Distributed virtual switch architecture for a hybrid cloud

Patent metadata

Field	Value
Publication number	US-9203784-B2
Application number	US-201213454528-A
Country	US
Kind code	B2
Filing date	Apr 24, 2012
Priority date	Apr 24, 2012
Publication date	Dec 1, 2015
Grant date	Dec 1, 2015

Abstract

In one embodiment, a secure transport layer tunnel may be established over a public network between a first cloud gateway in a private cloud and a second cloud gateway in a public cloud, where the secure transport layer tunnel is configured to provide a link layer network extension between the private cloud and the public cloud. In addition, a cloud virtual Ethernet module (cVEM) may be executed (instantiated) within the public cloud, where the cVEM is configured to switch inter-virtual-machine (VM) traffic between the private cloud and one or more private application VMs in the public cloud connected to the cVEM.

First claim

What is claimed is:

1. A method, comprising:
establishing a secure transport layer tunnel over a public network between a first cloud gateway in a private cloud and a second cloud gateway in a public cloud, the secure transport layer tunnel configured to provide a link layer network extension between the private cloud and the public cloud that creates a secure link layer network overlay infrastructure at a cloud data center on demand, wherein the secure link layer network overlay infrastructure allows for same customer network polices to be applied to the cloud resources without requiring application re-architecting;
executing a cloud virtual Ethernet module (cVEM) within the public cloud, the cVEM configured to switch inter-virtual-machine (VM) traffic between the private cloud and one or more private application VMs in the public cloud connected to the cVEM;
managing the one or more private application VMs in the public cloud by a virtual supervisor module (VSM) in the private cloud as though the cVEM and VMs in the public cloud were within the private cloud; and
migrating an instance of a particular private application VM between a virtual Ethernet module (VEM) of the private cloud and the cVEM of the public cloud on demand.

2. The method as in claim 1 , further comprising:
managing a virtual network interface card (vNIC) of each of the one or more private application VMs in the public cloud as a virtual Ethernet interfaces (veth) on the VSM.

3. The method as in claim 2 , further comprising:
configuring a particular veth using a port-profile applicable to an instance of a particular private application VM when instantiated within the public cloud or within the private cloud.

4. The method as in claim 1 , further comprising:
instantiating the first cloud gateway and second cloud gateway by a cloud manager within the public cloud.

5. The method as in claim 1 , further comprising:
monitoring health of the first and second cloud gateways, the one or more private application VMs, the cVEM, and the secure transport layer tunnel by a cloud manager within the public cloud.

6. The method as in claim 1 , further comprising:
embedding the cVEM within the second cloud gateway.

7. The method as in claim 1 , further comprising:
attaching the first cloud gateway as a VM to one of either a switch of the private cloud or to a virtual Ethernet module (VEM) of the private cloud that is attached to the switch.

8. A system, comprising:
a first cloud gateway device in a private cloud;
a second cloud gateway device in a public cloud;
a secure transport layer tunnel over a public network between the first cloud gateway device in the private cloud and the second cloud gateway device in the public cloud, the secure transport layer tunnel configured to provide a link layer network extension between the private cloud and the public cloud that creates a secure link layer network overlay infrastructure at a cloud data center on demand, wherein the secure link layer network overlay infrastructure allows for same customer network polices to be applied to the cloud resources without requiring application re-architecting;
a cloud virtual Ethernet module (cVEM) executed within the public cloud; and
one or more private application virtual machines (VMs) in the public cloud connected to the cVEM, wherein the cVEM is configured to switch inter-VM traffic between the private cloud and the one or more private application VMs;
a virtual supervisor module (VSM) in the private cloud configured to manage the one or more private application VMs in the public cloud as though the cVEM and VMs in the public cloud were within the private cloud; and
a cloud manager within the public cloud and configured to migrate an instance of a particular private application VM between a virtual Ethernet module (VEM) of the private cloud and the cVEM of the public cloud on demand.

9. The system as in claim 8 , wherein the VSM is further configured to manage a virtual network interface card (vNIC) of each of the one or more private application VMs in the public cloud as a virtual Ethernet interfaces (veth) on the VSM.

10. The system as in claim 9 , wherein the VSM is further configured to configure a particular veth using a port-profile applicable to an instance of a particular private application VM when instantiated within the public cloud or within the private cloud.

11. The system as in claim 8 , further comprising:
a cloud manager within the private cloud and configured to instantiate the first cloud gateway and second cloud gateway device.

12. The system as in claim 8 , further comprising:
a cloud manager within the private cloud and configured to monitor health of the first and second cloud gateway devices, the one or more private application VMs, the cVEM, and the secure transport layer tunnel.

13. The system as in claim 8 , wherein the cVEM is embedded within the second cloud gateway device.

14. The system as in claim 8 , further comprising:
a switch of the private cloud, wherein the first cloud gateway device is attached as a VM to one of either the switch or to a virtual Ethernet module (VEM) of the private cloud that is attached to the switch.

15. A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:
establish a secure transport layer tunnel over a public network between a first cloud gateway in a private cloud and a second cloud gateway in a public cloud, the secure transport layer tunnel configured to provide a link layer network extension between the private cloud and the public cloud that creates a secure link layer network overlay infrastructure at a cloud data center on demand, wherein the secure link layer network overlay infrastructure allows for same customer network polices to be applied to the cloud resources without requiring application re-architecting; and
instantiate a cloud virtual Ethernet module (cVEM) within the public cloud, the cVEM configured to switch inter-virtual-machine (VM) traffic between the private cloud and one or more private application VMs in the public cloud connected to the cVEM; and
migrate an instance of a particular private application VM between a virtual Ethernet module (VEM) of the private cloud and the cVEM of the public cloud, wherein the particular private application VM is managed by the virtual supervisor module (VSM) of the private cloud as though the cVEM and VMs in the public cloud were within the private cloud.

Assignees

• Chang David W
• Patra Abhijit
• Bagepalli Nagaraj A
• Mestery Kyle
• Cisco Tech Inc

Inventors

• Chang David W
• Patra Abhijit
• Bagepalli Nagaraj A
• Mestery Kyle

Classifications

• H04L2012/5617

  Virtual LANs; Emulation of LANs · CPC title

• H04L12/4625

  Single bridge functionality, e.g. connection of two networks over a single bridge · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L49/70 Primary

  Virtual switches · CPC title

• H04L12/462

  LAN interconnection over a bridge based backbone · CPC title