BFD OVER VxLAN ON vPC UPLINKS

Patent metadata

Field	Value
Publication number	US-2017257260-A1
Application number	US-201615063288-A
Country	US
Kind code	A1
Filing date	Mar 7, 2016
Priority date	Mar 7, 2016
Publication date	Sep 7, 2017
Grant date	—

Abstract

Disclosed are systems, methods, and computer-readable storage media for synchronizing the secondary vPC node to the primary vPC node in a BFD protocol over a VxLAN channel with a remote node. In some embodiments of the present technology a primary vPC node can receive a packet from the remote node. The primary vPC node can then determine the packet includes either a MAC address corresponding to the primary vPC node or a secondary vPC node, and at least one inner packet identifier. Additionally, the primary networking switch can identify an access control list (ACL) entry from a set of ACL entries based on the at least one inner packet identifier. Subsequently, based on the ACL entry, the primary vPC node can generate a copy of the packet. After which, the primary vPC node can transmit the packet to the secondary vPC node.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a primary virtual port channel (vPC) node, a packet from a remote node; determining, by the primary vPC node, the packet includes a media access control (MAC) address corresponding to either the primary vPC or the secondary vPC node and at least one inner packet identifier; identifying, by the primary vPC node, an access control list entry from a set of access control list entries based on the at least one inner packet identifier; based on the identified ACL entry, generating, by the primary vPC node, a copy of the packet; and based on the determined MAC address and after generating a copy of the packet, transmitting, by the primary vPC node to the secondary vPC node, the packet.

2 . The method of claim 1 , further comprising:
receiving, by the primary vPC node and from the secondary vPC node, a second packet; verifying, by the primary vPC node, a copy of the second packet has been generated by the secondary vPC node; and authorizing, by the primary vPC node, receipt of the second packet.

3 . The method of claim 1 , further comprising:
receiving, by the primary vPC node, a second packet; determining, by the primary vPC node, the secondary vPC node did not generate a copy of the second packet; and restricting, by the primary vPC node, receipt of the second packet.

4 . The method of claim 1 , further comprising:
determining, by the secondary vPC node, the primary vPC node generated a copy of the packet.

5 . The method of claim 1 , wherein the primary vPC node and the secondary vPC node include MAC addresses of both the primary vPC node and the secondary vPC node.

6 . The method of claim 1 , further comprising:
receiving, by the primary vPC node and from a second remote node, a second packet; determining, by the primary vPC node, the second packet includes the MAC address corresponding to either the primary vPC node or the secondary vPC node and the inner UDP destination address; identifying, by the primary vPC node, the ACL entry from a set of ACL entries based on the inner UDP destination address, the access control list entry including an instruction to copy the second packet; based on the identified ACL entry, generating, by the primary vPC node, a copy of the second packet; and based on the determined MAC address and after generating a copy of the second packet, transmitting, by the primary vPC node to the secondary vPC node, the packet.

7 . The method of claim 1 , wherein the inner packet identifier includes at least one of an inner destination internet protocol (IP) address, an inner user datagram protocol (UDP) destination port address and an inner IP time to live (TTL).

8 . A non-transitory computer-readable medium containing instructions that, when executed by a primary vPC node, cause the primary vPC node to:
receive a packet from a remote node; determine the packet includes a media access control (MAC) address corresponding to either the primary vPC or a secondary vPC node, and at least one inner packet identifier; identify an access control list entry from a set of access control list entries based on the at least one inner packet identifier, the access control list entry including an instruction to copy the packet; based on the identified ACL entry, generate a copy of the packet; and based on the determined MAC address and after generating a copy of the packet transmit the packet to the secondary vPC node.

9 . The non-transitory computer readable medium of claim 8 , wherein the instructions further cause the primary vPC node to:
receive a second packet from the secondary vPC node; verify a copy of the second packet has been generated by the secondary vPC node; and authorize receipt of the second packet.

10 . The non-transitory computer readable medium of claim 8 , wherein the instructions further cause the primary vPC node to:
receive a second packet from the secondary vPC node; determine a copy of the second packet has not been generated by the secondary vPC node; and restrict receipt of the second packet.

11 . The non-transitory computer readable medium of claim 8 , wherein the instructions further cause the primary vPC node to:
determine a failover of the primary vPC node; and transmit instructions to the node to initialize communications between the node and the secondary vPC node.

12 . The non-transitory computer readable medium of claim 11 , wherein the inner packet identifier includes at least one an inner destination internet protocol (IP) address, an inner user datagram protocol (UDP) destination port address and an inner IP time to live (TTL).

13 . A computing system comprising:
a remote node; a dual-homed virtual tunnel endpoint (VTEP), the dual-homed VTEP including primary network switch and a secondary network switch; a processor; and memory containing instructions that, when executed by the processor, cause the secondary network switch to:
receive a packet from the remote node;
determine the packet includes a media access control (MAC) address corresponding to either the primary network switch or the secondary network switch and at least one inner packet identifier;
identify an access control list entry from a set of access control list entries based on the at least one inner packet identifier, the access control list entry including an instruction to copy the packet;
based on the identified ACL entry, generate a copy of the packet; and
based on the determined MAC address and after generating a copy of the packet, transmit the packet to the primary network switch.

14 . The computing system of claim 13 , wherein the instructions further cause the secondary network switch to:
receive from the primary network switch or the node, a copy of an initial packet, the initial packet including a discriminator; determine the discriminator is associated with a bidirectional forwarding detection (BFD) protocol between the secondary network switch and the node; and configure the secondary network switch to be a hot-standby.

15 . The computing system of claim 14 , wherein the instructions further cause the secondary network switch to:
determine a failover of the primary network switch; and transmit instructions to the node to initialize communications between the node and the secondary network switch.

16 . The computing system of claim 13 , wherein primary network switch and the secondary network switch both include MAC addresses of the primary network switch and the secondary network.

17 . The computing system of claim 13 , wherein the instructions further cause the secondary network switch to:
receive a second packet; determine a copy of the second packet has not been generated by the primary network switch; and restrict receipt of the second packet.

18 . The computing system of claim 13 , wherein the instructions further cause the secondary network switch to:
receive a second packet; determine a copy of the second packet was generated by the primary network switch; and authorizing receipt of the second packet.

19 . The computing system of claim 13 , wherein the inner packet identifier includes at least one of an inner destination internet protocol (IP) address, an inner user datagram protocol (UDP) destination port address and an inner IP time to live (TTL).

20 . The computing system of claim 13 , wherein the remote node and the dual-homed VTEP have initialized a BFD session over VxLAN.

Assignees

• Cisco Tech Inc

Inventors

• Govindan Vengada Prasad
• Banerjee Ayan
• Mahajan Mehak
• Gidwani Abhayraj Kuldip
• Mallik Mudigonda Jwala

Classifications

• H04L41/0654 Primary

  using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) · CPC title

• H04L12/4633 Primary

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L41/0659

  by isolating or reconfiguring faulty entities · CPC title