Packet processing in federated network

• US 8,964,767 B2
• Filed: 08/17/2012
• Issued: 02/24/2015
• Est. Priority Date: 08/17/2011
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Koponen, Teemu, Casado, Martin, Thakkar, Pankaj, Zhang, Ronghua, Wendlandt, Daniel J.
• Primary Examiner(s): Hsu, Alpus H
• Assistant Examiner(s): WILLIAMS, ELTON S
• Application Number:
  US13/589,044
• Publication Number:
  US 20130044763A1
• Time in Patent Office: 921 Days
• Field of Search: 370/401, 370/231, 370/392, 370/397, 370/409, 370/428, 709/230, 709/238
• US Class Current: 370/401
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing

Abstract

Some embodiments provide a novel method for forwarding a packet at a managed switching element in a first domain. The method receives a packet from a local machine. The method encapsulates the packet with a first context identifier that identifies a first logical port of a first logical switching element that couples to machines in both the first domain and a second domain. The first logical port maps to a destination address of the packet. Based on a mapping of the first logical port to a second logical port of a second logical switching element that couples to machines in only the first domain, the method encapsulates the packet with a second context identifier that identifies the second logical port. The method transmits the twice-encapsulated packet out of a port of the managed switching element based on the second context identifier.

Claims

1. A method for forwarding a packet at a managed switching element in a first domain, the method comprising:

receiving a packet from a local end machine that operates on a same physical machine as the managed switching element;

at the managed switching element, encapsulating the packet with a first context identifier that identifies a first logical egress port of a first logical datapath set implemented by (i) the managed switching element, ii) other managed switching elements in the first domain, and (iii) managed switching elements in a second domain, wherein the first logical datapath set couples to end machines in both the first domain and the second domain, wherein the first logical datapath set maps a destination address of the packet to the first logical egress port;

at the managed switching element, based on a mapping of the first logical egress port to a second logical egress port of a second logical datapath set that couples to machines in only the first domain, encapsulating the once-encapsulated packet with a second context identifier that identifies the second logical egress port, wherein the second logical datapath set is implemented by only (i) the managed switching element and (ii) other managed switching elements in the first domain, wherein the second logical datapath set maps logical ports of the first logical datapath set to logical ports of the second logical datapath set and a third logical datapath set, implemented by managed switching elements in the second domain, maps logical ports of the first logical datapath set to logical ports of the third logical datapath set; and

transmitting the twice-encapsulated packet out of a port of the managed switching element based on the second context identifier.

2. The method of claim 1, wherein each of the first and second context identifiers comprises a logical port identifier that is separate from any source address or destination address associated with the managed switching elements.

3. The method of claim 1, wherein the first logical egress port maps to a physical port of a managed switching element in the second domain that connects to an end machine having the destination address of the packet.

4. The method of claim 3, wherein the second logical egress port maps to a physical port of a managed interconnection switching element in the first domain that connects to the second domain.

5. The method of claim 4, wherein the managed interconnection switching element connects to a second managed interconnection switching element in the second domain.

6. The method of claim 1, wherein the managed switching element is a software switching element.

7. The method of claim 1 further comprising, prior to encapsulating the packet with the first context identifier:

mapping a port of the managed switching element at which the packet is received to a first logical ingress port of the second logical datapath set; and

mapping the first logical ingress port to a second logical ingress port of the first logical datapath set.

8. The method of claim 7, wherein the managed switching element stores the first and second logical ingress ports in a set of registers while forwarding the packet.

9. The method of claim 7 further comprising, prior to encapsulating the packet with the first context identifier, applying access control list (ACL) rules to the packet based on the second logical ingress port.

10. The method of claim 9, wherein the ACL rules specify to allow the packet.

11. The method of claim 1, wherein encapsulating the once-encapsulated packet with a second context identifier comprises:

identifying a physical location in the first domain that corresponds to the second logical egress port; and

identifying the port of the managed switching element for which a tunnel to the physical location in the first domain has been created.

12. The method of claim 11, wherein the packet is encapsulated with tunneling information for the tunnel between the managed switching element and the identified physical location in the first domain.

13. The method of claim 11, wherein the identified physical location in the first domain is a particular port of an interconnection switching element for connecting the first domain to the second domain.

14. A method for forwarding a network data packet, the method comprising:

at an interconnection switching element of a first domain that connects the first domain to a second domain, receiving a packet from an edge switching element of the first domain;

removing from the packet a first encapsulation that identifies a first logical egress port of a first logical datapath set that couples to network hosts in the first domain and is implemented by both the edge switching element and the interconnection switching element of the first domain, wherein the identified first logical egress port couples to a second logical datapath set that couples to network hosts in the second domain, the packet having a second encapsulation for identifying a second logical egress port of a third logical datapath set that couples to network hosts in both the first and second domains and is implemented by switching elements in both the first and second domains, wherein the first logical datapath set maps logical ports of the third logical datapath set to logical ports of the first logical datapath set and the second logical datapath set maps logical ports of the third logical datapath set to logical ports of the second logical datapath set;

based on the identified first logical egress port, using interconnection instructions to encapsulate the packet with a third encapsulation identifying a logical ingress port of the second logical datapath set, wherein the identified logical ingress port couples to the first logical datapath set that couples to network hosts in the first domain; and

transmitting the packet having the second and third encapsulations to an interconnection switching element of the second domain, wherein the interconnection switching element and other switching elements of the second domain implement the second logical datapath set.

15. The method of claim 14, wherein the first and second encapsulations were applied to the packet by the edge switching element of the first domain.

16. The method of claim 14, wherein a tunnel exists between the interconnection switching element of the first domain and the interconnection switching element of the second domain, wherein transmitting the packet having the second and third encapsulations to the interconnection switching element of the second domain comprises encapsulating the packet with tunneling information for the tunnel.

17. The method of claim 14, wherein the interconnection switching elements of the first and second domains are extenders.

18. A method for forwarding a network data packet, the method comprising:

at an interconnection switching element of a first domain, that connects the first domain to a second domain, receiving a packet from an interconnection switching element of the second domain;

removing a first encapsulation that identifies a logical ingress port of a first logical datapath set that couples to machines in the first domain, wherein (i) the identified logical ingress port maps to a second logical datapath set that couples to machines in the second domain and (ii) other logical ports of the first logical datapath set map to machines in the first domain, wherein the first logical datapath set is implemented by the interconnection switching element of the first domain and other switching elements of the first domain, and the second logical datapath set is implemented by the interconnection switching element of the second domain and other switching elements of the second domain;

removing a second encapsulation that identifies a first logical egress port of a third logical datapath set that couples to machines in both the first and second domains, wherein logical ports of the third logical datapath set map to logical egress ports of the first and second logical datapath sets, the third logical datapath set implemented by switching elements in both the first and second domains;

based on a mapping of the first logical egress port to a second logical egress port of the first logical datapath set, encapsulating the packet with a context identifier that identifies the second logical egress port, which maps to a destination address of the first domain; and

transmitting the encapsulated packet to an edge switching element of the first domain.

19. The method of claim 18, wherein the edge switching element couples directly to a machine having a destination address of the packet.

20. The method of claim 19, wherein the edge switching element is a software switching element that operates on a same physical host machine as the destination machine.

21. The method of claim 20, wherein the destination machine is a virtual machine.