Tenant-based mapping for virtual routing and forwarding

Patent metadata

Field	Value
Publication number	US-2021328917-A1
Application number	US-202117232547-A
Country	US
Kind code	A1
Filing date	Apr 16, 2021
Priority date	Apr 16, 2020
Publication date	Oct 21, 2021
Grant date	—

Abstract

A network device is configured to associate a tenant of a plurality of tenants with a virtual routing and forwarding (VRF) instance of a plurality of VRF instances. The network device receives a packet comprising metadata specifying a tenant identifier for the tenant. The network device identifies, based on the tenant identifier specified by the metadata, the VRF instance associated with the tenant. The network device retrieves one or more routes from a routing information base (RIB) of the VRF instance associated with the tenant and forwards the packet toward a destination via the one or more routes.

First claim

What is claimed is:

1 . A method comprising:
associating, by a network device, a tenant with a virtual routing and forwarding (VRF) instance of a plurality of VRF instances; receiving, by the network device, a packet comprising a first portion of metadata specifying a tenant identifier for the tenant and a second portion of metadata specifying a session identifier for a session associated with the packet; selecting, by the network device and based on the first portion of metadata specifying the tenant identifier, the VRF instance of the plurality of VRF instances associated with the tenant; determining, by the network device and based on the second portion of metadata specifying the session identifier, the session associated with the packet; determining, by the network device and based on the session, a service associated with the session; retrieving, by the network device and based on the determined service associated with the packet, one or more routes from a routing information base (RIB) of the selected VRF instance of the plurality of VRF instances associated with the tenant; and forwarding, by the network device, the packet toward a destination for the packet via the one or more routes.

2 . The method of claim 1 , further comprising:
obtaining, by the network device and based on the service associated with the session, one or more policies for the service; and applying, by the network device, the one or more policies for the service to the packet.

3 . The method of claim 2 , wherein the one or more policies for the service comprise one or more of:
a path failover policy; a Differentiated Services Code Point (DSCP) marking policy; a traffic engineering policy; or a priority for network traffic associated with the session.

4 . The method of claim 1 , wherein the tenant identifier for the tenant comprises a natural language text string.

5 . The method of claim 1 ,
wherein associating the tenant with the VRF instance of the plurality of VRF instances comprises assigning, to the VRF instance of the plurality of VRF instances, the tenant identifier for the tenant, and wherein selecting, based on the first portion of metadata specifying the tenant identifier, the VRF instance of the plurality of VRF instances associated with the tenant comprises selecting the VRF instance of the plurality of VRF instances associated with the tenant based on a determination that the tenant identifier specified by the first portion of metadata is the same as the tenant identifier assigned to the VRF instance associated with the tenant.

6 . The method of claim 1 ,
wherein the packet comprises a first packet of a plurality of packets of a flow, and wherein forwarding the packet toward the destination via the one or more routes comprises forwarding the first packet and each subsequent packet of the flow in order toward the destination via the one or more routes.

7 . The method of claim 1 , wherein associating the tenant with the VRF instance of the plurality of VRF instances comprises associating each tenant of the plurality of tenants with a different VRF instance of the plurality of VRF instances.

8 . The method of claim 1 , wherein associating the tenant with the VRF instance of the plurality of VRF instances comprises:
associating, by the network device, a first tenant of the plurality of tenants with a first VRF instance of a plurality of VRF instances for the network device, wherein the first VRF instance for the network device to which the first tenant is assigned is different than a second VRF instance of a second plurality of VRF instances for a second network device to which the first tenant is associated.

9 . The method of claim 1 , further comprising:
associating, by the network device, a second tenant with a second VRF instance of the plurality of VRF instances different than the VRF instance; receiving, by the network device, a second packet comprising a first portion of metadata specifying a second tenant identifier for the second tenant and a second portion of metadata specifying a second session identifier for a second session associated with the second packet; selecting, by the network device and based on the first portion of metadata of the second packet specifying the second tenant identifier, the second VRF instance of the plurality of VRF instances associated with the second tenant; determining, by the network device and based on the second portion of metadata of the second packet specifying the second session identifier, the second session associated with the second packet; determining, by the network device and based on the second session, the service associated with the second session, wherein the service associated with the second session is the same as the service associated with the session; retrieving, by the network device and based on the determined service associated with the second packet, one or more second routes from a second RIB of the selected second VRF instance of the plurality of VRF instances associated with the second tenant, wherein the one or more second routes are different from the one or more routes from the RIB of the selected VRF instance of the plurality of VRF instances associated with the tenant; and forwarding, by the network device, the second packet toward a destination for the second packet via the one or more second routes.

10 . The method of claim 1 , wherein retrieving the one or more routes from the RIB of the VRF instance of the plurality of VRF instances associated with the tenant comprises:
retrieving, from a forwarding information base (FIB) of the VRF instance of the plurality of VRF instances associated with the tenant, an address of the destination for the packet; performing Border Gateway Protocol (BGP) lookup of one or more routes to the address of the destination; storing, in the RIB of the VRF instance of the plurality of VRF instances associated with the tenant, the one or more routes to the address of the destination; and retrieving, from the RIB of the VRF instance of the plurality of VRF instances associated with the tenant, the one or more routes to the address of the destination for forwarding the packet toward the destination for the packet.

11 . A system comprising:
processing circuitry; and memory operably coupled to the processing circuitry and comprising instructions configured to cause the processing circuitry to:
associate a tenant with a virtual routing and forwarding (VRF) instance of a plurality of VRF instances;
receive a packet comprising a first portion of metadata specifying a tenant identifier for the tenant and a second portion of metadata specifying a session identifier for a session associated with the packet;
select, based on the first portion of metadata specifying the tenant identifier, the VRF instance of the plurality of VRF instances associated with the tenant;
determine, based on the second portion of metadata specifying the session identifier, the session associated with the packet;
determine, based on the session, a service associated with the session;
retrieve, based on the determined service associated with the packet, one or more routes from a routing information base (RIB) of the selected VRF instance of the plurality of VRF instances associated with the tenant; and
forward the packet toward a destination for the packet via the one or more routes.

12 . The system of claim 11 , wherein the processing circuitry is further configured to:
obtain, based on the service associated with the session, one or more policies for the service; and apply the one or more policies for the service to the packet.

Assignees

• Juniper Networks Inc

Inventors

• Menon Abilash
• Jork Markus
• Peterson John M

Classifications

• H04L45/745 Primary

  Address table lookup; Address filtering · CPC title

• H04L45/033

  by updating distance vector protocols · CPC title

• H04L45/02

  Topology update or discovery · CPC title

• H04L45/586 Primary

  of virtual routers · CPC title

• H04L45/38

  Flow based routing · CPC title