Exposing a subset of hosts on an overlay network to components external to the overlay network without exposing another subset of hosts on the overlay network

Patent metadata

Field	Value
Publication number	US-11240152-B2
Application number	US-201916416154-A
Country	US
Kind code	B2
Filing date	May 18, 2019
Priority date	Sep 2, 2016
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

Techniques for exposing a subset of hosts on an overlay network, without exposing another subset of hosts on the overlay network, are disclosed. A component associated with an overlay network exposes a subset of hosts on the overlay network to components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) the substrate addresses associated with the hosts. Alternatively, a component external to an overlay network exposes a subset of hosts on the overlay network to additional components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) a substrate address associated with the particular component. In either embodiment, a mapping for hosts to-be-hidden is not distributed.

First claim

What is claimed is:

1. One or more non-transitory machine-readable media storing instructions which, when executed by one or more processors, cause:
identifying a first policy, administered by a first entity, that manages communication between a first gateway and a second gateway;
identifying a second policy, administered by a second entity, that manages the communication between the first gateway and the second gateway;
wherein the first gateway and the second gateway directly or indirectly connect a first overlay network and a second overlay network;
wherein the first policy allows a first subset of hosts of the first overlay network to be exposed to the second gateway, the first subset of exposed hosts including a first host of the first overlay network and a second host of the first overlay network;
wherein the second policy allows a second subset of hosts of the first overlay network to be exposed to the second gateway, the second subset of exposed hosts including the first host of the first overlay network but not including the second host of the first overlay network;
responsive to determining that both the first policy and the second policy allow the first host of the first overlay network to be exposed to the second gateway:
transmitting, via the first gateway, a first set of routing information for the first host toward the second gateway;
wherein the first set of routing information for the first host comprises a mapping between (a) an overlay network address corresponding to the first host and (b) a substrate address which may be used to transmit communication via the substrate network toward the overlay network address;
responsive to determining that the second policy does not allow the second host of the first overlay network to be exposed to the second gateway:
refraining from transmitting, via the first gateway, any routing information for the second host toward the second gateway.

2. The one or more non-transitory machine-readable media of claim 1 , further storing instructions which, when executed by the one or more processors, cause:
responsive to determining that exposing a third host of a third overlay network to the second gateway is not prohibited by any policy managing the communication between the first gateway and the second gateway:
transmitting, via the first gateway, a second set of routing information for the third host toward the second gateway;
wherein the first gateway and the second gateway directly or indirectly connect the third overlay network and the second overlay network.

3. The one or more non-transitory machine-readable media of claim 1 , further storing instructions which, when executed by the one or more processors, cause:
responsive to determining that exposing a third host of a third overlay network to the second gateway is prohibited by at least one policy managing the communication between the first gateway and the second gateway:
refraining from transmitting, via the first gateway, any set of routing information for the third host toward the second gateway;
wherein the first gateway and the second gateway directly or indirectly connect the third overlay network and the second overlay network.

4. The one or more non-transitory machine-readable media of claim 1 , further storing instructions which, when executed by the one or more processors, cause:
receiving a second set of routing information for a third host of the second overlay network, without receiving any routing information for a fourth host of the second overlay network;
wherein both the first policy and the second policy allow the third host of the second overlay network to be exposed to the first gateway;
wherein at least one of the first policy and the second policy does not allow the fourth host of the second overlay network to be exposed to the first gateway.

5. The one or more non-transitory machine-readable media of claim 4 , further storing instructions which, when executed by the one or more processors, cause:
updating a stored set of routing information for the first gateway based on the second set of routing information for the third host.

6. The one or more non-transitory machine-readable media of claim 1 , wherein the first set of routing information for the first host comprises:
a mapping between an overlay address of the first host and a substrate address of an ingress port associated with the first gateway.

7. The one or more non-transitory machine-readable media of claim 6 , wherein the ingress port is configured to receive communication from the second gateway.

8. The one or more non-transitory machine-readable of claim 1 , wherein:
the first entity is a first tenant of a multi-tenant network;
the second entity is a second tenant of the multi-tenant network.

9. The one or more non-transitory machine-readable media of claim 1 , wherein:
the first overlay network is managed by the first entity;
the second overlay network is managed by the second entity.

10. The one or more non-transitory machine-readable media of claim 1 , wherein a particular host of the first overlay network is exposed to the second gateway only if both the first policy and the second policy allow the particular host to be exposed to the second gateway.

11. The one or more non-transitory machine-readable media of claim 1 , wherein:
a set of hosts, including the first host and the second host, of the first overlay network are respectively implemented by a set of digital devices of a substrate network;
the set of digital devices of the substrate network are connected by a set of physical links;
the set of hosts of the first overlay network are connected by virtual or logical communication paths, each corresponding to at least one of the set of physical links.

12. The one or more non-transitory machine-readable media of claim 1 , further storing instructions which, when executed by the one or more processors, cause:
responsive to determining that exposing a third host of a third overlay network to the second gateway is not prohibited by any policy managing the communication between the first gateway and the second gateway:
transmitting, via the first gateway, a second set of routing information for the third host toward the second gateway;
responsive to determining that exposing a fourth host of the third overlay network to the second gateway is prohibited by at least one policy managing the communication between the first gateway and the second gateway:
refraining from transmitting, via the first gateway, any set of routing information for the fourth host toward the second gateway;
wherein the first gateway and the second gateway directly or indirectly connect the third overlay network and the second overlay network;
receiving a third set of routing information for a fifth host of the second overlay network, without receiving any routing information for a sixth host of the second overlay network;
wherein both the first policy and the second policy allow the fifth host of the second overlay network to be exposed to the first gateway;
wherein at least one of the first policy and the second policy does not allow the sixth host of the second overlay network to be exposed to the first gateway;
updating a stored set of routing information for the first gateway based on the third set of routing information for the fifth host;
wherein the first set of routing information for the first host comprises: a mapping between an overlay address of the first host and a substrate address of an ingress port associated with the first gateway;
wherein the ingress port is configured to receive communication from the second gateway;
wherein the first entit

Assignees

• Oracle Int Corp

Inventors

• Hill Peter John
• McArthur David Allen
• Brar Jagwinder Singh
• Bhanu Vivek
• Higgins Chris

Classifications

• H04L45/64 Primary

  using an overlay routing layer · CPC title

• H04L12/66

  Arrangements for connecting between networks having differing types of switching systems, e.g. gateways · CPC title

• H04L45/02

  Topology update or discovery · CPC title