Port mapping for bonded interfaces of ECMP group

Patent metadata

Field	Value
Publication number	US-11909558-B2
Application number	US-202217880899-A
Country	US
Kind code	B2
Filing date	Aug 4, 2022
Priority date	Jan 14, 2020
Publication date	Feb 20, 2024
Grant date	Feb 20, 2024

Abstract

Some embodiments of the invention provide novel methods for providing a stateful service at a network edge device (e.g., an NSX edge) that has a plurality of north-facing interfaces (e.g., interfaces to an external network) and a plurality of corresponding south-facing interfaces (e.g., interfaces to a logical network). A set of interfaces on each side of the network edge device for a set of equal cost paths, in some embodiments, are bonded together in the network edge device to correspond to a single interface on either side of a logical bridge including at least one logical switch providing a stateful service implemented by the network edge device. The bond is implemented, in some embodiments, by a bonding module executing on the network edge device that maintains a mapping between ingress and egress interfaces to allow deterministic forwarding through the network edge device in the presence of bonded interfaces.

First claim

We claim:

1. A method for performing services for a logical first network, the method comprising:
deploying a north first set of one or more routers and a south second set of one or more routers as two sets of gateway devices between the logical first network and a second network;
deploying a set of services between the two sets of routers in order to perform at least one service on data messages passing through the two sets of routers as the data messages enter or exit the logical network; and
defining a logical switch to connect to the first and second sets of routers, and to the set of services, said logical switch forwarding data messages received from one set of routers to one or more services and forwarding data messages received from the one or more services to the other set of routers after the one or more services have performed their operations.

2. The method of claim 1 , wherein the set of services are defined in a demilitarized zone (DMZ) that is between the first and second sets of routers.

3. The method of claim 1 , wherein deploying the set of services comprises configuring at least one of the first and second sets of routers to direct at least a subset of data message flows incoming to or outgoing from the logical network to one or more of the services.

4. The method of claim 1 , wherein the set of services includes at least one of a firewall service, a load balancer service, a network address translation service, and a virtual private network service.

5. The method of claim 1 , wherein the logical switch is implemented by a device that also implements a router from at least one of the first and second sets of routers.

6. The method of claim 1 , wherein the logical switch is implemented by a device that is separate from any router in the first and second sets of routers.

7. The method of claim 1 , wherein the set of services include stateful services for which connection-tracking records are created and inspected.

8. The method of claim 1 , wherein at least one of the first and second sets of routers include an active router and a standby router.

9. The method of claim 1 , wherein the second network is another logical network.

10. A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs services for a logical first network, the program comprising sets of instructions for:
configuring a north first set of one or more routers and a south second set of one or more routers as two sets of gateway devices between the logical first network and a second network;
configuring a set of services between the two sets of routers in order to perform at least one service on data messages passing through the two sets of routers as the data messages enter or exit the logical network; and
configuring a logical switch to connect to the first and second sets of routers, and to the set of services, said logical switch forwarding data messages received from one set of routers to one or more services and forwarding data messages received from the one or more services to the other set of routers after the one or more services have performed their operations.

11. The non-transitory machine readable medium of claim 10 , wherein the set of services are configured in a demilitarized zone (DMZ) that is between the first and second sets of routers.

12. The non-transitory machine readable medium of claim 10 , wherein the set of instructions for configuring the set of services comprises a set of instructions for configuring at least one of the first and second sets of routers to direct at least a subset of data message flows incoming to or outgoing from the logical network to one or more of the services.

13. The non-transitory machine readable medium of claim 10 , wherein the set of services includes at least one of a firewall service, a load balancer service, a network address translation service, and a virtual private network service.

14. The non-transitory machine readable medium of claim 10 , wherein the logical switch is implemented by a device that also implements a router from at least one of the first and second sets of routers.

15. The non-transitory machine readable medium of claim 10 , wherein the logical switch is implemented that is separate from any router in the first and second sets of routers.

16. The non-transitory machine readable medium of claim 10 , wherein the set of services include stateful services for which connection-tracking records are created and inspected.

17. The non-transitory machine readable medium of claim 10 , wherein at least one of the first and second sets of routers include an active router and a standby router.

18. The non-transitory machine readable medium of claim 10 , wherein the second network is another logical network.

Assignees

• VMware LLC

Inventors

• Wang Dexiang
• Yu Jia
• Jain Jayant
• Parsa Mike
• Luo Haihua

Classifications

• H04L45/02

  Topology update or discovery · CPC title

• H04L12/66 Primary

  Arrangements for connecting between networks having differing types of switching systems, e.g. gateways · CPC title

• H04L63/0254 Primary

  Stateful filtering · CPC title

• H04L45/24

  Multipath · CPC title

• H04L49/25

  Routing or path finding in a switch fabric · CPC title