Cisco Technology, Inc.

Danmu Wu

Feng Ping Cai

Jianda Liu

Zhiyong Fang

Yuxiang Chen

Yunpeng Zhang

A network device stores a Virtual Extensible Local Area Network (VxLAN) Tunnel Endpoint (VTEP) membership information that associates VxLANs each with a corresponding set of VTEPs authorized to originate VxLAN packets on that VxLAN. The network device receives from a communication network a VxLAN packet that identifies a VxLAN and an originating VTEP. The VTEP compares the originating VTEP to the set of VTEPs associated with the VxLAN in the VTEP membership information that matches the identified VxLAN. If the comparison indicates that the originating VTEP is not included in the set of VTEPs authorized to originate VxLAN packets, the VTEP discards the received VxLAN packet. Otherwise the VTEP further processes the VxLAN packet.

VxLAN security implemented using VxLAN membership information at VTEPs

A method is provided in one embodiment and includes receiving at a network element an encapsulated packet and determining whether both an ECMP/LAG Existing ('ele') flag and an Entropy Label Capability ('elc') flag are set for an egress node of the packet in a Label Distribution Protocol (&#x201c;LDP&#x201d;) database of the network element. If both the ele and elc flags are set for the egress node of the packet in the LDP database, the method further includes determining whether the network element is an ingress node for the packet and, if the network element is the ingress node for the packet, pushing an Entropy Label (&#x201c;EL&#x201d;) and an Entropy Label Indicator (&#x201c;ELI&#x201d;) onto an MPLS stack of the packet.

Growing community of inventors

Shanghai, China

Danmu Wu