Data plane isolation for virtual machine (VM) mobility operations

Patent metadata

Field	Value
Publication number	US-12455754-B2
Application number	US-202217578302-A
Country	US
Kind code	B2
Filing date	Jan 18, 2022
Priority date	Jan 18, 2022
Publication date	Oct 28, 2025
Grant date	Oct 28, 2025

Abstract

Techniques for implementing data plane isolation for VM mobility operations are provided. In one set of embodiments, these techniques include creating a virtual network path between a source host system and a destination host system participating in a VM mobility operation, which allows the host systems to exchange data for carrying out the operation without exposing their physical IP addresses to each other and without requiring the use of intermediate proxies. In certain embodiments, the virtual network path can be dynamically established upon initiation of the VM mobility operation and dynamically rolled back upon operation completion, thereby reducing the overhead of virtual path management.

First claim

What is claimed is:

1. A method comprising:
receiving, by a first computer system and a second computer system, a request to migrate a virtual machine (VM) from a source host system to a destination host system, the request being sent by global mobility manager, the global mobility manager being configured to allocate virtual addresses and routes in a networking routing table;
creating, by the first and second computer systems, a virtual network path between the source and destination host systems, the virtual network path enabling the source and destination host systems to migrate the VM without exposing a physical Internet Protocol (IP) address of the source host system to the destination host system or a physical IP address of the destination host system to the source host system; and
once the VM has been migrated, tearing down, by the first and second computer systems, the virtual network path;
wherein the first computer system and the second computer system reside in different virtual infrastructure management domains and are connected via a wide area network.

2. The method of claim 1 wherein the first computer system and first host system reside at a first site, wherein the second computer system and the second host system reside at a second site, and wherein the first and second sites are part of different virtual infrastructure (VI) management domains.

3. The method of claim 1 wherein creating the virtual network path comprises:
allocating, by the first computer system, a virtual IP address to the source host system from a first virtual IP subnet assigned to the first site;
allocating, by the second computer system, a virtual IP address to the destination host system from a second virtual IP subnet assigned to the second site;
sending, by the first computer system, the virtual IP address allocated to the source host system to the second computer system; and
sending, by the second computer system, the virtual IP address allocated to the destination host system to the first computer system.

4. The method of claim 3 wherein the first and second virtual IP subnets are assigned by a third computer system configured to ensure that the virtual network path can be created without conflicts in the virtual IP addresses allocated to the source and destination host systems.

5. The method of claim 3 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more network address translation (NAT) rules in a first gateway at the first site for translating between the virtual IP address allocated to the source host system and a physical IP address of the source host system; and
programming, by the second computer system, one or more NAT rules in a second gateway at the second site for translating between the virtual IP address allocated to the destination host system and a physical IP address of the destination host system.

6. The method of claim 4 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more routes in a network routing table of the source host system for forwarding all network traffic destined for the virtual IP address allocated to the destination host system to the first gateway; and
programming, by the second computer system, one or more routes in a network routing table of the destination host system for forwarding all network traffic destined for the virtual IP address allocated to the source host system to the second gateway.

7. The method of claim 4 wherein, upon creation of the virtual network path, a first VI management server at the first site sends a first migration specification to the source host system that specifies the VM and the virtual IP address allocated to the destination host system and sends a second migration specification to a second VI management server at the second site that specifies the VM and the virtual IP address allocated to the source host system, and wherein the second VI management server sends the second migration specification to the destination host system.

8. A non-transitory computer readable storage medium having stored thereon program code executable by a first computer system and a second computer system, the program code embodying a method comprising:
receiving a request to migrate a virtual machine (VM) from a source host system to a destination host system, the request being sent by global mobility manager, the global mobility manager being configured to allocate virtual addresses and routes in a networking routing table;
creating a virtual network path between the source and destination host systems, the virtual network path enabling the source and destination host systems to migrate the VM without exposing a physical Internet Protocol (IP) address of the source host system to the destination host system or a physical IP address of the destination host system to the source host system; and
once the VM has been migrated, tearing down the virtual network path;
wherein the first computer system and the second computer system reside in different virtual infrastructure management domains and are connected via a wide area network.

9. The non-transitory computer readable storage medium of claim 8 wherein the first computer system and first host system reside at a first site, wherein the second computer system and the second host system reside at a second site, and wherein the first and second sites are part of different virtual infrastructure (VI) management domains.

10. The non-transitory computer readable storage medium of claim 8 wherein creating the virtual network path comprises:
allocating, by the first computer system, a virtual IP address to the source host system from a first virtual IP subnet assigned to the first site;
allocating, by the second computer system, a virtual IP address to the destination host system from a second virtual IP subnet assigned to the second site;
sending, by the first computer system, the virtual IP address allocated to the source host system to the second computer system, and
sending, by the second computer system, the virtual IP address allocated to the destination host system to the first computer system.

11. The non-transitory computer readable storage medium of claim 10 wherein the first and second virtual IP subnets are assigned by a third computer system configured to ensure that the virtual network path can be created without conflicts in the virtual IP addresses allocated to the source and destination host systems.

12. The non-transitory computer readable storage medium of claim 10 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more network address translation (NAT) rules in a first gateway at the first site for translating between the virtual IP address allocated to the source host system and a physical IP address of the source host system; and
programming, by the second computer system, one or more NAT rules in a second gateway at the second site for translating between the virtual IP address allocated to the destination host system and a physical IP address of the destination host system.

13. The non-transitory computer readable storage medium of claim 10 wherein creating the virtual network path further comprises:
programming, by the first computer system, one or more routes in a network routing table of the source host system for forwarding all network traffic destined for the virtual IP address allocated to the destination host system to the first gateway; and
programming, by the second computer system, one or more routes in a network routing table of the

Assignees

• VMware LLC

Inventors

• Ramanathan Arunachalam
• Ekbote Siddharth Sudir
• Prziborowski Nathan Lyle
• Beard Derek William
• Zhao Yanlei
• Narasimhaprasad Pavan

Classifications

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title