Efficient implementation of complex network segmentation
In one embodiment, a network device includes an interface to receive packets from sources in a network for forwarding to destinations in the network, the sources and destinations being assigned to groups, each packet including a source and destination identifier, a memory configured to store a source-group mapping table that maps source identifiers to source-groups, a destination-group mapping table that maps destination identifiers to destination-groups, and an intergroup access-control list that maps source-destination-group pairs to forwarding rules, and a single IC chip configured, for each packet, to find a source-group for the source identifier in the source-group mapping table, find a destination-group for the destination identifier in the destination-group mapping table, find a forwarding rule for a source-destination pair including the found source and destination-group in the intergroup access-control list, and forward or drop the packet according to the found forwarding rule.
1. A network device comprising:
an interface configured to receive a plurality of packets from sources disposed in a network for forwarding to destinations disposed in the network, the sources and the destinations being assigned to a plurality of groups, each packet of the plurality of packets including a source identifier and a destination identifier;
a memory configured to store: a source-group mapping table that maps source identifiers to source-groups; a destination-group mapping table that maps destination identifiers to destination-groups; and an intergroup access-control list that maps source-destination-group pairs to forwarding rules; and
a single Integrated Circuit (IC) chip configured, for each packet received through the interface, to:
find a source-group for the source identifier in the source-group mapping table;
find a destination-group for the destination identifier in the destination-group mapping table;
find a forwarding rule for a source-destination pair including the found source-group and the found destination-group in the intergroup access-control list; and
forward the packet through the interface or drop the packet according to the found forwarding rule.
2. The device according to claim 1 , wherein the single IC chip is configured to manage a timing of operations so that for each packet, a first time period in which the source-group is found and a second time period in which the destination-group is found at least partially overlap.
3. The device according to claim 1 , wherein the intergroup access-control list allows bidirectional forwarding between two entities from different groups of the plurality of groups.
4. The device according to claim 1 , wherein the intergroup access-control list allows unidirectional forwarding between two entities from different groups of the plurality of groups.
5. The device according to claim 1 , wherein the network supports a multi-tenant infrastructure.
6. The device according to claim 1 , wherein the source identifier and the destination identifier are classified according to any one or more of the following: a virtual extensible local area network (VXLAN) network identifier, a media access control (MAC) address from an Ethernet header, an Internet Protocol (IP) address from an Internet Protocol version 4 header, an IP address from an Internet Protocol version 6 header, and a virtual local area network (VLAN) identify from an Ethernet header.
7. An access control method, comprising:
receiving a plurality of packets from sources disposed in a network for forwarding to destinations disposed in the network, the sources and the destinations being assigned to a plurality of groups, each packet of the plurality of packets including a source identifier and a destination identifier;
storing: a source-group mapping table that maps source identifiers to source-groups; a destination-group mapping table that maps destination identifiers to destination-groups; and an intergroup access-control list that maps source-destination-group pairs to forwarding rules; and
performing the following for each packet in a single Integrated Circuit (IC) chip:
finding a source-group for the source identifier in the source-group mapping table;
finding a destination-group for the destination identifier in the destination-group mapping table;
finding a forwarding rule for a source-destination pair including the found source-group and the found destination-group in the intergroup access-control list; and
forwarding or dropping the packet according to the found forwarding rule.
8. The method according to claim 7 , further comprising managing a timing of operations so that for each packet, a first time period in which the source-group is found and a second time period in which the destination-group is found at least partially overlap.
9. The method according to claim 7 , wherein the intergroup access-control list allows bidirectional forwarding between two entities from different groups of the plurality of groups.
10. The method according to claim 7 , wherein the intergroup access-control list allows unidirectional forwarding between two entities from different groups of the plurality of groups.
11. The method according to claim 7 , wherein the network supports a multi-tenant infrastructure.
12. The method according to claim 7 , wherein the source identifier and the destination identifier are classified according to any one or more of the following: a virtual extensible local area network (VXLAN) network identifier, a media access control (MAC) address from an Ethernet header, an Internet Protocol (IP) address from an Internet Protocol version 4 header, an IP address from an Internet Protocol version 6 header, and a virtual local area network (VLAN) identify from an Ethernet header.