Last-hop processing for reverse direction packets

• US 9,602,404 B2
• Filed: 11/20/2015
• Issued: 03/21/2017
• Est. Priority Date: 08/17/2011
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Koponen, Teemu, Zhang, Ronghua
• Primary Examiner(s): CHOUDHRY, SAMINA F
• Application Number:
  US14/947,036
• Publication Number:
  US 20160080261A1
• Time in Patent Office: 487 Days
• Field of Search: 370/437, 709/227
• US Class Current: 1/1
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/70 Virtual switches

Abstract

Some embodiments provide a method for a first managed forwarding element that implements a logical network. The method receives a packet from a second managed forwarding element. The first packet has an initial set of characteristics defining a first connection between a source machine connected to the second managed forwarding element and a destination machine connected to the first managed forwarding element. The method determines whether a second connection exists with the initial set of characteristics between a different machine connected to a third managed forwarding element and the destination machine. When a second connection exists with the initial set of characteristics, the method modifies at least one characteristic of the packet such that the modified packet does not have the same set of characteristics. The method delivers the modified packet to the destination machine.

Claims

1. For a first managed forwarding element, a method comprising:

receiving a first packet from a second managed forwarding element via a tunnel between the first and second managed forwarding elements, the first packet comprising context information that identifies (i) that first-hop logical processing was performed by the second managed forwarding element to process the first packet through a set of logical forwarding elements of a logical network implemented by the first and second managed forwarding elements and (ii) that a first machine connected to the first managed forwarding element is a destination for the first packet;

based on the context information in the first packet, generating forwarding data for processing subsequent packets received from the first machine and having a particular destination address that corresponds to a source address of the first packet; and

using the generated forwarding data to forward a second packet, received from the first machine and having the particular destination address, to the second managed forwarding element via the tunnel without performing first-hop logical processing to process the second packet through the set of logical forwarding elements of the logical network, wherein the second managed forwarding element performs said logical processing upon receiving the second packet via the tunnel.

2. The method of claim 1, wherein the set of logical forwarding elements includes a first logical switch, a logical router, and a second logical switch.

3. The method of claim 1, wherein the first managed forwarding element operates on a first physical host machine along with a first middlebox element and the second managed forwarding element operates on a second physical host machine along with a second middlebox element, wherein the first and second middlebox elements both implement a logical middlebox for the logical network.

4. The method of claim 3, wherein the second middlebox element processes the first packet during the first-hop logical processing and stores state information for a connection between a second machine that connects to the second managed forwarding element and the first machine, wherein the second packet is forwarded to the second managed forwarding element for the second managed forwarding element to perform logical processing on the second packet and the second middlebox element to process the packet using the stored state information.

5. The method of claim 4, wherein the second middlebox element does not share the state information with the first middlebox element.

6. The method of claim 4, wherein the logical middlebox is a firewall, wherein the state information comprises information regarding opening of the connection between the second machine and the first machine.

7. The method of claim 4, wherein the logical middlebox is source network address translation and the state information comprises a mapping of a network address of the first machine to the source address of the first packet.

8. The method of claim 3 further comprising:

receiving a third packet from the first machine that has a different destination address;

performing first-hop logical processing on the third packet, including sending the third packet to the first middlebox element for processing according to the logical middlebox; and

forwarding the third packet to a third managed forwarding element via a second tunnel between the first and third managed forwarding elements.

9. The method of claim 8, wherein the first middlebox element stores state information regarding the third packet and the third managed forwarding element forwards subsequent packets sent from a fourth machine in response to the third packet to the first managed forwarding element via the second tunnel without performing first-hop logical processing on the subsequent packets.

10. The method of claim 1, wherein the first-hop logical processing performed by the second managed forwarding element to process the first packet comprises processing for a first logical switch, a logical router, and a second logical switch, wherein the logical processing performed by the second managed forwarding element to process the second packet comprises processing for the second logical switch, the logical router, and the first logical switch.

11. A non-transitory machine readable medium storing a first managed forwarding element for execution by at least one processing unit, the first managed forwarding element comprising sets of instructions for:

receiving a first packet from a second managed forwarding element via a tunnel between the first and second managed forwarding elements, the first packet comprising context information that identifies (i) that first-hop logical processing was performed by the second managed forwarding element to process the first packet through a set of logical forwarding elements of a logical network implemented by the first and second managed forwarding elements and (ii) that a first machine connected to the first managed forwarding element is a destination for the first packet;

based on the context information in the first packet, generating forwarding data for processing subsequent packets received from the first machine and having a particular destination address that corresponds to a source address of the first packet; and

using the generated forwarding data to forward a second packet, received from the first machine and having the particular destination address, to the second managed forwarding element via the tunnel without performing first-hop logical processing to process the second packet through the set of logical forwarding elements of the logical network, wherein the second managed forwarding element performs said logical processing upon receiving the second packet via the tunnel.

12. The non-transitory machine readable medium of claim 11, wherein the set of logical forwarding elements includes a first logical switch, a logical router, and a second logical switch.

13. The non-transitory machine readable medium of claim 11, wherein the first managed forwarding element executes on a first physical host machine along with a first middlebox element and the second managed forwarding element executes on a second physical host machine along with a second middlebox element, wherein the first and second middlebox elements both implement a logical middlebox for the logical network.

14. The non-transitory machine readable medium of claim 13, wherein the second middlebox element processes the first packet during the first-hop logical processing and stores state information for a connection between a second machine that connects to the second managed forwarding element and the first machine, wherein the second packet is forwarded to the second managed forwarding element for the second managed forwarding element to perform logical processing on the second packet and the second middlebox element to process the packet using the stored state information.

15. The non-transitory machine readable medium of claim 14, wherein the second middlebox element does not share the state information with the first middlebox element.

16. The non-transitory machine readable medium of claim 14, wherein the logical middlebox is a firewall, wherein the state information comprises information regarding opening of the connection between the second machine and the first machine.

17. The non-transitory machine readable medium of claim 14, wherein the logical middlebox is source network address translation and the state information comprises a mapping of a network address of the first machine to the source address of the first packet.

18. The non-transitory machine readable medium of claim 13, wherein the first managed forwarding element further comprises sets of instructions for:

receiving a third packet from the first machine that has a different destination address;

performing first-hop logical processing on the third packet, including sending the third packet to the first middlebox element for processing according to the logical middlebox; and

forwarding the third packet to a third managed forwarding element via a second tunnel between the first and third managed forwarding elements.

19. The non-transitory machine readable medium of claim 18, wherein the first middlebox element stores state information regarding the third packet and the third managed forwarding element forwards subsequent packets sent from a fourth machine in response to the third packet to the first managed forwarding element via the second tunnel without performing first-hop logical processing on the subsequent packets.

20. The non-transitory machine readable medium of claim 11, wherein the first-hop logical processing performed by the second managed forwarding element to process the first packet comprises processing for a first logical switch, a logical router, and a second logical switch, wherein the logical processing performed by the second managed forwarding element to process the second packet comprises processing for the second logical switch, the logical router, and the first logical switch.