Virtual tunnel network router

• US 20070130366A1
• Filed: 11/21/2006
• Published: 06/07/2007
• Est. Priority Date: 12/02/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Kameswaran, Anand, O'Connell, Martin
• Granted Patent: US 9,397,856 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 45/586 of virtual routers

Abstract

A virtual host computer is presented that includes a virtualization software platform, at least one virtual machine executed by the virtualization software platform, a private network segment configured to prevent communications with at least one external computer, a public network segment configured to facilitate communications with the at least one external computer, and a virtual routing module that is executed as a virtual image by the virtualization software platform. The virtual routing module is configured to communicate with the at least one virtual machine via the private network segment, communicate with the public network segment, and execute a tunneling layer to form a private virtual network segment between the at least one virtual machine and the at least one external computer.

Claims

1. A virtualized host computer, comprising:

a virtualization software platform;

at least one virtual machine executed by the virtualization software platform;

a private network segment configured to prevent communications with at least one external computer;

a public network segment configured to facilitate communications with the at least one external computer;

a virtual routing module that is executed as a virtual image by the virtualization software platform and is configured to;

(a) communicate with the at least one virtual machine via the private network segment;

(b) communicate with the public network segment; and

(c) execute a tunneling layer to form a private virtual network segment between the at least one virtual machine and the at least one external computer.

2. The virtualized host computer of claim 1, wherein the at least one virtual machine contains a network address that is on a subnet that is reserved as non-routable.

3. The virtualized host computer of claim 2, wherein the virtual router contains a network address that is based on the virtual machine network address.

4. The virtualized host computer of claim 1, wherein the at least one external computer is configured as a second virtual host computer having a second virtual machine and a second private network segment, and

wherein the executed tunneling layer establishes the private virtual network segment by merging the private network segment and the second private network segment.

5. The virtualized host computer of claim 1, wherein the tunneling layer further comprises a first tunnel mechanism configured to forward data to virtual router-enabled computers and a second tunnel mechanism configured to receive data from virtual router-enabled computers.

6. The virtualized host computer of claim 1, wherein, for internal communications between more than one virtual machine within the host computer, the virtual routing module executes multi-homing to route packets between the virtual machines.

7. The virtualized host computer of claim 1, wherein the virtual routing module further comprises public and hidden network addresses of data sources and data destinations.

8. The virtualized host computer of claim 1, wherein the virtual routing module further comprises commands configured to assist in administrative tasks.

9. A virtualized computer network, comprising:

a first host computer including a first virtualization platform, at least one virtual machine executed by the first virtualization platform, a first private network segment configured to prevent external communications, a first public network segment configured to facilitate external communications, and a first virtual routing module that is executed as a virtual image by the first virtualization software platform;

a second host computer including a second virtualization platform, at least one virtual machine executed by the second virtualization platform, a second private network segment configured to prevent external communications, a second public network segment configured to facilitate external communications, and a second virtual routing module that is executed as a virtual image by the second virtualization software platform;

(a) wherein the first virtual routing module is configured to;

(i) communicate with the at least one virtual machine of the first host computer via the first private network segment;

(ii) communicate with the at least one virtual machine of the second host computer via the first public network segment; and

(iii) execute a first tunneling mechanism to form a private virtual network segment from the at least one virtual machine of the first host computer to the at least one virtual machine of the second host computer; and

(b) wherein the second virtual routing module is configured to;

(i) communicate with the at least one virtual machine of the second host computer via the second private network segment;

(ii) communicate with the at least one virtual machine of the first host computer via the second public network segment; and

(iii) execute a second tunneling mechanism to form a private virtual network segment from the at least one virtual machine of the second host computer to the at least one virtual machine of the first host computer.

10. The virtualized computer network of claim 9, wherein the at least one virtual machines of the first and second host computers contain network addresses that are on respective subnets that are reserved as non-routable.

11. The virtualized computer network of claim 10, wherein the first and second virtual routing modules contain network addresses that are based on the respective at least one virtual machines of the first and second host computers.

12. The virtualized computer network of claim 9, wherein, for internal communications between more than one virtual machine being executed within the first host computer or the second host computer, the respective first or second virtual routing modules executes multi-homing to route packets between the virtual machines.

13. The virtualized computer network of claim 9, wherein the first and second virtual routing modules further comprise public and hidden network addresses of data sources and data destinations.

14. The virtualized computer network of claim 9, wherein the first and second virtual routing modules further comprise commands configured to assist in administrative tasks.

15. A method of establishing a virtualized computer network, comprising:

executing a first virtualization platform on a first host computer, the first host computer including a first private network segment configured to prevent external communications and a first public network segment configured to facilitate external communications;

initiating an instance of at least one virtual machine by the first virtualization platform;

executing a second virtualization platform on a second host computer, the second host computer including a second private network segment configured to prevent external communications and a second public network segment configured to facilitate external communications;

initiating an instance at least one virtual machine by the second virtualization platform;

deploying a first virtual routing module on the first host computer, the first virtual routing module being executed as a virtual image by the first virtualization software platform;

deploying a second virtual routing module on the second host computer, the second virtual routing module being executed as a virtual image by the second virtualization software platform;

configuring the first virtual routing module to communicate with the at least one virtual machine of the first host computer via the first private network segment, communicate with the at least one virtual machine of the second host computer via the first public network segment, and execute a first tunneling mechanism to form a private virtual network segment from the at least one virtual machine of the first host computer to the at least one virtual machine of the second host computer; and

configuring the second virtual routing module to communicate with the at least one virtual machine of the second host computer via the second private network segment, communicate with the at least one virtual machine of the first host computer via the second public network segment, and execute a second tunneling mechanism to form a private virtual network segment from the at least one virtual machine of the second host computer to the at least one virtual machine of the first host computer.

16. The method of claim 15, further comprising assigning the at least one virtual machines of the first and second host computers to network addresses that are on respective subnets and are reserved as non-routable.

17. The method of claim 16, further comprising assigning the first and second virtual routing modules to network addresses that are based on the respective at least one virtual machines of the first and second host computers.

18. The method of claim 15, wherein, for internal communications between more than one virtual machine being executed within the first host computer or the second host computer, executing multi-homing to route packets between the virtual machines within each of the first and second host computers.

19. The method of claim 15, wherein the first and second virtual routing modules further comprise public and hidden network addresses of data sources and data destinations.

20. The method of claim 15, wherein the first and second virtual routing modules further comprise commands configured to assist in administrative tasks.