MECHANISM FOR ENABLING LAYER TWO HOST ADDRESSES TO BE SHIELDED FROM THE SWITCHES IN A NETWORK

• US 20160197854A1
• Filed: 03/14/2016
• Published: 07/07/2016
• Est. Priority Date: 10/22/2008
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Tanaka, Bert H., Mihelich, Joseph R.
• Granted Patent: US 9,948,576 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/56 Packet switching systems
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/66 Layer 2 routing, e.g. in Ethernet based MAN's
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/25 Routing or path finding in a switch fabric
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses

Abstract

Methods and systems for shielding layer two host addresses (e.g., MAC addresses) from a network are provided. An edge network device interposed between a network of switches and multiple local hosts receives from a first local host a first packet destined for a first destination host. The first local host has a first layer 2 (L2) address and a first layer 3 (L3) address associated therewith. The first packet includes the first L2 address as a source L2 address of the first packet, and includes the first L3 address as a source L3 address of the first packet. The edge network device shields the first L2 address from the network of switches by replacing the source L2 address for the first packet with a first substitute L2 address of a first communication channel of the edge network device before sending the first packet to the network of switches.

Claims

1. A method comprising:

receiving, by an edge network device interposed between a network of switches and a plurality of local hosts, from a first local host of the plurality of local hosts, a first packet destined for a first destination host, wherein the first local host has a first layer 2 (L2) address and a first layer 3 (L3) address associated therewith, and wherein the first packet includes the first L2 address as a source L2 address of the first packet, and includes the first L3 address as a source L3 address of the first packet;

reducing a number of L2 addresses that need to be stored by forwarding tables of the switches, by the edge network device, by exposing fewer L2 addresses to the switches, including replacing the source L2 address of the first packet with a first substitute L2 address that is shared by a first set of the plurality of local hosts associated with a first communication channel of the edge network device; and

transmitting, by the edge network device, the first packet to the network of switches via a first edge link coupled to the first communication channel.

2. The method of claim 1, wherein the first L2 address and the substitute L2 address comprise media access control (MAC) addresses, and wherein the first L3 address comprises an Internet Protocol (IP) address.

3. The method of claim 1, further comprising:

receiving, by the edge network device from a second local host of the plurality of hosts, a second packet destined for a second destination host, wherein the second local host has a second L2 address and a second L3 address associated therewith, and wherein the second packet includes the second L2 address as a source L2 address of the second packet, and includes the second L3 address as a source L3 address of the second packet;

shielding, by the edge network device, the second L2 address from the network of switches by replacing the source L2 address for the second packet with a second substitute L2 address that is shared by a second set of the plurality of local hosts associated with a second communication channel of the edge network device; and

transmitting, by the edge network device, the second packet to the network of switches via a second edge link coupled to the second communication channel.

4. The method of claim 3, further comprising:

receiving, by the edge network device from the network of switches, a third packet, wherein the third packet includes the first L3 address as a destination L3 address, and includes the first substitute L2 address as a destination L2 address;

accessing, by the edge network device, a data structure, wherein the data structure comprises a first set of information that indicates an association between the first L3 address and the first L2 address;

determining, by the edge network device, based at least partially upon the first L3 address contained within the third packet and the first set of information, that the destination L2 address of the third packet should be the first L2 address;

modifying the third packet, by the edge network device, by replacing the first substitute L2 address with the first L2 address, thereby making the first L2 address the destination L2 address of the third packet; and

sending, by the edge network device, the third packet to the first local host.

5. The method of claim 4, further comprising:

receiving, by the edge network device from the network of switches, a fourth packet, wherein the fourth packet includes the second L3 address as a destination L3 address, and includes the second substitute L2 address as a destination L2 address;

accessing, by the edge network device, the data structure, wherein the data structure comprises a second set of information that indicates an association between the second L3 address and the second L2 address;

determining, by the edge network device, based at least partially upon the second L3 address in the fourth packet and the second set of information, that the destination L2 address of the fourth packet should be the second L2 address;

modifying the fourth packet, by the edge network device, by replacing the second substitute L2 address with the second L2 address, thereby making the second L2 address the destination L2 address of the fourth packet; and

sending, by the edge network device, the forth packet to the first local host.

6. An edge network device comprising:

a plurality of communication channels; and

a communication manager configured to;

receive, from a first local host of a first set of local hosts of the plurality of local hosts that are coupled to a first communication channel of the plurality of communication channels, a first packet destined for a first destination host, wherein the first local host has a first layer 2 (L2) address and a first layer 3 (L3) address associated therewith, and wherein the first packet includes the first L2 address as a source L2 address of the first packet, and includes the first L3 address as a source L3 address of the first packet;

shield the first L2 address from the network of switches by replacing the source L2 address of the first packet with a first substitute L2 address associated with the first communication channel and which is shared by the first set of local hosts of the plurality of local hosts; and

send, via the first communication channel, the first packet to the network of switches.

7. The edge network device of claim 6, wherein the first L2 address and the substitute L2 address comprise media access control (MAC) addresses, and wherein the first L3 address comprises an Internet Protocol (IP) address.

8. The edge network device of claim 6, wherein the communication manager is further configured to:

receive, from a second local host of a second set of local hosts of the plurality of local hosts coupled to a second communication channel of the plurality of communication channels, a second packet destined for a second destination host, wherein the second host has a second L2 address and a second L3 address associated therewith, and wherein the second packet includes the second L2 address as a source L2 address of the second packet, and includes the second L3 address as a source L3 address of the second packet;

shield the second L2 address from the network of switches by replacing the source L2 address for the second packet with a second substitute L2 address associated with the second communication channel and which is shared by the second set of local hosts of the plurality of local hosts; and

send, via the communication channel, the second packet to the network of switches.

9. The edge network device of claim 6, wherein the communication manager is further configured to:

receive, from the network of switches via the first communication channel, a third packet, wherein the third packet includes the first L3 address as a destination L3 address, and includes the first substitute L2 address as a destination L2 address;

access a data structure, wherein the data structure comprises a first set of information that indicates an association between the first L3 address and the first L2 address;

determine, based at least partially upon the first L3 address in the third packet and the first set of information, that the destination L2 address of the third packet should be the first L2 address;

modify the third packet by replacing the first substitute L2 address with the first L2 address, thereby making the first L2 address the destination L2 address of the third packet; and

send, via the first communication channel, the third packet to the first local host.

10. The edge network device of claim 9, wherein the communication manager is further configured to:

receive, from the network of switches via the second communication channel, a fourth packet, wherein the fourth packet includes the second L3 address as a destination L3 address, and includes the second substitute L2 address as a destination L2 address;

access the data structure, wherein the data structure comprises a second set of information that indicates an association between the second L3 address and the second L2 address;

determine, based at least partially upon the second L3 address in the fourth packet and the second set of information, that the destination L2 address of the fourth packet should be the second L2 address;

modify the fourth packet by replacing the second substitute L2 address with the second L2 address, thereby making the second L2 address the destination L2 address of the fourth packet; and

send, via the second communication channel, the fourth packet to the second local host.

11. A method comprising:

receiving, by an edge network device interposed between a network of switches and a plurality of local hosts, a first request packet from a first local host of a first set of local hosts of the plurality of local hosts, wherein the first request packet requests a layer 2 (L2) address for a first target host, wherein the first local host has a first L2 address and a first layer 3 (L3) address associated therewith, wherein the first target host has a first target L3 address associated therewith, and wherein the first request packet includes the first L2 address as a source L2 address, includes the first L3 address as a sending L3 address, includes the first target L3 address as a target L3 address, and includes an indication that the first request packet is to be broadcasted;

obtaining, by the edge network device, the first L2 address and the first L3 address associated with the first local host from the first request packet;

updating, by the edge network device, a data structure to include a first set of information indicating an association between the first L3 address and the first L2 address;

shielding, by the edge network device, the first L2 address from the network of switches by replacing the source L2 address of the first request packet with a first substitute L2 address that is associated with a first communication channel of a plurality of communication channels of the edge network device and that is shared by the first set of local hosts of the plurality of local hosts; and

sending, by the edge network device, the first request packet to the network of switches to be broadcasted throughout the network of switches.

12. The method of claim 11, wherein the first L2 address and the first substitute L2 address comprise media access control (MAC) addresses, and wherein the first L3 address and the first target L3 address comprise Internet Protocol (IP) addresses.

13. The method of claim 11, further comprising:

receiving, from a second local host of a second set of local hosts of the plurality of local hosts, a second request packet requesting an L2 address for a second target host, wherein the second host has a second L2 address and a second L3 address associated therewith, wherein the second target host has a second target L3 address associated therewith, and wherein the second request packet includes the second L2 address as a source L2 address, includes the second L3 address as a sending L3 address, includes the second target L3 address as a target L3 address, and includes an indication that the second request packet is to be broadcasted;

obtaining the second L2 address and the second L3 address associated with the second host from the second request packet;

updating the data structure to include a second set of information indicating an association between the second L3 address and the second L2 address;

shielding, by the edge network device, the second L2 address from the network of switches by replacing the source L2 address of the second request packet with a second substitute L2 address associated with a second communication channel of the plurality of communication channels of the edge network device; and

sending the second request packet to the network of switches to be broadcasted throughout the network of switches.

14. The method of claim 13, further comprising:

receiving, from the network of switches, a first reply packet which is a reply to the first updated request packet, wherein the first reply packet includes the first L3 address, includes the first substitute L2 address as a destination L2 address, includes the first target L3 address, and includes a first requested L2 address for the first target host;

accessing the data structure;

determining, based at least partially upon the first L3 address in the first reply packet and the first set of information in the data structure, that the destination L2 address of the first reply packet should be the first L2 address;

deriving a first updated reply packet from the first reply packet by replacing the first substitute L2 address with the first L2 address, thereby making the first L2 address the destination L2 address of the first updated reply packet; and

sending the first updated reply packet to the first local host.

15. The method of claim 14, wherein the first requested L2 address included in the first reply packet for the first target host is not the target host'"'"'s real L2 address but rather is an L2 address associated with a communication channel of another edge network device to which the first target host is coupled.

16. The method of claim 14, further comprising:

receiving, from the network of switches, a second reply packet which is a reply to the second updated request packet, wherein the second reply packet includes the second L3 address, includes the second substitute L2 address as a destination L2 address, includes the second target L3 address, and includes a second requested L2 address for the second target host;

accessing the data structure;

determining, based at least partially upon the second L3 address in the second reply packet and the second set of information in the data structure, that the destination L2 address of the second reply packet should be the second L2 address;

deriving a second updated reply packet from the second reply packet by replacing the second substitute L2 address with the second L2 address, thereby making the second L2 address the destination L2 address of the second updated reply packet; and

sending the second updated reply packet to the second local host.

17. The method of claim 11, wherein the first request packet includes an indication that the first request packet is a standard address request packet, and wherein said deriving the first updated request packet further comprises including in the first request packet an indication that the first request packet is a non-standard address request packet.

18. The method of claim 17, further comprising:

receiving, from the first local host, a second request packet requesting an L2 address for the first target host, wherein the second request packet includes the first L2 address as a source L2 address, includes the first L3 address as a sending L3 address, includes the first target L3 address as a target L3 address, includes an indication that the second request packet is a standard address request packet, and includes an indication that the second request packet is to be broadcasted;

determining that the second request packet is a second request from the first local host for an L2 address for the first target host, thereby determining that the first local host has not received a reply to the first request packet;

in response to a determination that the first local host has not received a reply to the first request packet, shielding the first L2 address from the network of switches by replacing the source L2 address of the second request packet with the first substitute L2 address associated with the first communication channel of the edge network device and maintaining an indication in the second request packet that the second packet is standard address request packet; and

sending the second request packet to the network of switches to be broadcasted throughout the network of switches.

19. The method of claim 14, wherein the first request packet includes an indication that the first request packet is a standard address request packet, and wherein the method further comprises including in the first request packet an indication that the first request packet is a non-standard address request packet.

20. The method of claim 19, wherein the first reply packet includes an indication that the first reply packet is a non-standard address reply packet, and wherein the method further comprises including in the first reply packet an indication that the first reply packet is a standard address reply packet.