ARCHITECTURE OF NETWORKS WITH MIDDLEBOXES

• US 20170277557A1
• Filed: 06/09/2017
• Published: 09/28/2017
• Est. Priority Date: 11/15/2011
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Koponen, Teemu, Zhang, Ronghua, Thakkar, Pankaj, Casado, Martin
• Granted Patent: US 10,191,763 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 41/0889 Techniques to speed-up the configuration process
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/15 Interconnection of switching modules
• CPC Class Codes: H04L 49/70 : Virtual switches
• CPC Class Codes: H04L 61/2503 : Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/2517 : using port numbers
• CPC Class Codes: H04L 61/2521 : Translation architectures other than single NAT servers
• CPC Class Codes: H04L 61/256 : NAT traversal
• CPC Class Codes: H04L 63/0218 : Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 67/1008 : based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

Some embodiments provide a system for implementing a logical network that includes a set of end machines, a first logical middlebox, and a second logical middlebox connected by a set of logical forwarding elements. The system includes a set of nodes. Each of several nodes includes (i) a virtual machine for implementing an end machine of the logical network, (ii) a managed switching element for implementing the set of logical forwarding elements of the logical network, and (iii) a middlebox element for implementing the first logical middlebox of the logical network. The system includes a physical middlebox appliance for implementing the second logical middlebox.

Claims

1-16. -16. (canceled)

17. A system for implementing a logical network, the system comprising:

a plurality of host machines for implementing a first logical middlebox of the logical network, wherein the first middlebox operates separately on middlebox elements of each of the plurality of host machines without communication of state information between the middlebox elements; and

a set of separate physical middleboxes for implementing a second logical middlebox of the logical network, wherein the second logical middlebox performs an operation that requires state information relating to packets between several different sets of end machines of the logical network.

18. The system of claim 17, wherein each particular middlebox element stores state information regarding transport connections the packets of which are processed by the particular middlebox element.

19. The system of claim 18, wherein the processing for a particular transport connection does not require any state information regarding other transport connections.

20. The system of claim 17, wherein the set of separate physical middleboxes comprises a single physical middlebox.

21. The system of claim 17, wherein the set of separate physical middleboxes comprises a cluster of middleboxes that operate as a resource pool.

22. The system of claim 21 further comprising a dedicated network connection between the cluster of middleboxes for sharing state information between the physical middleboxes in the cluster.

23. The system of claim 17, wherein the first logical middlebox comprises one of a firewall, a load balancer, and a source network address translator.

24. The system of claim 17, wherein the second logical middlebox comprises an intrusion detection system that performs operations requiring state information for each packet processed.

25. The system of claim 17, wherein the second logical middlebox comprises a wide area network optimizer.

26. A method for implementing a logical network, the method comprising:

receiving a logical network configuration, the logical network comprising a first logical middlebox and a second logical middlebox;

distributing configuration data for the first logical middlebox to a plurality of host machines for middlebox elements to implement the first logical middlebox separately on each the plurality of host machines without communication of state information between the middlebox elements; and

distributing configuration data for the second logical middlebox to a set of separate physical middleboxes for the set of separate physical middleboxes to implement the second logical middlebox, wherein the second logical middlebox performs an operation that requires state information relating to packets between several different sets of machines of the logical network.

27. The method of claim 26, wherein each particular middlebox element stores state information regarding transport connections the packets of which are processed by the particular middlebox element.

28. The method of claim 27, wherein the processing by the first logical middlebox for a particular transport connection does not require state information regarding other transport connections.

29. The method of claim 26, wherein the set of separate physical middleboxes comprises a single physical middlebox.

30. The method of claim 26, wherein the set of separate physical middleboxes comprises a cluster of middleboxes that operate as a resource pool to implement the second logical middlebox.

31. The method of claim 30, wherein a dedicated network connection exists between the physical middleboxes of the cluster for sharing state information regarding the second logical middlebox.

32. The method of claim 26, wherein the first logical middlebox comprises one of a firewall, a load balancer, and a network address translator.

33. The method of claim 26, wherein the second logical middlebox comprises an intrusion detection system that performs operations requiring state information for each packet processed.

34. The method of claim 26, wherein the second logical middlebox comprises a wide area network optimizer.

35. The method of claim 26, wherein the logical network is a first logical network, wherein the set of separate physical middleboxes also implements a third logical middlebox that belongs to a second logical network.

36. The method of claim 26, wherein the logical network is a first logical network, wherein a subset of the middlebox elements also implement a third logical middlebox that belongs to a second logical network.