Nicira, Inc.

Vmware, Inc.

Benjamin L Pfaff

Justin Pettit

Martin Casado

Keith Eric Amidon

Teemu Koponen

Daniel J Wendlandt

Peter J Balland, Iii

Anupam Chanda

Amar Padmanabhan

Bruce Davie

Natasha Gude

Jesse Ernest Gross, Iv

Paul Ingram

Scott J Shenker

Pankaj Thakkar

Andy Zhou

Cheng-Chun Tu

Yi-Hung Wei

Yifeng Sun

Srinivas Neginhal

Ethan J Jackson

Harold Vinson C Lim

Mart Haitjema

Peter Balland

Some embodiments provide a method for a forwarding element that receives a packet. The method determines whether the packet matches any flow entries in a first cache that uses a first type of algorithm to identify matching flow entries for packets. When the packet does not match any flow entries in the first cache, the method determines whether the packet matches any flow entries in a second cache that uses a second, different type of algorithm to identify matching flow entries for packets. The method executes a set of actions specified by a flow entry matched by the packet in one of the first and second caches.

Packet classification with multiple classifiers

Systems and methods for managing a network are described. A view of current state of the network is maintained where the current state of the network characterizes network topology and network constituents, including network entities and network elements residing in or on the network. Events are announced that correspond to changes in the state of the network and one or more network elements can be configured accordingly. Methods for managing network traffic are described that ensure forwarding and other actions taken by network elements implement globally declared network policy and refer to high-level names, independently of network topology and the location of network constituents. Methods for discovering network constituents are described, whereby are automatically configured. Routing may be performed using ACL and packets can be intercepted to permit host to continue in sleep mode. The methods are applicable to virtual environments.

Network operating system for managing and securing networks

Some embodiments provide a set of one or more network controllers that communicates with a wide range of devices, ranging from switches to appliances such as firewalls, load balancers, etc. The set of network controllers communicates with such devices to connect them to its managed virtual networks. The set of network controllers can define each virtual network through software switches and/or software appliances. To extend the control beyond software network elements, some embodiments implement a database server on each dedicated hardware. The set of network controllers accesses the database server to send management data. The hardware then translates the management data to connect to a managed virtual network.

Database protocol for exchanging forwarding state with hardware switches

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g, GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

Method and apparatus for implementing and managing virtual switches

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g., GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

A method of suppressing ARP packets in a logical network comprising a set of data compute nodes (DCNs). The DCNs are hosted on a set of physical hosts. Each DCN has a protocol address and is connected to a forwarding elements (FE) on the corresponding host. Each FE has a set of flows that specifies a set of conditions to match a set of fields of each received packet and a set of actions to take on a packet that matches the set of conditions. An FE on a physical host receives a packet sent by a first DCN on the physical host and determines that the received packet is an ARP request packet by matching a set of fields in the packet with a set of conditions of a particular flow. The ARP request packet identifies a protocol address of a second DCN on the logical network. The PFE utilizes the actions specified by the particular flow to determine a corresponding hardware address for the target protocol address by searching an address-mapping table that maps the protocol address of each DCN to a corresponding hardware address. The PFE converts the ARP request packet to an ARP reply packet utilizing the set of actions specified by the particular flow, the ARP reply packet comprising the determined target address as a resolution of the ARP request. The PFE sends the ARP reply packet to the first DCN without broadcasting the ARP request to any DCNs on the logical network.

Address resolution protocol suppression using a flow-based forwarding element

Some embodiments provide a method for processing a packet received by a managed forwarding element. The method performs a series of packet classification operations based on header values of the received packet. The packet classifications operations determine a next destination of the received packet. When the series of packet classification operations specifies to send the packet to a network service that performs payload transformations on the packet, the method (1) assigns a service operation identifier to the packet that identifies the service operations for the network service to perform on the packet, (2) sends the packet to the network service with the service operation identifier, and (3) stores a cache entry for processing subsequent packets without the series of packet classification operations. The cache entry includes the assigned service operation identifier. The network service uses the assigned service operation identifier to process packets without performing its own classification operations.

Processing packets according to hierarchy of flow entry storages

Some embodiments provide a method that receives several flow descriptions. Each flow description includes a set of match conditions and corresponding set of actions. Each set of match conditions is represented as a combination of Boolean and relational operators in a flow description language. The method generates one or more flow entries for each flow description. The flow entries are generated in a format useable by a managed forwarding element (MFE). The method distributes the generated flow entries to the MFE in order for the MFE to implement network operations described by the plurality of flow descriptions.

Representation of match conditions in logical pipeline data

Some embodiments provide a method for a network controller that manages a managed forwarding element (MFE). The method receives a set of data tuples that define packet processing behavior of the MFE. A particular one of the data tuples defines (i) a match condition with at least two conjunctive dimensions and (ii) an action for the MFE to take on a packet that matches an element from each of the dimensions, each of which include at least one element. The method generates a conjunction flow entry that matches on an assigned conjunction identifier and specifies the action defined by the particular data tuple. For each dimension, the method generates a set of flow entries that each match on a different element of the dimension and specify an action that includes the assigned conjunction identifier. The method distributes the conjunction flow entry and the sets of flow entries to the MFE.

Generating conjunctive match flow entries

Some embodiments provide a method for a controller agent operating in a physical machine alongside a managed forwarding element (MFE) that implements several logical networks. The method receives a first set of flow entries describing a particular logical network. The flow entries of the first set have a first format. The method receives a set of physical network description data and binding data that binds logical network entities to the physical network. Based on the received flow entries, physical network description data, and binding data, the method generates a second set of flow entries for implementing the particular logical network in the physical network. The flow entries of the second set have a second format readable by the MFE. The method distributes the second set of flow entries to the MFE.

Local controller agent for converting logical pipeline data

Some embodiments provide a method for a controller agent operating in a physical machine alongside a local managed forwarding element (MFE) that implements logical networks along with other MFEs in a physical network. From a centralized storage, the method receives a description of a physical network populated by other controller agents, a description of a logical network populated by a centralized controller, and a set of bindings between the logical and physical network populated by the plurality of other controller agents. From the local MFE, the method receives a description of physical network data relating to the local MFE and bindings between the logical and physical network for machines connected directly to the local MFE. The method populates the centralized storage with the data from the local MFE. The method generates forwarding data for the local MFE using the data received from the centralized storage and from the local MFE.

Growing community of inventors

Redwood City, CA, United States of America

Benjamin L Pfaff