Single pane distributed networking and security for bare metal and overlay workloads
Some embodiments provide a novel method for defining a set of policies for a set of applications executing on a host computer of a software-defined network (SDN). The method configures, on a physical network interface card (PNIC) connected to the host computer, a network adapter to create a logical port that connects an interface of the host computer to a virtual distributed switch (VDS) executing on the PNIC. The method defines the set of policies based on the logical port for the VDS to apply to data message flows sent from the set of applications on the host computer to one or more other host computers of the SDN.
1 . A method for defining a set of policies for a set of applications executing on a computer of a software-defined network (SDN), the method comprising:
configuring, on a physical network interface card (PNIC) connected to the computer, a network adapter to create a logical port that is mapped by the PNIC to a physical port of a virtual distributed switch (VDS) executing on the PNIC, wherein the logical port connects an interface of the computer to the VDS, and instructions to execute the VDS are stored on the PNIC; and
defining the set of policies for the logical port to cause the VDS to apply the set of policies to data message flows sent by the PNIC via the logical port, from the set of applications on the computer to one or more other computers of the SDN.
2 . The method of claim 1 , wherein the computer is a bare metal server that is incapable of applying the set of policies to the data message flows.
3 . The method of claim 1 , wherein the set of policies comprises at least one of networking policies and security policies, to apply to the data message flows.
4 . The method of claim 1 , further comprising:
before defining the set of policies, receiving configuration information regarding the logical port, which is used to define the set of policies.
5 . The method of claim 4 , wherein the configuration information regarding the logical port is received from one or more controllers of the SDN and specifies a network address of the logical port.
6 . The method of claim 1 , wherein the computer views the PNIC as a Peripheral Component Interconnect Express (PCIe) device connected to the computer.
7 . The method of claim 1 , wherein the logical port connects to the interface of the computer through an embedded switch of the PNIC that forwards packets between the interface of the computer and the VDS.
8 . The method of claim 7 , wherein the embedded switch connects to the interface of the computer through a virtual function (VF) of a physical function (PF) of the PNIC.
9 . The method of claim 8 , wherein the VF is a virtualized peripheral component interconnect express (PCIe) function exposed as an interface of the PNIC, and the PF is a physical interface of the PNIC.
10 . The method of claim 8 , wherein the logical port connects to the embedded switch through a representor port of the PNIC.
11 . The method of claim 7 , wherein the embedded switch is a hardware switch.
12 . The method of claim 7 , wherein the embedded switch is configured to:
receive a particular data message of a particular data message flow from a particular application;
determine that the embedded switch does not store a flow record for the particular data message flow; and
provide the particular data message to the VDS through the logical port.
13 . The method of claim 12 , wherein the VDS is configured to:
based on the set of policies, perform one or more operations on the particular data message including a particular operation to encapsulate the particular data message with an encapsulating header specifying at least one of a source virtual tunnel endpoint (VTEP) and a destination VTEP.
14 . The method of claim 13 , wherein the encapsulating header is a Generic Network Virtualization Encapsulation (Geneve) header.
15 . The method of claim 13 ,
wherein the VDS is further configured to:
provide the encapsulated particular data message to the embedded switch, and
wherein the embedded switch is further configured to:
forward the encapsulated particular data message to a destination of the particular data message.
16 . The method of claim 13 , wherein the one or more operations further comprise one or more middlebox service operations.
17 . The method of claim 16 , wherein the one or more middlebox service operations comprise one or more of firewall services, load balancing services, network address translation services, intrusion detection services, and intrusion prevention services.
18 . The method of claim 13 ,
wherein the VDS is further configured to:
determine a set of actions to perform on the particular data message flow based on the one or more operations performed on the particular data message;
generate a particular flow record for the particular data message flow specifying a flow identifier and the set of actions; and
provide the particular flow record to the embedded switch, and
wherein the embedded switch is further configured to:
use the particular flow record to perform the set of actions on subsequent data messages of the particular data message flow.
19 . The method of claim 1 , wherein the configuring and defining steps are performed by one or more management servers of the SDN connecting to the PNIC through a management interface of the PNIC.
20 . A non-transitory machine readable medium storing a program for execution by at least one processing unit for defining a set of policies for a set of applications executing on a computer of a software-defined network (SDN), the program comprising sets of instructions for:
configuring, on a physical network interface card (PNIC) connected to the computer, a network adapter to create a logical port that is mapped by the PNIC to a physical port of a virtual distributed switch (VDS) executing on the PNIC, wherein the logical port connects an interface of the computer to the VDS, and instructions to execute the VDS are stored on the PNIC; and
defining the set of policies for the logical port to cause the VDS to apply the set of policies to data message flows sent by the PNIC via the logical port, from the set of applications on the computer to one or more other computers of the SDN.