Scalable gateways for a fabric switch
View Patent ↗One embodiment of the present invention provides a switch. The switch includes a gateway subgroup module, a tunnel management module, and a packet processor. The gateway subgroup module operates the switch in conjunction with a remote switch to form a gateway subgroup. The switch and the remote switch actively operate as tunnel gateways. The tunnel management module maintains a data structure indicating whether a tunnel source subnet is associated with the gateway subgroup. The packet processor decapsulates a tunnel-encapsulated packet in response to a tunnel source subnet of the tunnel-encapsulated packet being associated with the gateway subgroup.
1. A method, comprising:
maintaining a data structure comprising a first mapping between a first tunnel source subnet and a first gateway subgroup, wherein a respective member of a gateway subgroup actively operates as a tunnel gateway;
determining whether the first tunnel source subnet is associated with a tunnel-encapsulated packet based on the first mapping;
in response to determining that the first tunnel source subnet is associated with the tunnel-encapsulated packet, decapsulating a tunnel header of the tunnel-encapsulated packet; and
in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet, refraining from decapsulating the tunnel header of the tunnel-encapsulated packet.
2. The method of claim 1 , further comprising, in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet:
identifying a second tunnel source subnet associated with the tunnel-encapsulated packet; and
determining, based on a second mapping in the data structure, a second gateway subgroup mapped to the second tunnel source subnet.
3. The method of claim 2 , further comprising determining an egress port corresponding to a gateway switch, wherein the gateway switch is in the second gateway subgroup.
4. The method of claim 1 , wherein with a destination identifier of the tunnel header is a first virtual gateway identifier of a first virtual switch, and wherein first virtual gateway identifier comprises one or more of: a virtual IP address and a virtual MAC address.
5. The method of claim 4 , wherein the virtual gateway identifier is associated with the first gateway subgroup and a second gateway subgroup.
6. The method of claim 4 , wherein the first gateway subgroup is represented as a second virtual switch distinct from the first virtual switch, and wherein the second virtual switch is associated with a second virtual gateway identifier distinct from the first virtual gateway identifier.
7. The method of claim 1 , wherein an inner packet of the tunnel-encapsulated packet is a multi-destination packet; and
wherein the method further comprises, in response to decapsulating the tunnel header:
determining whether a local switch is the designated forwarder of the first gateway subgroup; and
in response to determining that the local switch is the designated forwarder, determining one or more ports of the local switch as egress ports for the inner packet.
8. The method of claim 7 , wherein the one or more ports include one or more of:
an edge port coupling a destination of the inner packet; and
an inter-switch port associated with a distribution tree associated with the inner packet.
9. The method of claim 1 , further comprising suppressing forwarding via local edge ports in response to receiving the tunnel-encapsulated packet within a same gateway instance, wherein a gateway instance represents a gateway, and wherein a gateway instance includes one or more gateway subgroups.
10. The method of claim 9 , further comprising determining one or more local edge ports as egress ports for an inner packet of the tunnel-encapsulated packet in response to not receiving the tunnel-encapsulated packet within the same gateway instance, wherein the inner packet is a multi-destination packet, and wherein a local switch is a designated switch for the gateway instance.
11. A switch, comprising:
tunnel management circuitry configured to maintain a data structure comprising a first mapping between a first tunnel source subnet and a first gateway subgroup, wherein a respective member of a gateway subgroup actively operates as a tunnel gateway;
packet processing circuitry configured to:
determine whether the first tunnel source subnet is associated with a tunnel-encapsulated packet based on the first mapping;
in response to determining that the first tunnel source subnet is associated with the tunnel-encapsulated packet, decapsulate a tunnel header of the tunnel-encapsulated packet; and
in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet, refrain from decapsulating the tunnel header of the tunnel-encapsulated packet.
12. The switch of claim 11 , wherein the packet processing circuitry is further configured to, in response to determining that the first tunnel source subnet is not associated with the tunnel-encapsulated packet:
identify a second tunnel source subnet associated with the tunnel-encapsulated packet; and
determine, based on a second mapping in the data structure, a second gateway subgroup mapped to the second tunnel source subnet.
13. The switch of claim 12 , wherein the packet processing circuitry is further configured to determine an egress port corresponding to a gateway switch, wherein the gateway switch is in the second gateway subgroup.
14. The switch of claim 11 , wherein with a destination identifier of the tunnel header is a first virtual gateway identifier of a first virtual switch, and wherein first virtual gateway identifier comprises one or more of: a virtual IP address and a virtual MAC address.
15. The switch of claim 14 , wherein the virtual gateway identifier is associated with the first gateway subgroup and a second gateway subgroup.
16. The switch of claim 14 , wherein the first gateway subgroup is represented as a second virtual switch distinct from the first virtual switch, and wherein the second virtual switch is associated with a second virtual gateway identifier distinct from the first virtual gateway identifier.
17. The switch of claim 11 , wherein an inner packet of the tunnel-encapsulated packet is a multi-destination packet; and
wherein the switch further comprises multi-destination management circuitry configured to, in response to decapsulating the tunnel header:
determine whether a local switch is the designated forwarder of the first gateway subgroup; and
in response to determining that the local switch is the designated forwarder, determine one or more ports of the local switch as egress ports for the inner packet.
18. The switch of claim 17 , wherein the one or more ports include one or more of:
an edge port coupling a destination of the inner packet; and
an inter-switch port associated with a distribution tree associated with the inner packet.
19. The switch of claim 11 , wherein the switch further comprises multi-destination management circuitry configured to suppress forwarding via local edge ports in response to receiving the tunnel-encapsulated packet within a same gateway instance, wherein a gateway instance represents a gateway, and wherein a gateway instance includes one or more gateway subgroups.
20. The switch of claim 19 , wherein the multi-destination management circuitry is further configured to determine one or more local edge ports as egress ports for an inner packet of the tunnel-encapsulated packet in response to not receiving the tunnel-encapsulated packet within the same gateway instance, wherein the inner packet is a multi-destination packet, and wherein a local switch is a designated switch for the gateway instance.