Building a platform to scale control and data plane for virtual network functions
The present disclosure provides an approach for scaling the number of VNFs in a data center without scaling the number of control sessions between VNFs and a data center gateway. The approach includes opening a session between a VNF and a route server, rather than between the VNF and the gateway, when the VNF needs to send its connectivity information to the gateway. The VNF sends its connectivity information to the route server, and the route server forwards the connectivity information to the gateway. The gateway receives connectivity information of a plurality of VNFs in the data center from the route server rather than from each of the VNFs individually. The connectivity information is then used to send packets, by the gateway to a VNF, for processing. The packets are sent using three layers of networking: an underlay physical network, an overlay logical network, and a second overlay logical network.
1. A method of processing a packet, the method comprising:
establishing, by a plurality of virtual network functions (VNFs), a plurality of control plane sessions comprising a separate control plane session between a route server and each of the plurality of VNFs;
receiving, by the route server, VNF connectivity information from the plurality of virtual network functions (VNFs) via the plurality of control plane sessions;
transmitting, by the route server, the VNF connectivity information of the plurality of VNFs to a gateway of a data center via a single control plane session, wherein the route server has established the single control plane session with the gateway;
receiving a packet from a first device, the packet comprising a first header and a payload, the first header comprising a source address comprising an address of the first device in a virtual tenant network and a destination address comprising an address of a second device in the virtual tenant network;
based on the VNF connectivity information indicating at least one of the address of the first device and the address of the second device is associated with a VNF of the plurality of VNFs, determining that the VNF is assigned to process the packet;
based on the VNF connectivity information, adding a second header to the packet, the second header indicating:
a second destination address comprising an address of the VNF in a second network that uses different addressing than the virtual tenant network; and
a second source address comprising an address of a tunneling service of the gateway in the second network;
determining a host on which the VNF is executing;
adding a third header to the packet, the third header indicating:
a third destination address comprising an address of the host in a third network that uses different addressing than the virtual tenant network and the second network; and
a third source address comprising an address of the gateway in the third network;
transmitting the packet to the host, wherein the gateway routes the packet between the first device and the host; and
processing the packet by the VNF.
2. The method of claim 1 , the method further comprising, subsequent to the transmitting of the packet to the host:
receiving the packet by a virtual switch of the host;
removing the third header at the host; and
based on the second header, transmitting by the virtual switch the packet to the VNF.
3. The method of claim 1 , the method further comprising:
based on the first header, determining by the VNF one or more processing rules; and
performing the processing of the packet according to the one or more processing rules.
4. The method of claim 1 , wherein the VNF connectivity information is transmitted to the route server by the plurality of VNFs using a gateway protocol, wherein the gateway protocol is one of border gateway protocol (BGP) or multiprotocol-BGP (MP-BGP).
5. The method of claim 1 , wherein the processing of the packet by the VNF comprises at least one of: firewall filtering, parental control filtering, accounting, load balancing, routing, forwarding, network address translation, or intrusion detection or prevention.
6. The method of claim 1 , wherein the gateway is a physical device.
7. The method of claim 1 , wherein:
the third network comprises an underlay physical network;
the second network comprises a first overlay logical network;
the virtual tenant network comprises a second overlay logical network; and
the first overlay logical network services as a logical underlay network for the second overlay logical network.
8. A non-transitory computer readable medium comprising instructions to be executed by one or more processors of a computer system, the instructions when executed by the one or more processors cause the computer system to carry out a method of processing a packet, the method comprising:
establishing, by a plurality of virtual network functions (VNFs), a plurality of control plane sessions comprising a separate control plane session between a route server and each of the plurality of VNFs;
receiving, by the route server, VNF connectivity information from the plurality of virtual network functions (VNFs) via the plurality of control plane sessions;
transmitting, by the route server, the VNF connectivity information of the plurality of VNFs to a gateway of a data center via a single control plane session, wherein the route server has established the single control plane session with the gateway;
receiving a packet from a first device, the packet comprising a first header and a payload, the first header comprising a source address comprising an address of the first device in a virtual tenant network and a destination address comprising an address of a second device in the virtual tenant network;
based on the VNF connectivity information indicating at least one of the address of the first device and the address of the second device is associated with a VNF of the plurality of VNFs, determining that the VNF is assigned to process the packet;
based on the VNF connectivity information, adding a second header to the packet, the second header indicating:
a second destination address comprising an address of the VNF in a second network that uses different addressing than the virtual tenant network; and
a second source address comprising an address of a tunneling service of the gateway in the second network;
determining a host on which the VNF is executing;
adding a third header to the packet, the third header indicating:
a third destination address comprising an address of the host in a third network that uses different addressing than the virtual tenant network and the second network; and
a third source address comprising an address of the gateway in the third network;
transmitting the packet to the host, wherein the gateway routes the packet between the first device and the host; and
processing the packet by the VNF.
9. The non-transitory computer readable medium of claim 8 , the method further comprising, subsequent to the transmitting of the packet to the host:
receiving the packet by a virtual switch of the host;
removing the third header at the host; and
based on the second header, transmitting by the virtual switch the packet to the VNF.
10. The non-transitory computer readable medium of claim 8 , the method further comprising:
based on the first header, determining by the VNF one or more processing rules; and
performing the processing of the packet according to the one or more processing rules.
11. The non-transitory computer readable medium of claim 8 , wherein the VNF connectivity information is transmitted to the route server by the plurality of VNFs using a gateway protocol, wherein the gateway protocol is one of border gateway protocol (BGP) or multiprotocol-BGP (MP-BGP).
12. The non-transitory computer readable medium of claim 8 , wherein the processing of the packet by the VNF comprises at least one of: firewall filtering, parental control filtering, accounting, load balancing, routing, forwarding, network address translation, or intrusion detection or prevention.
13. The non-transitory computer readable medium of claim 8 , wherein the gateway is a physical device.
14. A computer system comprising:
one or more processors, wherein the one or more processors are configured to carry out a method of processing a packet, the method comprising:
establishing, by a plurality of virtual network functions (VNFs), a plurality of control plane sessions comprising a separate control plane session between a route server and each of the plurality of VNFs;
receiving, by the route server, VNF connectivity information from the plurality of virtual network functions (VNFs) via the plurality of control plane sessions;
transmitting, by the route server, the VNF connectivity information of the plurality of VNFs to a gateway of a data center via a single control plane session, wherein the route server has established the single control plane session with the gateway;
receiving a packet from a first device, the packet comprising a first header and a payload, the first header comprising a source address comprising an address of the first device in a virtual tenant network and a destination address comprising an address of a second device in the virtual tenant network;
based on the VNF connectivity information indicating at least one of the address of the first device and the address of the second device is associated with a VNF of the plurality of VNFs, determining that the VNF is assigned to process the packet;
based on the VNF connectivity information, adding a second header to the packet, the second header indicating:
a second destination address comprising an address of the VNF in a second network that uses different addressing than the virtual tenant network; and
a second source address comprising an address of a tunneling service of the gateway in the second network;
determining a host on which the VNF is executing;
adding a third header to the packet, the third header indicating:
a third destination address comprising an address of the host in a third network that uses different addressing than the virtual tenant network and the second network; and
a third source address comprising an address of the gateway in the third network;
transmitting the packet to the host, wherein the gateway routes the packet between the first device and the host; and
processing the packet by the VNF.
15. The computer system of claim 14 , the method further comprising, subsequent to the transmitting of the packet to the host:
receiving the packet by a virtual switch of the host;
removing the third header at the host; and
based on the second header, transmitting by the virtual switch the packet to the VNF.