Scalable gateways for a fabric switch

• US 9,871,676 B2
• Filed: 07/20/2016
• Issued: 01/16/2018
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Brocade Communications Systems, LLC (Broadcom, Inc.)
• Inventors: Venkatesh, Vardarajan
• Primary Examiner(s): Elliott, IV, Benjamin H
• Application Number:
  US15/215,377
• Publication Number:
  US 20170026197A1
• Time in Patent Office: 545 Days
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 49/10 characterised by the switching fabric construction
• CPC Class Codes: H04L 49/111 Switch interfaces, e.g. port details
• CPC Class Codes: H04L 49/356 for storage area networks
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

One embodiment of the present invention provides a switch. The switch includes a gateway subgroup module, a tunnel management module, and a packet processor. The gateway subgroup module operates the switch in conjunction with a remote switch to form a gateway subgroup. The switch and the remote switch actively operate as tunnel gateways. The tunnel management module maintains a data structure indicating whether a tunnel source subnet is associated with the gateway subgroup. The packet processor decapsulates a tunnel-encapsulated packet in response to a tunnel source subnet of the tunnel-encapsulated packet being associated with the gateway subgroup.

Claims

1. A method, comprising:

maintaining a data structure comprising a first mapping between a first tunnel source subnet and a first gateway subgroup, wherein a respective member of a gateway subgroup actively operates as a tunnel gateway;

determining whether the first tunnel source subnet is associated with a tunnel-encapsulated packet based on the first mapping;

in response to determining that the first tunnel source subnet is associated with the tunnel-encapsulated packet, decapsulating a tunnel header of the tunnel-encapsulated packet; and

in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet, refraining from decapsulating the tunnel header of the tunnel-encapsulated packet.

2. The method of claim 1, further comprising, in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet:

identifying a second tunnel source subnet associated with the tunnel-encapsulated packet; and

determining, based on a second mapping in the data structure, a second gateway subgroup mapped to the second tunnel source subnet.

3. The method of claim 2, further comprising determining an egress port corresponding to a gateway switch, wherein the gateway switch is in the second gateway subgroup.

4. The method of claim 1, wherein with a destination identifier of the tunnel header is a first virtual gateway identifier of a first virtual switch, and wherein first virtual gateway identifier comprises one or more of:

a virtual IP address and a virtual MAC address.

5. The method of claim 4, wherein the virtual gateway identifier is associated with the first gateway subgroup and a second gateway subgroup.

6. The method of claim 4, wherein the first gateway subgroup is represented as a second virtual switch distinct from the first virtual switch, and wherein the second virtual switch is associated with a second virtual gateway identifier distinct from the first virtual gateway identifier.

7. The method of claim 1, wherein an inner packet of the tunnel-encapsulated packet is a multi-destination packet;

and

wherein the method further comprises, in response to decapsulating the tunnel header;

determining whether a local switch is the designated forwarder of the first gateway subgroup; and

in response to determining that the local switch is the designated forwarder, determining one or more ports of the local switch as egress ports for the inner packet.

8. The method of claim 7, wherein the one or more ports include one or more of:

an edge port coupling a destination of the inner packet; and

an inter-switch port associated with a distribution tree associated with the inner packet.

9. The method of claim 1, further comprising suppressing forwarding via local edge ports in response to receiving the tunnel-encapsulated packet within a same gateway instance, wherein a gateway instance represents a gateway, and wherein a gateway instance includes one or more gateway subgroups.

10. The method of claim 9, further comprising determining one or more local edge ports as egress ports for an inner packet of the tunnel-encapsulated packet in response to not receiving the tunnel-encapsulated packet within the same gateway instance, wherein the inner packet is a multi-destination packet, and wherein a local switch is a designated switch for the gateway instance.

11. A switch, comprising:

tunnel management circuitry configured to maintain a data structure comprising a first mapping between a first tunnel source subnet and a first gateway subgroup, wherein a respective member of a gateway subgroup actively operates as a tunnel gateway;

packet processing circuitry configured to;

determine whether the first tunnel source subnet is associated with a tunnel-encapsulated packet based on the first mapping;

in response to determining that the first tunnel source subnet is associated with the tunnel-encapsulated packet, decapsulate a tunnel header of the tunnel-encapsulated packet; and

in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet, refrain from decapsulating the tunnel header of the tunnel-encapsulated packet.

12. The switch of claim 11, wherein the packet processing circuitry is further configured to, in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet:

identify a second tunnel source subnet associated with the tunnel-encapsulated packet; and

determine, based on a second mapping in the data structure, a second gateway subgroup mapped to the second tunnel source subnet.

13. The switch of claim 12, wherein the packet processing circuitry is further configured to determine an egress port corresponding to a gateway switch, wherein the gateway switch is in the second gateway subgroup.

14. The switch of claim 11, wherein with a destination identifier of the tunnel header is a first virtual gateway identifier of a first virtual switch, and wherein first virtual gateway identifier comprises one or more of:

a virtual IP address and a virtual MAC address.

15. The switch of claim 14, wherein the virtual gateway identifier is associated with the first gateway subgroup and a second gateway subgroup.

16. The switch of claim 14, wherein the first gateway subgroup is represented as a second virtual switch distinct from the first virtual switch, and wherein the second virtual switch is associated with a second virtual gateway identifier distinct from the first virtual gateway identifier.

17. The switch of claim 11, wherein an inner packet of the tunnel-encapsulated packet is a multi-destination packet;

and

wherein the switch further comprises multi-destination management circuitry configured to, in response to decapsulating the tunnel header;

determine whether a local switch is the designated forwarder of the first gateway subgroup; and

in response to determining that the local switch is the designated forwarder, determine one or more ports of the local switch as egress ports for the inner packet.

18. The switch of claim 17, wherein the one or more ports include one or more of:

an edge port coupling a destination of the inner packet; and

an inter-switch port associated with a distribution tree associated with the inner packet.

19. The switch of claim 11, wherein the switch further comprises multi-destination management circuitry configured to suppress forwarding via local edge ports in response to receiving the tunnel-encapsulated packet within a same gateway instance, wherein a gateway instance represents a gateway, and wherein a gateway instance includes one or more gateway subgroups.

20. The switch of claim 19, wherein the multi-destination management circuitry is further configured to determine one or more local edge ports as egress ports for an inner packet of the tunnel-encapsulated packet in response to not receiving the tunnel-encapsulated packet within the same gateway instance, wherein the inner packet is a multi-destination packet, and wherein a local switch is a designated switch for the gateway instance.