Engines to prune overlay network traffic
An example system in accordance with an aspect of the present disclosure includes an inspection engine and a forwarding engine. The inspection engine is to identify whether a tunneled network packet is associated with the multicast group address and a VNI that is contained in the mapping table. The forwarding engine is to forward or discard the packet in response to whether the VNI is contained in the mapping table.
1. A network device comprising:
a mapping table, to contain a mapping between an underlay network multicast group address and at least one virtual network identifier (VNI) corresponding to an overlay network;
an inspection engine to identify whether a tunneled network packet received at the network device is associated with the multicast group address and a VNI that is contained in the mapping table; and
a forwarding engine to forward the packet according to the multicast group address in response to the VNI being contained in the mapping table, and to discard the packet in response to the VNI not being contained in the mapping table.
2. The network device of claim 1 , wherein the inspection engine is to receive, from a tenant address, a multicast group membership report including at least one VNI, and the network device is to extract the at least one VNI from the membership report, and incorporate the at least one VNI into the mapping table based on mapping the at least one VNI and tenant address to the multicast group address.
3. The network device of claim 2 , wherein the network device is to construct a multicast distribution tree corresponding to the at least one VNI.
4. The network device of claim 2 , wherein the membership report is based on at least one of the IGMP and MLD protocols.
5. The network device of claim 2 , wherein the network device is to include, in a multicast group membership report, a VNI flag, an indication of the number of VNIs in the multicast group membership report, and a field to contain the at least one VNI and corresponding at least one tenant address.
6. The network device of claim 1 , wherein the network device is to, in response to receiving a group membership leave indication from a tenant address, update the mapping table to remove the tenant address and VNI mapping corresponding to the group membership leave indication.
7. The network device of claim 1 , wherein the inspection engine is to check for the VNI in a virtual local area network (VxLAN) encapsulation header.
8. The network device of claim 1 , wherein the network device is to, in response to receiving broadcast-unicast-multicast (BUM) traffic from a tenant address associated with the VNI, encapsulate the frame and embed the VNI into the frame of the BUM traffic to be sent to the multicast group address.
9. A method comprising:
identifying, by an inspection engine, whether a tunneled network packet is associated with a multicast group address and a VNI that is contained in a mapping table, wherein the mapping table is to contain a mapping between an underlay network multicast group address and at least one virtual network identifier (VNI) corresponding to an overlay network;
forwarding, by a forwarding engine, the packet according to the multicast group address in response to the VNI being contained in the mapping table; and
discarding, by the forwarding engine, the packet in response to the VNI not being contained in the mapping table.
10. The method of claim 9 , comprising:
receiving, from a tenant address, a multicast group membership report including at least one VNI;
extracting the at least one VNI from the membership report; and
incorporating the at least one VNI into the mapping table based on mapping the at least one VNI and tenant address to the multicast group address.
11. The method of claim 9 , comprising constructing a multicast distribution tree corresponding to the at least one VNI.
12. The method of claim 9 , wherein the membership report is based on at least one of the IGMP and MLD protocols.
13. The method of claim 9 , further comprising providing a notification in response to the VNI not being contained in the mapping table, wherein the notification is based on at least one of i) logging an incident, and ii) providing an indication to an administrator regarding network traffic.
14. The method of claim 9 , wherein a device that is to host at least one tenant is at least one of a virtual switch (vswitch) and a physical switch (pswitch).
15. A non-transitory machine-readable storage medium encoded with instructions, executable by a computing system to prune overlay network traffic, that when executed cause the computing system to:
identify, by an inspection engine, whether a tunneled network packet is associated with a multicast group address and a VNI that is contained in a mapping table, wherein the mapping table is to contain a mapping between an underlay network multicast group address and at least one virtual network identifier (VNI) and associated at least one tenant address corresponding to an overlay network;
forward, by a forwarding engine, the packet according to the multicast group address in response to the VNI being contained in the mapping table; and
discard, by the forwarding engine, the packet in response to the VNI not being contained in the mapping table.
16. The non-transitory storage medium of claim 15 , further comprising instructions that cause the computing system to construct the multicast distribution tree.
17. The non-transitory storage medium of claim 15 , further comprising instructions that cause the computing system to extract the at least one VNI from the membership report, and incorporate the at least one VNI into the mapping table based on mapping the at least one VNI and corresponding at least one tenant address to the multicast group address.
18. The non-transitory storage medium of claim 15 , further comprising instructions that cause the computing system to:
receive a group membership leave indication from a tenant address; and
update the mapping table to remove the tenant address and VNI mapping corresponding to the group membership leave indication.
19. The non-transitory storage medium of claim 15 , further comprising instructions that cause the computing system to check for the VNI in a virtual local area network (VxLAN) encapsulation header.
20. The non-transitory storage medium of claim 15 , further comprising instructions that cause the computing system to:
receive broadcast-unicast-multicast (BUM) traffic from a tenant address associated with the VNI;
encapsulate the frame; and
embed the VNI into the frame of the BUM traffic to be sent to the multicast group address.