Handling NAT in logical L3 routing

• US 9,350,696 B2
• Filed: 02/01/2013
• Issued: 05/24/2016
• Est. Priority Date: 08/17/2011
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Zhang, Ronghua, Thakkar, Pankaj, Koponen, Teemu
• Primary Examiner(s): Chu, Wutchung
• Application Number:
  US13/757,636
• Publication Number:
  US 20130148542A1
• Time in Patent Office: 1,208 Days
• Field of Search: 370/352, 370386-392
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation

Abstract

A non-transitory machine readable medium storing a program that configures first and second managed forwarding elements to perform logical L2 switching and L3 routing is described. The program generates a first set of flow entries for configuring the first managed forwarding element to perform (1) a first logical L2 processing for a first logical L2 domain, (2) a logical L3 processing, (3) a network address translation (NAT) processing on packets to be sent to the second managed forwarding element, and (4) a logical ingress L2 processing for a second logical L2 domain on the packets. The program generates a second set of flow entries for configuring the second managed forwarding element to perform a logical egress L2 processing for the second logical L2 domain on the packets.

Claims

1. A non-transitory machine readable medium storing a program which when executed by at least one processing unit configures a plurality of managed forwarding elements (MFEs) to implement a logical network that comprises a logical L3 router and at least one logical L2 switch that logically couples to a plurality of machines, the program comprising sets of instructions for:

for each MFE of the plurality of MFEs that implement the logical network and couple directly to at least one of the machines, generating a first set of data records for configuring the MFE to install a first set of flow entries that implement the logical L2 switch and logical L3 router for packets sent by the at least one machine that couples directly to the MFE, wherein each MFE of the plurality of MFEs operates on a separate physical machine to implement the logical L2 switch and logical L3 router on the separate physical machine; and

for each MFE of the plurality of MFEs, generating a second set of data records for configuring the MFE to install a second set of flow entries that implement network address translation (NAT) processing on a subset of packets sent by the at least one machine that couples directly to the MFE, the subset of packets comprising packets sent to a destination that does not logically couple to a same logical L2 switch as the machine that sent the packet to the MFE.

2. The machine readable medium of claim 1, wherein the NAT processing comprises at least one of (i) source NAT operations for translating an original source network address of a packet into a new source network address and (ii) destination NAT operations for translating an original destination address of the packet into a new destination network address.

3. The machine readable medium of claim 2, wherein the original source network address is an IP address of the machine that sent the packet to the MFE.

4. The machine readable medium of claim 2, wherein the second set of data records for each of the MFEs is for configuring the MFE to install flow entries that specify for the MFE to perform the destination NAT operations before performing the source NAT operations.

5. The machine readable medium of claim 1, wherein a particular MFE uses the flow entries that implement the logical L2 switch to identify an egress port of the logical L2 switch for a particular packet received from a particular machine directly coupled to the particular MFE.

6. The machine readable medium of claim 5, wherein the particular packet has a destination MAC address corresponding to the logical egress port.

7. For a network controller that manages a network, a method for configuring a plurality of network elements in the network to implement a logical network comprising first and second logical L2 domains, the method comprising:

configuring a first plurality of edge managed forwarding elements (MFEs) to perform logical switching for the first logical L2 domain and a second plurality of edge MFEs to perform logical switching for the second logical L2 domain, wherein each edge MFE in at least one of the first and second pluralities of MFEs operates in a separate physical machine to implement the logical switching for at least one of the first and second logical L2 domains;

configuring a separate managed forwarding element that operates in a physical machine, separate from the physical machines in which the edge MFEs operate, as a second-level managed forwarding element to perform logical switching for the first and second logical L2 domains;

configuring a container in the physical machine to operate as a router for routing packets sent between the first and second logical domains and performing network address translation (NAT) on the packets by configuring a routing table and a NAT table for the container, wherein the second-level MFE is configured to send to the container packets sent between the first and second logical domains in order for the container to route and perform NAT operations on the packets before returning the packets to the second-level MFE operating in the physical machine.

8. The method of claim 7, wherein the second-level managed forwarding element facilitates communications between the edge managed forwarding elements, wherein the edge managed forwarding elements interface directly with sources and destinations of packets and the second-level managed forwarding element does not directly interface with the sources and destinations of packets.

9. The method of claim 7, wherein the container in the physical machine is a namespace.

10. The method of claim 7 further comprising establishing a tunnel between the second-level managed forwarding element and one of the edge managed forwarding elements.

11. The method of claim 7, wherein the edge managed forwarding elements comprise software switches that execute on the physical machines along with the sources and destinations of packets.

12. For a network controller manages a network, a method for configuring a plurality of managed forwarding elements (MFEs) to implement a logical network that comprises a logical L3 router and at least one logical L2 switch that logically couples to a plurality of machines, the method comprising:

for each MFE of the plurality of MFEs that implement the logical network and couple directly to at least one of the machines, generating a first set of data records for configuring the MFE to install a first set of flow entries that implement the logical L2 switch and logical L3 router for packets sent by the at least one machine that couples directly to the MFE, wherein each MFE of the plurality of MFEs operates on a separate physical machine to implement the logical L2 switch and logical L3 router on the separate physical machine; and

for each MFE of the plurality of MFEs, generating a second set of data records for configuring the MFE to install a second set of flow entries that implement network address translation (NAT) processing on a subset of packets sent by the at least one machine that couples directly to the MFE, the subset of packets comprising packets sent to a destination that does not logically couple to a same logical L2 switch as the machine that sent the packet to the MFE.

13. The method of claim 12, wherein the NAT processing comprises at least one of (i) source NAT operations for translating an original source network address of a packet into a new source network address and (ii) destination NAT operations for translating an original destination address of the packet into a new destination network address.

14. The method of claim 13, wherein the original source network address is an IP address of the machine that sent the packet to the MFE.

15. The method of claim 13, wherein the second set of data records for each of the MFEs is for configuring the MFE to install flow entries that specify for the MFE to perform the destination NAT operations before performing the source NAT operations.

16. The method of claim 12 further comprising configuring at least a first MFE and a second MFE to send packets to each other via a tunnel.

17. The method of claim 12, wherein the second set of flow entries installed by a particular MFE comprises a flow entry for sending a packet to a daemon operating on the same physical machine as the particular MFE and the machine that sent the packet to the MFE.

18. The method of claim 17, wherein the daemon stores a NAT table for identifying one of a new source network address and a new destination network address for the packet.

19. The method of claim 17, wherein the daemon identifies a new network address for the packet and installs a new flow entry for the particular MFE to use instead of sending subsequent packets to the daemon.

20. The method of claim 12, wherein the plurality of machines logically coupled by the logical L3 router and at least one logical L2 switch comprises at least one virtual machine.