Connection identifier assignment and source network address translation

• US 9,306,909 B2
• Filed: 11/20/2014
• Issued: 04/05/2016
• Est. Priority Date: 11/15/2011
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Koponen, Teemu, Zhang, Ronghua, Thakkar, Pankaj, Casado, Martin
• Primary Examiner(s): Yao, Kwang B
• Assistant Examiner(s): DUDA, ADAM K
• Application Number:
  US14/549,517
• Publication Number:
  US 20150081861A1
• Time in Patent Office: 502 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 41/0889 Techniques to speed-up the configuration process
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 49/70 : Virtual switches
• CPC Class Codes: H04L 61/2503 : Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/2517 : using port numbers
• CPC Class Codes: H04L 61/2521 : Translation architectures other than single NAT servers
• CPC Class Codes: H04L 61/256 : NAT traversal
• CPC Class Codes: H04L 63/0218 : Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 67/1008 : based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

A controller of a network control system for configuring several middlebox instances is described. The middlebox instances implement a middlebox in a distributed manner in several hosts. The controller assigns a first set of identifiers to a first middlebox instance that associates an identifier in the first set with a first packet. The controller assigns a second set of identifiers to a second middlebox instance that associates an identifier in the second set with a second packet.

Claims

1. A non-transitory machine readable medium of a controller of a network control system for configuring a logical middlebox in a plurality of hosts, the network control system comprising a plurality of controllers, the non-transitory machine readable medium storing sets of instructions for:

receiving configuration data for configuring, in each host of the plurality of hosts, a middlebox instance to provide a source network address translation (SNAT) service to a virtual machine operating in the host;

identifying a set of additional controllers of the network control system that manage the plurality of middlebox instances for implementing the configuration data; and

sending the configuration data to the identified set of additional controllers for the additional controllers to subsequently distribute the configuration data to the plurality of middlebox instances.

2. The non-transitory machine readable medium of claim 1, wherein the controller is a logical controller and the additional controllers are physical controllers.

3. The non-transitory machine readable medium of claim 1, wherein the network control system is for generating physical control plane data for managing a set of managed forwarding elements that implements forwarding operations associated with a first logical datapath set, wherein the controller further comprises a set of instructions for converting logical control plane data for the first logical datapath set to physical control plane data.

4. The non-transitory machine readable medium of claim 3, wherein the controller is a master controller for the first logical datapath set, wherein each of the additional controllers is a master controller for a set of managed forwarding elements that operate in the plurality of hosts to implement the first logical datapath set.

5. The non-transitory machine readable medium of claim 1, wherein the configuration data comprise at least one mapping of a pair of addresses.

6. The non-transitory machine readable medium of claim 1, wherein the configuration data comprise a set of connection identifiers, wherein the middlebox instance provides the SNAT service to the virtual machine operating in the same host by assigning connection identifiers in the set of connection identifiers to packets the middlebox instance receives from the virtual machine.

7. The non-transitory machine readable medium of claim 6, wherein connection identifiers in the set of connection identifiers are assigned to packets in order for managed switching elements, operating in other hosts that receive the packets, to use the connection identifiers to send responses to the correct sources of the packets.

8. The non-transitory machine readable medium of claim 6, wherein the middlebox instance is configured to associate a connection identifier in the set of connection identifiers with a first packet originating from the virtual machine operating in the host.

9. The non-transitory machine readable medium of claim 8, wherein the middlebox instance associates the connection identifier with the first packet by replacing a source port number of the first packet with the connection identifier.

10. The non-transitory machine readable medium of claim 6, wherein the set of connection identifiers is recorded as no longer available to prevent other middlebox instances from assigning connection identifiers in the set of connection identifiers to packets the other middlebox instances receive.

11. For a controller of network control system comprising a plurality of controllers, a method for configuring a logical middlebox in a plurality of hosts, the method comprising:

receiving configuration data for configuring, in each host of the plurality of hosts, a middlebox instance to provide a source network address translation (SNAT) service to a virtual machine operating in the host;

identifying a set of additional controllers of the network control system that manage the plurality of middlebox instances for implementing the configuration data; and

sending the configuration data to the identified set of additional controllers for the additional controllers to subsequently distribute the configuration data to the plurality of middlebox instances.

12. The method of claim 11, wherein the controller is a logical controller and the additional controllers are physical controllers.

13. The method of claim 11, wherein the network control system is for generating physical control plane data for managing a set of managed forwarding elements that implements forwarding operations associated with a first logical datapath set, wherein the controller further comprises a set of instructions for converting logical control plane data for the first logical datapath set to physical control plane data.

14. The method of claim 13, wherein the controller is a master controller for the first logical datapath set, wherein each of the additional controllers is a master controller for a set of managed forwarding elements that operate in the plurality of hosts to implement the first logical datapath set.

15. The method of claim 11, wherein the configuration data comprise at least one mapping of a pair of addresses.

16. The method of claim 11, wherein the configuration data comprises a set of connection identifiers, wherein the middlebox instance provides the SNAT service to the virtual machine operating in the same host by assigning connection identifiers in the set of connection identifiers to packets the middlebox instance receives from the virtual machine.

17. The method of claim 16, wherein connection identifiers in the set of connection identifiers are assigned to packets in order for managed switching elements, operating in other hosts that receive the packets, to use the connection identifiers to send responses to the correct sources of the packets.

18. The method of claim 16, wherein the middlebox instance is configured to associate a connection identifier in the set of connection identifiers with a first packet originating from the virtual machine operating in the host.

19. The method of claim 18, wherein the middlebox instance associates the connection identifier with the first packet by replacing a source port number of the first packet with the connection identifier.

20. The method of claim 16, wherein the set of connection identifiers is recorded as no longer available to prevent other middlebox instances from assigning connection identifiers in the set of connection identifiers to packets the other middlebox instances receive.