security Parameter Index (SPI), a VLAN tag, and IP header options.

7. The non-transitory machine readable medium of claim 1, wherein the service switching gateway directs the packet to the service machine by further using the extracted service tag to select an encapsulation mechanism for encapsulating the packet to send to the service machine.

8. The non-transitory machine readable medium of claim 7, wherein the service switching gateway selects the encapsulation mechanism from a group of encapsulation mechanisms that includes two or more of:

Generic Routing Encapsulation (GRE) tunneling;

Internet Protocol Security (IPsec) tunneling;

Virtual Local Area Network (VLAN) encapsulation; and

Internet Protocol (IP) encapsulation.

9. A non-transitory machine readable medium storing a service-switching program for directing a packet to a service machine to perform a service on the packet, the program for execution by at least one hardware processing unit, the program comprising sets of instructions for:

receiving an encapsulated packet comprising an encapsulation header that includes a service tag that identifies (i) a source identifier identifying a source machine for the packet and (ii) a service identifier identifying the requested service;

extracting, from the encapsulated packet, the service tag;

from a plurality of service policies, selecting a particular service policy by using a mapping structure that maps service tags to service policies to select the particular service policy associated with the extracted service tag;

using the selected service policy to select a particular service machine to perform a service operation on the packet; and

forwarding the packet to the selected particular service machine.

10. The non-transitory machine readable medium of claim 9, wherein the set of instructions for selecting the particular service policy comprises a set of instructions for selecting an encapsulation mechanism for encapsulating the packet to send to the selected particular service machine.

11. The non-transitory machine readable medium of claim 10, wherein the service-switching program selects the encapsulation mechanism from a group of encapsulation mechanisms that includes two or more of:

Generic Routing Encapsulation (GRE) tunneling;

Internet Protocol Security (IPsec) tunneling;

Virtual Local Area Network (VLAN) encapsulation; and

Internet Protocol (IP) encapsulation.

12. The non-transitory machine readable medium of claim 9, wherein the received encapsulated packet is a first received packet, the program further comprising sets of instructions for:

receiving a second packet from the particular service machine to which the first packet was forwarded; and

reconstructing the service identifier and the source identifier for the second packet based on the selected service policy.

13. The non-transitory machine readable medium of claim 9, wherein the service tag comprises one or more of:

a GRE key, an IPSec Security Parameter Index (SPI), a VLAN tag, and IP header options.

14. The non-transitory machine readable medium of claim 9, wherein the packet originates from a machine that executes on a host computer and the packet is encapsulated by a service-originating switch executing on the host computer.

15. The non-transitory machine readable medium of claim 9, wherein the packet originates from a machine that executes on a host computer and the packet is encapsulated by a service originating service-originating switch operating outside of the host computer.

16. A non-transitory machine readable medium storing a service-switching program for directing a packet to a service machine to perform a service on the packet, the program for execution by at least one hardware processing unit, the program comprising sets of instructions for:

receiving an encapsulated packet comprising an encapsulation header that includes a source identifier identifying a source machine for the packet and a service identifier identifying the requested service;

extracting, from the encapsulated packet, the source and service identifiers;

from a plurality of service policies, selecting a particular service policy based on the extracted source and service identifiers, said selected service policy specifying a particular forwarding operation to perform; and

based on the particular forwarding operation, forwarding the packet to a service machine, wherein at least two different service policies for two different source clients specify the same forwarding operation, and at least two different service policies for two other different source clients specify different forwarding operations.

17. The non-transitory machine readable medium of claim 16, wherein the program further comprises a set of instructions for maintaining a mapping between the service machine and one or more of:

a source machine;

a requested service;

the service identifier; and

a tunnel encapsulation.

18. The non-transitory machine readable medium of claim 16, wherein the service identifier comprises one or more of:

a GRE key, an IPSec Security Parameter Index (SPI), a VLAN tag, and IP header options.