Application of profile setting groups to logical network entities

Patent metadata

Field	Value
Publication number	US-10749751-B2
Application number	US-201815969736-A
Country	US
Kind code	B2
Filing date	May 2, 2018
Priority date	May 2, 2018
Publication date	Aug 18, 2020
Grant date	Aug 18, 2020

Abstract

Some embodiments provide a method for a network controller. The method receives network configuration data including an association of an entity configuration profile set with a logical network entity. The entity configuration profile set is a group of at least two entity configuration profiles for different types of settings to apply to logical network entities with which the entity configuration profile set is associated. The method identifies a host machine at which the logical network entity is implemented. The method distributes the entity configuration profile set and each of the at least two entity configuration profiles to the identified host machine.

First claim

We claim:

1. For a network controller, a method comprising:
receiving network configuration data comprising (i) an association of a first entity configuration profile with a first logical network entity and (ii) an association of an entity configuration profile set with a second logical network entity, wherein the entity configuration profile set is a group of at least two entity configuration profiles, including at least the first entity configuration profile and a second entity configuration profile, for different types of settings to apply to logical network entities with which the entity configuration profile set is associated;
identifying a first set of host computers at which the first logical network entity is implemented and a second set of host computers at which the second logical network entity is implemented; and
distributing (i) the first entity configuration profile to each host computer in the first set of host computers and (ii) the entity configuration profile set and each of the at least two entity configuration profiles to each host computer in the second set of host computers, wherein at least one host computer is in both the first and second sets of host computers.

2. The method of claim 1 , wherein the network controller receives the network configuration data from a network manager, wherein the network manager comprises an application programming interface (API) through which a user provides the association of the entity configuration profiles to the logical entities.

3. The method of claim 1 , wherein the second logical network entity comprises a logical switch port that is implemented on a host computer that is in the second set of host computers.

4. The method of claim 1 , wherein:
the second logical network entity comprises a logical switch having a plurality of logical switch ports;
identifying the second set of host computers at which the second logical network entity is implemented comprises identifying a plurality of host computers at which the plurality of logical switch ports are implemented; and
distributing the entity configuration profile set and the at least two entity configuration profiles comprises distributing the entity configuration profile set and the at least two entity configuration profiles to each host computer of the plurality of identified host computers at which the plurality of logical switch ports are implemented.

5. The method of claim 1 , wherein a particular one of the entity configuration profiles comprises configuration settings for one of quality of service, security, and IP Flow Information Export (IPFIX).

6. The method of claim 1 , wherein a particular one of the entity configuration profiles comprises a set of distributed firewall rules.

7. The method of claim 1 further comprising:
receiving addition of an additional entity configuration profile to the entity configuration profile set; and
distributing the additional entity configuration profile and an entity configuration profile set update to the identified second set of host computers.

8. The method of claim 1 , wherein the first entity configuration profile comprises configuration settings for a particular property of the second logical network entity, the method further comprising:
receiving an association of a third entity configuration profile with the second logical network entity, the third entity configuration profile comprising configuration settings for the same particular property;
determining that the third entity configuration profile has a higher priority than the first entity configuration profile; and
removing the association of the first entity configuration profile with the second logical network entity.

9. The method of claim 1 further comprising:
receiving network configuration data comprising an association of the entity configuration profile set with a third logical network entity;
identifying a third set of host computers at which the second logical network entity is implemented; and
distributing the entity configuration profile set and each of the at least two entity configuration profiles to each host computer of the third set of host computers.

10. The method of claim 1 , wherein (i) the entity configuration profile set is a first entity configuration profile set and (ii) the first entity configuration profile has a first priority and comprises a first set of configuration settings for a particular property of logical network entities, the method further comprising:
receiving an association of a second entity configuration profile set with the second logical network entity, wherein (i) the second entity configuration profile set comprises at least a third entity configuration profile and a fourth entity configuration profile and (ii) the third entity configuration profile has a second priority and comprises a second set of configuration settings for the particular property;
determining that the first priority of the first entity configuration profile set is higher than the second priority of the second entity configuration profile set; and
distributing the fourth entity configuration profile set but not the third entity configuration profile set to each host computer in the second set of host computers.

11. A non-transitory machine-readable medium storing a network controller program for execution by at least one processing unit, the network controller program comprising sets of instructions for:
receiving network configuration data comprising (i) an association of a first entity configuration profile with a first logical network entity and (ii) an association of an entity configuration profile set with a second logical network entity, wherein the entity configuration profile set is a group of at least two entity configuration profiles, including at least the first entity configuration profile and a second entity configuration profile, for different types of settings to apply to logical network entities with which the entity configuration profile set is associated;
identifying a first set of host computers at which the first logical network entity is implemented and a second set of host computers at which the second logical network entity is implemented; and
distributing (i) the first entity configuration profile to each host computer in the first set of host computers and (ii) the entity configuration profile set and each of the at least two entity configuration profiles to each host computer in the second set of host computers, wherein at least one host computer is in both the first and second sets of host computers.

12. The non-transitory machine-readable medium of claim 11 , wherein the network controller program receives the network configuration data from a network manager, wherein the network manager comprises an application programming interface (API) through which a user provides the association of the entity configuration profiles to the logical entities.

13. The non-transitory machine-readable medium of claim 11 , wherein the second logical network entity comprises a logical switch port that is implemented on a host computer that is in the second set of host computers.

14. The non-transitory machine-readable medium of claim 11 , wherein:
the second logical network entity comprises a logical switch having a plurality of logical switch ports;
the set of instructions for identifying the second set of host computers at which the second logical network entity is implemented comprises a set of instructions for identifying a plurality of host computers at which the plurality of logical switch ports are implemented; and
the set of instructions for distributing the entity co

Assignees

• Nicira Inc

Inventors

• Wan Da
• Gao Juntao
• Shen Jianjun
• Han Donghai
• Wang Qiong
• Wu Qi
• Thakkar Pankaj
• Wang Yuanhui
• Song Mengdie

Classifications

• H04L67/30

  Profiles · CPC title

• H04L41/122

  of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/0893 Primary

  Assignment of logical groups to network elements · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title