Flow based network service insertion

Patent metadata

Field	Value
Publication number	US-9602415-B2
Application number	US-201514877034-A
Country	US
Kind code	B2
Filing date	Oct 7, 2015
Priority date	Aug 30, 2013
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

Techniques are provided to generate and store a network graph database comprising information that indicates a service node topology, and virtual or physical network services available at each node in a network. A service request is received for services to be performed on packets traversing the network between at least first and second endpoints. A subset of the network graph database is determined that can provide the services requested in the service request. A service chain and service chain identifier is generated for the service based on the network graph database subset. A flow path is established through the service chain by flow programming network paths between the first and second endpoints using the service chain identifier.

First claim

What is claimed is:

1. A method comprising:
receiving, in a network comprising a plurality of virtual machines hosted by a plurality of nodes, a service request for network services to be performed on packets traversing the network from a first virtual machine hosted by a first node to a second virtual machine hosted by a second node;
determining a service node topology of the network and virtual or physical network services available at each node in the network;
generating a service chain and a service chain identifier corresponding to the generated service chain for the network services, the service chain comprising an ordered list of the network services to be applied to the packets traversing the network;
starting each requested network service at a corresponding node in the service chain;
establishing a flow path based upon the service chain by flow programming network paths between the first virtual machine and the second virtual machine using the service chain identifier; and
sending the packets from the first virtual machine to the second virtual machine by way of the flow path, wherein the packets are serviced at and sent directly to corresponding nodes based upon the ordered list of the network services of the service chain as the packets traverse the flow path.

2. The method of claim 1 , wherein establishing the flow path comprises establishing a path specific network layer 2 or network layer 3 tunnel between the first node and the second node.

3. The method of claim 2 , wherein establishing the path specific network layer 3 tunnel comprises establishing one of a Virtual Local Area Network (VLAN) tunnel, a Virtual Extensible Local Area Network (VXLAN) tunnel, a Generic Routing Encapsulation (GRE) tunnel, a Network Virtualization Generic Routing Encapsulation (NVGRE) tunnel, and a Locator/Identifier Separation Protocol (LISP) tunnel.

4. The method of claim 1 , wherein establishing the flow path comprises generating flow entries and adding the flow entries to a flow table and redirecting the flow path by adding or removing the flow entries in the flow table, wherein the flow table includes information for a service chain hierarchy.

5. The method of claim 1 , wherein establishing comprises establishing the flow path by way of a central controller configured to manage the network services in the network.

6. The method of claim 1 , further comprising scaling the network services by clustering a plurality of central controllers.

7. The method of claim 1 , wherein starting each requested network service comprises:
determining that at least one of the requested network services includes a router virtual machine; and
starting the router virtual machine on one of the plurality of nodes.

8. An apparatus comprising:
a memory;
a network interface unit configured to enable communications over a network; and
a processor coupled to the network interface unit, the processor configured to:
receive a service request for network services to be performed on packets traversing a network from a first virtual machine hosted by a first node to a second virtual machine hosted by a second node;
determine a service node topology of the network and virtual or physical network services available at each node in the network;
generate a service chain and a service chain identifier corresponding to the generated service chain for the network services, the service chain comprising an ordered list of the network services to be applied to the packets traversing the network;
start each requested service at a corresponding node in the service chain;
establish a flow path based upon the service chain by flow programming network paths between the first virtual machine and the second virtual machine using the service chain identifier; and
command that the packets from the first virtual machine to the second virtual machine are sent by way of the flow path, wherein the packets are serviced at and sent directly to corresponding nodes based upon the ordered list of the network services of the service chain as the packets traverse the flow path.

9. The apparatus of claim 8 , wherein the processor is further configured to:
generate and store policy based service topology macros including one or more of topology widgets and subgraphs;
perform a policy lookup based on the service request to obtain a service topology macro or a subgraph;
execute the service topology macro when the service topology macro is obtained; and
map and instantiate the subgraph when the subgraph is obtained.

10. The apparatus of claim 8 , wherein the processor is further configured to:
generate flow entries;
add the flow entries to a flow table, wherein the flow table includes information for a service chain hierarchy; and
add and remove the flow entries in the flow table to redirect the flow path.

11. The apparatus of claim 8 , wherein the processor is further configured to:
establish the flow path by establishing a path specific network layer 2 or network layer 3 tunnel between the first node and the second node.

12. The apparatus of claim 11 , wherein the processor is further configured to:
establish the path specific network layer 3 tunnel by establishing one of a Virtual Local Area Network (VLAN) tunnel, a Virtual Extensible Local Area Network (VXLAN) tunnel, a Generic Routing Encapsulation (GRE) tunnel, a Network Virtualization Generic Routing Encapsulation (NVGRE) tunnel, and a Locator/Identifier Separation Protocol (LISP) tunnel.

13. The apparatus of claim 12 , wherein the processor is further configured to:
map the service chain identifier to the established path specific network layer 3 tunnel.

14. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
receive a service request for network services to be performed on packets traversing a network from a first virtual machine hosted by a first node to a second virtual machine hosted by a second node;
determine a service node topology of the network and virtual or physical network services available at each node in the network;
generate a service chain and a service chain identifier corresponding to the generated service chain for the network services, the service chain comprising an ordered list of the network services to be applied to the packets traversing the network;
start each requested network service at a corresponding node in the service chain;
establish a flow path based upon the service chain by flow programming network paths between the first virtual machine and the second virtual machine using the service chain identifier; and
command that the packets from the first virtual machine to the second virtual machine be sent by way of the flow path, wherein the packets are serviced at and sent directly to corresponding nodes based upon the ordered list of the network services of the service chain as the packets traverse the flow path.

15. The non-transitory computer readable storage media of claim 14 , further comprising instructions operable to:
generate and store policy based service topology macros including one or more of topology widgets and subgraphs;
perform a policy lookup based on the service request to obtain a service topology macro or a subgraph;
execute the service topology macro when the service topology macro is obtained; and
map and instantiate the subgraph when the subgraph is obtained.

16. The non-transitory computer readable storage media of claim 14 , further comprising instructions operable to:
generate flo

Assignees

• Cisco Tech Inc

Inventors

• Mestery Kyle Andrew Donald
• Dutta Debojyoti
• Perdomo Edgar Francisco Magana

Classifications

• H04L41/50

  Network service management, e.g. ensuring proper service fulfilment according to agreements · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L47/2408 Primary

  for supporting different services, e.g. a differentiated services [DiffServ] type of service · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title