Scalable and segregated network virtualization

• US 9,699,001 B2
• Filed: 06/09/2014
• Issued: 07/04/2017
• Est. Priority Date: 06/10/2013
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Brocade Communications Systems, Inc. (Broadcom, Inc.)
• Inventors: Malladi, Sadasivudu, Addanki, Venkata R. K., Chong, Chi L., Gavini, Kiran K.
• Primary Examiner(s): Thier, Michael
• Assistant Examiner(s): Krueger, Kent
• Application Number:
  US14/299,206
• Publication Number:
  US 20140362859A1
• Time in Patent Office: 1,121 Days
• Field of Search: None
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/465 wherein a single frame includes a plurality of VLAN tags
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering

Abstract

One embodiment of the present invention provides a switch. The switch includes a virtual network module and a forwarding module. The virtual network module includes a global virtual local area network (VLAN) tag in a packet. The global VLAN tag is mapped to an edge VLAN tag in the packet and is associated with a datacenter domain. The datacenter domain indicates a set of ports associated with a datacenter. The forwarding module identifies an egress edge port for the packet based on the global VLAN tag.

Claims

1. A switch, comprising:

a plurality of ports;

a storage device configured to store a data structure, which comprises an entry mapping a global virtual local area network (VLAN) tag to an edge VLAN tag and a datacenter domain identifier, wherein the datacenter domain identifier indicates a set of ports configured for a datacenter, and wherein the edge VLAN tag identifies a virtual network of a tenant in the datacenter and the global VLAN tag identifies a global virtual network distinct among tenants and datacenter domains; and

forwarding circuitry configured to encapsulate a packet comprising the edge VLAN tag with an encapsulation header based on the entry, wherein the encapsulation header includes the global VLAN tag; and

forwarding circuitry configured to identify, from the plurality of ports, an egress port for the packet based on the global VLAN tag.

2. The switch of claim 1, wherein the storage device is further configured to store a second data structure, which maps the global VLAN tag to an internal virtual identifier, which is internal and local to the switch;

and

wherein the forwarding circuitry is further adapted to identify the egress edge port based on a third data structure mapping the egress port to the internal virtual identifier.

3. The switch of claim 1, wherein the edge VLAN tag is associated with a virtual machine;

and

wherein migration of the virtual machine is restricted to the set of ports indicated by the datacenter domain.

4. The switch of claim 1,

wherein the storage device is further configured to store a fourth data structure, which maps the global VLAN tag to a media access control (MAC) address in a second packet, and wherein the second packet does not include an edge VLAN tag.

5. The switch of claim 1, wherein the data structure further maps the global VLAN tag to a tenant identifier, which is information that can distinguish between tenants.

6. The switch of claim 1, further comprising tag management circuitry configured to generate the global VLAN tag based on the datacenter domain and the edge VLAN tag.

7. The switch of claim 1, further comprising fabric switch management circuitry configured to maintain a membership in a network of interconnected switches, wherein the network of interconnected switches is identified by a fabric identifier.

8. The switch of claim 7, wherein the fabric switch management circuitry is further configured to include the global VLAN tag in a notification message for the member switches of network of interconnected switches.

9. The switch of claim 1, further comprising port profile circuitry configured to apply a port profile to an ingress port, in the plurality of ports, of the packet in response to identifying the source MAC address of the packet in a port profile, wherein the port profile specifies a set of port configuration information for a port of the switch.

10. The switch of claim 9, wherein the port profile is in a set of port profiles associated with the datacenter domain.

11. A computer-executable method, comprising:

storing, in a storage device of a switch, a data structure, which comprises an entry mapping a global virtual local area network (VLAN) tag to an edge VLAN tag and a datacenter domain identifier, wherein the datacenter domain identifier indicates a set of ports configured for a datacenter, and wherein the edge VLAN tag identifies a virtual network of a tenant in the datacenter and the global VLAN tag identifies a global virtual network distinct among tenants and datacenter domains;

encapsulating a packet comprising the edge VLAN tag with an encapsulation header based on the entry, wherein the encapsulation header includes the global VLAN; and

identifying an egress port for the packet based on the global VLAN tag.

12. The method of claim 11, further comprising:

storing, in the storage device, a second data structure, which maps the global VLAN tag to an internal virtual identifier, which is internal and local to the switch; and

identifying the egress edge port based on a third data structure mapping the egress port to the internal virtual identifier.

13. The method of claim 11, wherein the edge VLAN tag is associated with a virtual machine;

and

wherein migration of the virtual machine is restricted to the set of ports indicated by the datacenter domain.

14. The method of claim 11,

wherein the method further comprises storing, in the storage device, a fourth data structure, which maps the global VLAN tag to a media access control (MAC) address in a second packet, and wherein the second packet does not include an edge VLAN tag.

15. The method of claim 11, wherein the data structure further maps the global VLAN tag to a tenant identifier, which is information that can distinguish between tenants.

16. The method of claim 11, further comprising generating the global VLAN tag based on the datacenter domain and the edge VLAN tag.

17. The method of claim 11, further comprising maintaining a membership in a network of interconnected switches, wherein the network of interconnected switches is identified by a fabric identifier.

18. The method of claim 17, further comprising including the global VLAN tag in a notification message for the member switches of the network of interconnected switches.

19. The method of claim 11, further comprising applying a port profile to an ingress port, which belongs to the switch, of the packet in response to identifying the source MAC address of the packet in a port profile, wherein the port profile specifies a set of port configuration information for a port of the switch.

20. The method of claim 19, wherein the port profile is in a set of port profiles associated with the datacenter domain.

21. A computing system, comprising:

a plurality of ports;

a storage device;

a processor; and

a non-transitory computer-readable storage medium storing instructions which when executed by the processor causes the processor to perform a method, the method comprising;

storing, in the a storage device, a data structure, which comprises an entry mapping a global virtual local area network (VLAN) tag to an edge VLAN tag and a datacenter domain identifier, wherein the datacenter domain identifier indicates a set of ports configured for a datacenter, and wherein the edge VLAN tag identifies a virtual network of a tenant in the datacenter and the global VLAN tag identifies a global virtual network distinct among tenants and datacenter domains; and

encapsulating a packet comprising the edge VLAN tag with an encapsulation header based on the entry, wherein the encapsulation header includes the global VLAN tag; and

identifying an egress port, from the plurality of ports, for the packet based on the global VLAN tag.

22. The computing system of claim 21, wherein the method further comprises:

storing, in the storage device, a second data structure, which maps the global VLAN tag is mapped to an internal virtual identifier, which is internal and local to the switch; and

identifying the egress edge port based on a third data structure mapping the egress port to the internal virtual identifier.

23. The computing system of claim 21,

wherein the method further comprises storing, in the storage device, a fourth data structure, which maps the global VLAN tag to a media access control (MAC) address in a second packet, and wherein the second packet does not include an edge VLAN tag.

24. The computing system of claim 21, wherein the method further comprises maintaining a membership in a network of interconnected switches, wherein the network of interconnected switches is identified by a fabric identifier.

25. The computing system of claim 24, wherein the method further comprises applying a port profile to an ingress port, in the plurality of ports, of the packet in response to identifying the source MAC address of the packet in a port profile, wherein the port profile specifies a set of port configuration information for a port of the switch.