Network control software notification with advance learning
Techniques are disclosed for notifying network control software of new and moved source MAC addresses. In one embodiment, a switch detects packets sent by a new or migrated virtual machine, and sends a copy of a detected packet to the network control software as a notification. The switch further learns the source MAC address, thereby permitting the entry to be used for normal forwarding prior to validation of the entry and the VM associated therewith by the network control software. Until the network control software has validated the VM, the switch may periodically retry the notification to the network control software. “No_Redirect” and “Not_Validated” flags may be used to indicate whether a notification has already been attempted and thus no retry is necessary, and that the VM associated with the VM has not yet been validated, respectively.
1. One or more non-transitory computer-readable media storing instructions that, when executed by a switch device, are configured to cause the switch device to perform an operation comprising:
identifying a source media access control (MAC) address in a first packet received on the switch device from a virtual machine that is new or migrated, wherein the virtual machine comprises a member of a virtual local area network (VLAN) domain;
upon determining (i) that a forwarding database entry in a forwarding database matches the source MAC address and (ii) that routing information in a port field of the forwarding database entry does not match an ingress port of the first packet, updating the routing information to match the ingress port of the first packet; wherein the switch device is configured to insert the source MAC address into the forwarding database upon no source MAC address match being found;
redirecting a copy of the first packet as a notification to a network control software to validate the virtual machine, wherein the switch device and the network control software are separate entities, wherein the network control software is notified of the source MAC address in advance of the virtual machine being validated and in order to preemptively enable communication between the virtual machine and other virtual machines;
updating the forwarding database by clearing a redirection flag and a validation flag of the forwarding database entry corresponding to the source MAC address, by operation of one or more computer processors of the switch device, wherein the cleared redirection flag indicates to disable any further notification relating to the virtual machine because the network control software has been notified of the virtual machine, wherein the cleared validation flag indicates that the network control software has not yet validated the virtual machine, wherein the redirection flag is periodically reset to true by an aging function that walks the forwarding database; and
performing one or more forwarding operations based on the updated forwarding database and in order to provide notification that is content-aware, wherein the one or more forwarding operations (i) prevent the VLAN domain from being flooded with notifications triggered by any packet directed to the same virtual machine, (ii) while still permitting packets received substantially concurrently from different virtual machines to be redirected as notifications to the network control software.
2. The one or more non-transitory computer-readable media of claim 1 , wherein the one or more forwarding operations include forwarding the first packet to a target MAC address indicated in the first packet.
3. The one or more non-transitory computer-readable media of claim 1 , wherein the aging function walks the forwarding database with a tunable walking latency configurable via setting a programmable delay timer.
4. The one or more non-transitory computer-readable media of claim 1 , wherein the one or more forwarding operations include:
determining that a received second packet has a source MAC address that matches the forwarding database entry corresponding to the source MAC address; and
forwarding the second packet to the network control software only if the redirection flag is set and the validation flag is clear.
5. The one or more non-transitory computer-readable media of claim 1 , wherein the network control software causes the validation flag to be set to true only upon successfully validating the virtual machine.
6. The one or more non-transitory computer-readable media of claim 1 , wherein the redirection and validation flags are fields in the forwarding database entry.
7. A system comprising:
a switch device, having one or more computer processors and memory, configured to execute a program to perform an operation comprising:
identifying a source media access control (MAC) address in a first packet received on the switch device from a virtual machine that is new or migrated, wherein the virtual machine comprises a member of a virtual local area network (VLAN) domain;
upon determining (i) that a forwarding database entry in a forwarding database matches the source MAC address and (ii) that routing information in a port field of the forwarding database entry does not match an ingress port of the first packet, updating the routing information to match the ingress port of the first packet; wherein the switch device is configured to insert the source MAC address into the forwarding database upon no source MAC address match being found;
redirecting a copy of the first packet as a notification to a network control software to validate the virtual machine, wherein the switch device and the network control software are separate entities, wherein the network control software is notified of the source MAC address in advance of the virtual machine being validated and in order to preemptively enable communication between the virtual machine and other virtual machines;
updating the forwarding database by clearing a redirection flag and a validation flag of the forwarding database entry corresponding to the source MAC address, wherein the cleared redirection flag indicates to disable any further notification relating to the virtual machine because the network control software has been notified of the virtual machine, wherein the cleared validation flag indicates that the network control software has not yet validated the virtual machine, wherein the redirection flag is periodically reset to true by an aging function that walks the forwarding database; and
performing one or more forwarding operations based on the updated forwarding database and in order to provide notification that is content-aware, wherein the one or more forwarding operations (i) prevent the VLAN domain from being flooded with notifications triggered by any packet directed to the same virtual machine, (ii) while still permitting packets received substantially concurrently from different virtual machines to be redirected as notifications to the network control software.
8. The system of claim 7 , wherein the aging function walks the forwarding database with a tunable walking latency configurable via setting a programmable delay timer.
9. The system of claim 7 , wherein the one or more forwarding operations include:
determining that a received second packet has a source MAC address that matches the forwarding database entry corresponding to the source MAC address; and
forwarding the second packet to the network control software only if the redirection flag is set and the validation flag is clear.
10. The system of claim 7 , wherein the one or more forwarding operations include forwarding the first packet to a target MAC address indicated in the first packet.
11. The system of claim 7 , wherein the redirection and validation flags are fields in the forwarding database entry.
12. A computer-implemented method comprising, by a switch device:
identifying a source media access control (MAC) address in a first packet received on the switch device from a virtual machine that is new or migrated, wherein the virtual machine comprises a member of a virtual local area network (VLAN) domain;
upon determining (i) that a forwarding database entry in a forwarding database matches the source MAC address and (ii) that routing information in a port field of the forwarding database entry does not match an ingress port of the first packet, updating the routing information to match the ingress port of the first packet; wherein the switch device is configured to insert the source MAC address into the forwarding database upon no source MAC address match being found;
redirecting a copy of the first packet as a notification to a network control software to validate the virtual machine, wherein the switch device and the network control software are separate entities, wherein the network control software is notified of the source MAC address in advance of the virtual machine being validated and in order to preemptively enable communication between the virtual machine and other virtual machines;
updating the forwarding database by operation of one or more computer processors of the switch device and by clearing a redirection flag and a validation flag of the forwarding database entry corresponding to the source MAC address, wherein the cleared redirection flag indicates to disable any further notification relating to the virtual machine because the network control software has been notified of the virtual machine, wherein the cleared validation flag indicates that the network control software has not yet validated the virtual machine, wherein the redirection flag is periodically reset to true by an aging function that walks the forwarding database; and
performing one or more forwarding operations based on the updated forwarding database and in order to provide notification that is content-aware, wherein the one or more forwarding operations (i) prevent the VLAN domain from being flooded with notifications triggered by any packet directed to the same virtual machine, (ii) while still permitting packets received substantially concurrently from different virtual machines to be redirected as notifications to the network control software.
13. The computer-implemented method of claim 12 , wherein the one or more forwarding operations include forwarding the first packet to a target MAC address indicated in the first packet.
14. The computer-implemented method of claim 12 , wherein the aging function walks the forwarding database with a tunable walking latency configurable via setting a programmable delay timer.
15. The computer-implemented method of claim 12 , wherein the one or more forwarding operations include:
determining that a received second packet has a source MAC address that matches the forwarding database entry corresponding to the source MAC address; and
forwarding the second packet to the network control software only if the redirection flag is set and the validation flag is clear.
16. The computer-implemented method of claim 12 , wherein the network control software causes the validation flag to be set to true only upon successfully validating the virtual machine.
17. The computer-implemented method of claim 12 , wherein the source MAC address corresponds to a virtual Ethernet interface on the virtual machine,
wherein the redirection and validation flags are fields in the forwarding database entry,
wherein the one or more forwarding operations include forwarding the first packet to a target MAC address indicated in the first packet and an associated port indicated in the first packet, as if the first packet had been received from an existing virtual machine comprising a virtual machine that is neither new nor migrated, and
wherein the aging function walks the forwarding database with a tunable walking latency configurable via setting a programmable delay timer.
18. The computer-implemented method of claim 17 , wherein only upon successfully validating the virtual machine, the network control software sets the validation flag to true,
wherein the network control software periodically polls the forwarding database in order to determine if the forwarding database entry corresponding to the source MAC address is still in use, and
wherein the network control software is configured to maintain a shadow copy of the forwarding database using contents of packets redirected by the switch device to the network control software.
19. The computer-implemented method of claim 18 , wherein the network control software is further configured to protect a network from unknown traffic by permitting only validated virtual machines to send traffic on the network, including adding an access control list (ACL) rule to block or discard received packets having the source MAC address of the first packet upon unsuccessful validation of the virtual machine, and
wherein the one or more forwarding operations further include:
determining that a received second packet has a source MAC address that matches the forwarding database entry corresponding to the source MAC address; and
forwarding the second packet to the network control software only if the redirection flag is set and the validation flag is clear.
20. The computer-implemented method of claim 19 , wherein the network control software performs a plurality of actions based on whether validation of the virtual machine is successful, the plurality of actions including moving one or more network, adding one or more security rules, adding one or more quality of service (QoS) rules, and adding one or more VLAN-based rules,
wherein the virtual machine is assigned a set of resources by a hypervisor configured to distribute physical resources of a computer system among a plurality of virtual machines including the virtual machine, and
wherein upon successfully validating the virtual machine, the network control software sets the redirection flag to true.