Distributed overlay network data traffic management by a virtual server

• US 8,665,876 B2
• Filed: 07/27/2012
• Issued: 03/04/2014
• Est. Priority Date: 08/05/2011
• Status: Active Grant

• Current Assignee: Lenovo International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Cardona, Omar, Jain, Vinit, Recio, Renato J., Sharma, Rakesh
• Primary Examiner(s): GHOWRWAL, OMAR J
• Application Number:
  US13/560,515
• Publication Number:
  US 20130034109A1
• Time in Patent Office: 585 Days
• Field of Search: 370229-231, 370/235, 370/236, 370/241, 370/248, 370/351, 370/389, 370/392, 370/400, 370/419, 370/431, 370/912, 370/411
• US Class Current: 370/392
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 49/70 Virtual switches

Abstract

An approach is provided in which a data traffic module executing on a network interface card receives a data packet initiated by a first virtual machine with a destination at a second virtual machine. The data traffic module identifies one or more physical path translations corresponding to a logical connectivity that is independent of physical topology constraints of a physical network. In turn, the data traffic module encapsulates the data packet with the one or more physical path translations and sends the encapsulated data packet to the second virtual machine over the physical network.

Claims

1. A method comprising:

receiving, at a data traffic module executing on a network interface card, a data packet that is initiated by a first virtual machine with a destination at a second virtual machine;

identifying one or more physical path translations that are based upon a logical connectivity between the first virtual machine and the second virtual machine over a plurality of virtual networks, wherein each of the plurality of virtual networks are defined by a data-link layer operating on a physical network;

encapsulating, by the data traffic module, the data packet with the one or more physical path translations, wherein the one or more physical path translations include a plurality of network overlay identifiers, each of the plurality of network overlay identifiers corresponding to one of the plurality of virtual networks; and

sending the encapsulated data packet from the data traffic module executing on the network interface card through a physical port included on the network interface card to the second virtual machine over the plurality of virtual networks operating on the physical network.

2. The method of claim 1 wherein a policy indicates the logical connectivity using one or more logical references and is devoid of a physical reference to a physical entity located on the physical network.

3. The method of claim 1 wherein the encapsulated data traverses through a plurality of logical subnets separated by one or more routers prior to arriving at the destination virtual machine.

4. The method of claim 1 wherein the first virtual machine sends the data packet to the data traffic module through a virtual function, the data packet bypassing a hypervisor.

5. The method of claim 1 further comprising:

extracting, from the data packet, a destination virtual machine IP address corresponding to the second virtual machine;

identifying a destination overlay network identifier and a destination physical host address that correspond to the destination virtual machine IP address, the destination overlay network identifier corresponding to one of the virtual networks;

including the destination overlay network identifier and the destination physical host address in an overlay network header; and

wherein the encapsulating includes encapsulating the data packet with the overlay network header.

6. The method of claim 1 further comprising:

receiving, at the data traffic module, an encapsulated inbound data packet;

decapsulating the encapsulated inbound data packet resulting in an overlay network header and an inbound data packet; and

forwarding the inbound data packet to a sorter/classifier, wherein the sorter/classifier sends the inbound data packet to the destination virtual machine through a corresponding virtual function, the inbound data packet bypassing a hypervisor.

7. The method of claim 1 further comprising:

receiving a subsequent data packet at the data traffic module, the subsequent data packet having a destination at a third virtual machine;

determining, by the data traffic module, that the third virtual machine is a local virtual machine; and

forwarding the subsequent data packet to a sorter/classifier, wherein the sorter/classifier sends the subsequent data packet to the third virtual machine through a corresponding virtual function without encapsulating the subsequent data packet, the subsequent data packet bypassing a hypervisor.

8. The method of claim 1 further comprising:

determining that the data packet requires encryption;

in response to determining the data packet requires encryption, prior to encapsulating the data packet, the method further comprises;

identifying a security module executing on a third virtual machine that is managed by the data traffic module;

sending the data packet to the third virtual machine through a virtual function, the data packet bypassing a hypervisor; and

receiving, from the third virtual machine through the virtual function, an encrypted data packet at the data traffic module, the encrypted data packet bypassing the hypervisor; and

performing the encapsulation on the encrypted data packet.