Distributed operating system for a layer 2 fabric

• US 9,319,335 B1
• Filed: 12/07/2011
• Issued: 04/19/2016
• Est. Priority Date: 12/07/2010
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Pluribus Networks, Inc. (Arista Networks, Inc.)
• Inventors: Tripathi, Sunay
• Primary Examiner(s): Lai, Andrew
• Assistant Examiner(s): Andrews, Hoyet H
• Application Number:
  US13/313,837
• Time in Patent Office: 1,595 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/66 Layer 2 routing, e.g. in Ethernet based MAN's
• CPC Class Codes: H04L 47/196 Integration of transport layer protocols, e.g. TCP and UDP
• CPC Class Codes: H04L 47/35 by embedding flow control information in regular packets, e.g. piggybacking
• CPC Class Codes: H04L 49/25 Routing or path finding in a switch fabric

Abstract

A system that includes a layer 2 fabric, a first host, and a second host. The layer 2 fabric includes a first network device and a second network device. The first host is connected to the first network device and includes a first virtual machine (VM). The second host is connected to the second network device and includes a second VM. The layer 2 fabric includes a virtual network including the first VM and the second VM and the first virtual network is managed by a virtual network manager executing on the first network device.

Claims

1. A network switch, comprising:

a switch fabric including a switch fabric classifier, a plurality of external ports and a plurality of internal ports, the switch fabric being configured for switching incoming packets received at the external ports, the switch fabric classifier being configured for applying classification rules to process the incoming packets;

a control processor configured to execute a network device operation system (ndOS), wherein network switches executing the ndOS are defined to switch layer 2 packets and to share network information with other network switches executing ndOS, the network switch having a first switch identification (ID) that uniquely identifies the network switch among network switches executing ndOS; and

an internal switch operatively connected to the switch fabric and the control processor;

wherein the control processor when executing ndOS is configured to send a first classification rule to the switch fabric classifier via the internal switch, the first classification rule identifying an action to be performed on packets satisfying the first classification rule;

wherein the control processor when executing ndOS is configured to send a discovery packet through a first external port to a second network switch implementing ndOS, the discovery packet including the first switch ID and an ID of the first external port in the network switch.

2. The network switch of claim 1, further comprising:

a network processing unit (NPU),

wherein the internal switch is operatively connected to the NPU,

wherein the NPU is configured to receive packets from the switch fabric over the internal switch,

wherein the NPU is configured to send packets directly to the switch fabric using a second one of the plurality of internal ports.

3. The network switch of claim 2, wherein the NPU is configured to receive packets from the switch fabric using the second one of the plurality of internal ports.

4. The network switch of claim 2, wherein the ndOS is configured to send Service Level Agreement (SLA) or Quality of Service (QoS) requirements for a flow to the NPU.

5. The network switch of claim 4, wherein the flow is specified using at least one selected from group consisting of a media access control (MAC) address, an Internet Protocol (IP) address, a Transmission Control Protocol (TCP), user datagram protocol (UDP), an OSI layer 4 information related to a TCP port, an IPSec security association (SA), a virtual local area network (VLAN) tag, a 802.1Q VLAN tag, and a 802.1Q-in-Q VLAN tag.

6. The network switch of claim 1, further comprising:

a plurality of queues, wherein each queue is associated with one of a plurality of flows, wherein each queue is processed based on a priority determined using one or more of a Service Level Agreement (SLA) or Quality of Service (QoS) requirements.

7. The network switch of claim 1, wherein the internal switch is a peripheral component interconnect express (PCIe) switch.

8. The network switch of claim 1, wherein the ndOS further includes a hypervisor executing in the network switch.

9. The network switch of claim 8, wherein the ndOS is configured to create a virtual machine on the network switch, wherein the virtual machine is configured to execute on the control processor, and wherein the virtual machine is configured to process at least one packet received by the network switch.

10. The network switch of claim 1, wherein the discovery packet further includes a discovery media access control (MAC) address utilized by all ndOS network switches for exchanging discovery packets.

11. The network switch of claim 10, wherein the ndOS is configured to send a discovery classification rule to the switch fabric classifier using the switch, wherein the discovery classification rule specifies that any received packet with the discovery MAC address is sent to the ndOS.

12. The network switch of claim 1, wherein the network switch is configured to be connected to a network, and wherein the network switch is configured to receive an incoming discovery packet at an ingress port, wherein the ingress port is one of the plurality of external ports, wherein the ndOS generates a topology entry comprising the first switch ID, an ingress port ID that uniquely identifies the ingress port, a sending switch ID of the second network switch that sent the incoming discovery packet to the network switch, and an egress port ID that uniquely identifies an egress port on the second network switch.

13. The network switch of claim 12, wherein the network switch is configured to generate a layer 2 topology of the network using the topology entry.

14. The network switch of claim 13, wherein the network switch is configured to monitor the network to identify changes in the layer 2 topology of the network.

15. The network switch of claim 1, wherein the network switch is configured to identify a presence of a link aggregation group (LAG) between the network switch and the second network switch, wherein the LAG comprises at least two physical links between the network switch and the second network switch.

16. The network switch of claim 1,

wherein the control processor is configured to receive packets from the switch fabric using a second one of the plurality of internal ports.

17. The network switch of claim 1, wherein each ndOS network switch is defined to store topology information for other ndOS network switches executing the ndOS, wherein an entry in a topology information table includes a receiving switch ID, an ingress port ID of the receiving switch ID, a sending switch ID, and an egress port ID of the sending switch ID.

18. The network switch of claim 17, wherein the second network switch implementing ndOS is defined to create in the topology information table a first entry having a second switch ID of the second network switch, an ID of the port in the second network switch where the discovery packet was received, the first switch ID, and the ID of the first external port.

19. The network switch of claim 17 wherein the network switch is configured to exchange topology information with other ndOS network switches, wherein ndOS network switches are defined to obtain topology information from directly connected and from indirectly connected ndOS network switches.

20. A network switch, comprising:

a switch fabric including a switch fabric classifier, a plurality of external ports and a plurality of internal ports, the switch fabric being configured for switching incoming packets received at the external ports, the switch fabric classifier being configured for applying classification rules to process the incoming packets;

a control processor configured to execute a network device operation system (ndOS) and a virtual network manager, the virtual network manager being configured to manage a virtual network comprising one or more virtual machines (VM), wherein network switches executing the ndOS are defined to switch layer 2 packets and to share network information with other network switches executing ndOS; and

an internal switch operatively connected to the switch fabric and the control processor;

wherein managing the virtual network includes determining whether a first VM executing on a first host can migrate to a second host when the network switch is connected, through one of the plurality of external ports, to the first host and a second network switch is connected to the second host,

wherein the network switch is configured to temporarily store packets destined for the first VM and packets issued by the first VM while the network switch is migrating to the second host.

21. A system, comprising:

a layer 2 fabric including a plurality of network switches, wherein a first network switch is directly connected to a second network switch, wherein the plurality of network switches execute a network device operation system (ndOS), wherein network switches executing the ndOS are defined to switch layer 2 packets in the layer 2 fabric and to share network information with other network switches executing ndOS, wherein the first network switch comprises a first ndOS and the second network switch comprises a second ndOS;

wherein the first ndOS is configured to;

receive a request from a first host, the request specifying that a virtual machine on the first host is to be migrated to a second host connected to the second network switch; and

send the request to the second ndOS in the second network switch, wherein the second ndOS processes the request to determine whether the virtual machine may migrated from the first host to the second host.

22. The system of claim 21, wherein the first ndOS is further configured to receive a second request specifying that a copy of all packets associated with a flow be sent to the first host, wherein the flow comprises a plurality of packets identified using at least one selected from a group consisting of a media access control (MAC) address, an Internet Protocol (IP) address, a Transmission Control Protocol (TCP), user datagram protocol (UDP), an OSI layer 4 information related to a TCP ports, an IPSec security association (SA), a virtual local area network (VLAN) tag, a 802.1Q VLAN tag, and a 802.1Q-in-Q VLAN tag.

23. The system of claim 21, wherein the second ndOS is configured to enforce an Access Control List (ACL) associated with a virtual network after the virtual machine is migrated to the second host.

24. The system of claim 21, wherein the first ndOS is configured to discover a presence of the second ndOS and the second ndOS is configured to discover a presence of the first ndOS.

25. A system, comprising:

a layer 2 fabric including a plurality of network switches including a first network switch and a second network switch, wherein the plurality of network switches execute a network device operation system (ndOS), wherein network switches executing the ndOS are defined to switch layer 2 packets in the layer 2 fabric and to share network information with other network switches executing ndOS, wherein the first network switch includes a first ndOS;

wherein the first ndOS includes a virtual network manager configured to manage a first virtual network having a first virtual machine (VM) executing on a first host connected to the first network switch, wherein the layer 2 fabric operates the first virtual network, wherein the first virtual network is specified using at least one selected from a group consisting of a MAC address, a VLAN tag, a VLAN Q-in-Q tag, and an Multiprotocol Label Switching (MPLS) label, wherein the first ndOS is configured to create a second VM on the first network switch, wherein the second VM is configured to provide to the first virtual network at least one selected from a group consisting of a load balancing service, a DNS service, or a DHCP service.

26. The system of claim 25, further comprising:

a third network switch, wherein the third network switch is in the layer 2 fabric; and

a third host comprising a third (VM) connected to the third network switch;

wherein the third host comprises a fourth VM, wherein the layer 2 fabric comprises a second virtual network comprising the third VM and the fourth VM.

27. The system of claim 25, wherein the first virtual network is associated with an Access Control List (ACO), wherein the ACL is enforced by programming at least one classification rule on a switch fabric classifier on the first network switch and at least one classification rule on a switch fabric classifier on a second network switch.

28. The system of claim 25, wherein the first network switch is configured to provide local configuration information for the first network switch to the second network switch, wherein the local configuration information comprises a local layer 2 topology, an access control list (ACL) for any network entity in the local layer 2 topology, and local state information.