ASIC for routing a packet
The techniques described herein include isolating network traffic between tenants using a programmable switch that routes network traffic directly to the appropriate virtual private cloud (VPC) and/or virtual machine (VM).
1. A switch comprising:
a port that is configured to send and receive network traffic comprising packets;
an application-specific integrated circuit (ASIC);
a memory storing a set of instructions that, when executed, cause the ASIC to:
receive a packet via the port;
determine to forward the packet via a first path instead of a second path, wherein the first path comprises forwarding the packet to at least one of a virtual private cloud (VPC) or a virtual machine (VM) host, and wherein the second path comprises forwarding the packet to a gateway; and
forward the packet via the first path;
wherein the memory further stores a connection table and wherein determining to forward the packet via the first path comprises:
determining that the packet includes a virtual local area network (VLAN) tag and a destination IP address that match an entry in the connection table;
identifying, from the connection table and based at least in part on at least one of the VLAN tag or the destination IP address, a virtual extensible local area network (VxLAN) network identifier (VNI) associated with the VPC to which the packet is destined; and
identifying, from the connection table and based at least in part on the destination IP address, a VxLAN tunnel endpoint (VTEP) address associated with the VM host to which the packet is destined.
2. The switch of claim 1 , wherein forwarding the packet via the first path comprises bypassing the gateway.
3. The switch of claim 1 , wherein determining to forward the packet via the first path is based at least in part on a connection table and wherein the memory further stores the connection table, the connection table comprising:
a first entry corresponding to a first active connection between a first customer equipment and a first VPC; and
a second entry corresponding to a second active connection between a second customer equipment and a second VPC.
4. The switch of claim 1 , wherein forwarding the packet via the first path comprises encapsulating the packet in a VxLAN frame and forwarding it to at least one of a VPC router or the VM host.
5. The switch of claim 1 , wherein:
the switch is deployed as part of an edge of a network architecture, and
upstream network traffic received at the port comprises an Internet layer protocol.
6. The switch of claim 1 , wherein the instructions further cause the ASIC to:
receive, at the port and from the VPC, an egress packet;
identify, based at least in part on a virtual extensible local area network (VxLAN) network identifier (VNI) associated with the egress packet and a connection table stored in the memory, at least one of a virtual local area network (VLAN) tag or a next hop identifier;
forward, based at least in part on the VLAN tag and towards customer equipment, the egress packet.
7. A non-transitory computer-readable medium having a connection table and a set of instructions that, when executed, cause an application-specific circuit (ASIC) associated with a network switch to:
determine that a first virtual local area network (VLAN) tag and a destination address match at least part of an entry of the connection table, wherein a first ingress packet includes the first VLAN tag and wherein the first destination address is associated with a first virtual machine (VM) instance for which the ingress packet is destined;
identify, based at least in part on the entry, at least one of a first virtual extensible local area network (VxLAN) network identifier (VNI) or a first VxLAN tunnel endpoint (VTEP) address;
encapsulate, as a first encapsulated packet, the first ingress packet, based at least in part on at least one of the first VNI or the first VTEP address;
forward the first encapsulated packet to at least one of a first virtual private cloud (VPC) router or the first VM instance;
determine that a second VLAN tag and a second destination second ingress packet do not match any entries in the connection table;
identify, from the second ingress packet, a subnet identifier;
encapsulate, as a second encapsulated packet and based at least in part on at least one of a global VNI or a gateway address associated with the subnet identifier, the second ingress packet; and
forward the second encapsulated packet to a network gateway.
8. The non-transitory computer-readable medium of claim 7 , wherein the instructions further cause the ASIC to:
determine that a VNI associated with a first egress packet matches a second entry in the connection table; and
forward the egress packet to customer equipment, based at least in part on at least one of a third VLAN tag or a next hop identifier associated with the second entry.
9. The non-transitory computer-readable medium of claim 7 , wherein the instructions further cause the ASIC to:
determine that a VNI associated with a second egress packet does not match any entries in the connection table; and
at least one of forward the second egress packet to a network gateway or discard the second egress packet.
10. The non-transitory computer-readable medium of claim 7 , wherein the connection table comprises:
a first entry corresponding to a first active connection between a first customer equipment and a first VPC; and
a second entry corresponding to a second active connection between a second customer equipment and a second VPC.
11. The non-transitory computer-readable medium of claim 7 , wherein the non-transitory computer-readable medium comprises a cache associated with the switch.