Scalable policy management in an edge virtual bridging (EVB) environment
View Patent ↗Embodiments of the invention relate to scalable policy management in an edge virtual bridging (EVB) environment. One embodiment includes fetching information from a virtual station interface (VSI) database. A first table is generated with at least a portion of the information from the VSI database. A message is received including virtual machine (VM) information for a created VM. A second table is generated including at least a portion of the VM information. A VM identification (ID) is retrieved based on VM type from the first table. Rules associated with the retrieved VM ID are retrieved from the second table. The associated rules for the VM are applied.
1. A method comprising:
fetching, by a switch, information from a virtual station interface (VSI) database;
generating, by the switch, a first table for multiple different VM types with at least a portion of the information from the VSI database;
receiving, by the switch, a message including virtual machine (VM) information for a created VM, wherein the VM information for the created VM comprises VSI type identification (ID) and virtual local area network (VLAN) ID;
generating, by the switch, a second table including the VM information and using information from the VSI database for the multiple different VM types;
validating, by the switch, the message using a value of the VSI type ID to perform a lookup of the fetched VSI database;
retrieving, by the switch, the address of the created VM from the first table based on using the VSI type ID and the network ID;
retrieving, by the switch, rules associated with the retrieved address of the created VM and the VSI type ID from the second table; and
applying, by the switch, the associated rules for the created VM.
2. The method of claim 1 , wherein the VSI database comprises one or more rules for different VSI types and access rules.
3. The method of claim 2 , wherein the first table comprises multiple VSI type IDs each associated with a source address and a VLAN address.
4. The method of claim 3 , wherein the second table comprises multiple VSI type IDs associated with one or more access rules.
5. The method of claim 4 , wherein the second table further comprises transmission rate information and receiving rate information.
6. The method of claim 1 , wherein the switch fetches the information from the VSI database from a server in an edge virtual bridging (EVB) system.
7. The method of claim 6 , wherein based on creation of the VM, the switch receives a VSI discovery protocol (VDP) message, and the VDP message includes the VSI type ID, source media access control (MAC) address and the VLAN ID for the VM.
8. The method of claim 1 , wherein hardware resources for the access rules are proportional to a size of the second table.
9. The method of claim 1 , further comprising:
adding, by the switch, newly created VSI type IDs to the second table along with associated access rules.
10. The method of claim 1 , wherein:
retrieving the VSI type ID from the first table comprises performing a table look up (TLU) on the first table using the VSI type ID and VLAN ID as input, and outputting a source MAC address for the created VM; and
performing a TLU on the second table using output from the TLU on the first table including the source MAC address and the VSI type ID for the created VM as input, and outputting the associated rules for the created VM.