International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Vasmi Mohammad Abidi

Chandramouli Radhakrishnan

Tamanna Zackaria Sait

Zheng Dong Zhu

Yun Feng Sun

Xiang Hui Dong

Marius-Cristian David

Eugen-Cristian Udrea

Nirapad Ghosh

One embodiment includes obtaining virtual machine (VM) information for at least one VM. The VM information includes a VSI type identification (ID) associated with each VM. A policy discriminator (PD) is associated for each VSI type ID, where the PD represents scalable policy assignment. At least one rule and bandwidth filter information associated with a VSI type ID is retrieved from virtual station interface (VSI) database (DB) information and PD for each VSI type ID. The associated at least one rule and filter information is applied based on one of multiple PD types. The multiple PD types comprise a VM type and a virtual local area network (vLAN) type.

Scalable policy assignment in an edge virtual bridging (EVB) environment

A device includes a memory that is configured to store instructions. The device includes a processor configured to execute the instructions to: validate a message including virtual machine (VM) information using a value of a virtual station interface (VSI) type identification (ID) to perform a lookup of a fetched VSI database. The VM information for the VM includes VSI type ID and virtual local area network (VLAN) ID. The processor further generates a first table for multiple different VM types with at least a portion of information from the VSI database, retrieves an address of the VM from the first table for the multiple different VM types based on using VSI type ID and network ID, retrieves rules associated with the retrieved address of the VM and the VSI type ID from a second table including VM information, and applies the associated rules for the VM.

Scalable policy management in an edge virtual bridging (EVB) environment

A method includes validating, by a switch, a message including virtual machine (VM) information using a value of a virtual station interface (VSI) type identification (ID) to perform a lookup of a fetched VSI database. The VM information for the VM comprises VSI type ID and virtual local area network (VLAN) ID. The switch retrieves an address of the VM from a first table for multiple different VM types based on using VSI type ID and network ID. The switch retrieves rules associated with the retrieved address of the VM and the VSI type ID from a second table including VM information. The switch applies the associated rules for the VM.

Embodiments of the invention relate to scalable policy management in an edge virtual bridging (EVB) environment. One embodiment includes a system including a physical end station including a hypervisor, wherein the physical end station creates at least one virtual machine (VM). A virtual station interface (VSI) database is coupled to a VM manager server. The VSI database stores policy information comprising one or more rules for different VM types and access rules. A policy management module is coupled to a switch adjacent to the physical end station. The policy management module generates a first table using at least a portion of the policy information, generates a second table with a portion of VM information received from the hypervisor for the VM, and uses the first table and the second table to retrieve and apply rules for the VM.

Embodiments of the invention relate to scalable policy assignment in an edge virtual bridging (EVB) environment. One embodiment includes a system including a physical end station includes a hypervisor. The physical end station creates at least one virtual machine (VM). A virtual station interface (VSI) database (DB) is coupled to a VM manager server. The VSI DB stores policy information and bandwidth filter information. A policy assignment module is coupled to a switch adjacent to the physical end station. The policy assignment module generates a VSI DB table with at least a portion of the VSI DB information from the VSI DB and a policy discriminator (PD) value for each VSI type ID.

Embodiments of the invention relate to scalable policy assignment in an edge virtual bridging (EVB) environment. One embodiment includes fetching virtual machine (VM) information for one or more VMs from a virtual station interface (VSI) database (DB). The VM information includes a VSI type identification (ID) associated with each VM. A policy discriminator (PD) value is associated for each VSI type ID. A VSI DB table is generated with at least a portion of the VM information from the VSI DB and the PD for each VSI type ID. A message is received including virtual machine (VM) information for a created VM. One or more rules and bandwidth filter information associated with a VSI type ID are retrieved from the VSI DB table. The associated rules and filter information are applied based on the PD.

Embodiments of the invention relate to reflective relay (RR) processing on logical ports for channelized links in edge virtual bridging (EVB) systems. One embodiment includes providing a virtual edge bridge (VEB) mode and a virtual Ethernet port aggregator (VEPA) mode in an EVB system on a same port of a physical switch. RR capability per channel is negotiated between a server and the physical switch in the EVB system. RR per channel is supported on the physical switch of the EVB system using RR setting information per channel.

Reflective relay processing on logical ports for channelized links in edge virtual bridging systems

Embodiments of the invention relate to scalable policy management in an edge virtual bridging (EVB) environment. One embodiment includes fetching information from a virtual station interface (VSI) database. A first table is generated with at least a portion of the information from the VSI database. A message is received including virtual machine (VM) information for a created VM. A second table is generated including at least a portion of the VM information. A VM identification (ID) is retrieved based on VM type from the first table. Rules associated with the retrieved VM ID are retrieved from the second table. The associated rules for the VM are applied.

The disclosure relates to a method and apparatus for detecting and blocking unauthorized MAC addresses used by virtual machines. In one embodiment, the disclosure provides automated and consistent verification of VM traffic against values assigned to each VM by network administrator. In another embodiment, the disclosure provides for validating a newly discovered VM by comparing its attributes with the corresponding description of the known VMs stored at a database. A re-validation check may also be implemented. If the VM is validated, the VM will be processed according to network policy to support features including VMReady. If the VM fails validation, other actions can be taken.

Growing community of inventors

Cupertino, CA, United States of America

Vasmi Mohammad Abidi