Management of endpoint address discovery in a software defined networking environment
Described herein are systems and methods to manage Internet Protocol (IP) address discovery in a software defined networking (SDN) environment. In one example, a manager may generate an IP address discovery configuration and pass the IP address discovery configuration to a controller. Once received, the controller may obtain a discovered list from a hypervisor of one or more IP addresses associated with one or more logical ports and update a realized list for the one or more logical ports based on the discovered list and the IP address discovery configuration.
1. A method of managing Internet Protocol (IP) address discovery in a software defined network (SDN) environment, the method comprising:
in a management plane of the SDN environment, generating an IP address discovery configuration;
in the management plane, passing the IP address discovery configuration to the control plane;
in the control plane, obtaining a discovered list from a hypervisor of one or more IP addresses associated with one or more logical ports, wherein the discovered list comprises an aggregated address list from two or more sources, and wherein the one or more IP addresses correspond to one or more overlay network addresses associated with one or more virtual nodes coupled to the one or more logical ports; and
in the control plane, updating one or more realized lists for the one or more logical ports based on the discovered list and the IP address discovery configuration.
2. The method of claim 1 further comprising:
in the hypervisor, discovering a first set of one or more IP addresses associated with the one or more logical ports based on data traffic for the one or more logical ports;
in the hypervisor, aggregating the first set of one or more IP addresses into the discovered list for the one or more logical ports; and
in the hypervisor, passing the discovered list to the control plane.
3. The method of claim 2 , wherein the data traffic comprises Address Resolution Protocol (ARP) traffic, Dynamic Host Configuration Protocol (DHCP) traffic, or Neighbor Discovery Protocol traffic.
4. The method of claim 2 , wherein discovering the first set of one or more IP addresses associated with the one or more logical ports is further based on addressing information provided by one or more agents in virtual nodes coupled to the one or more logical ports.
5. The method of claim 1 , wherein the IP address discovery configuration comprises at least security controls associated with limiting IP address bindings to logical ports in the SDN environment.
6. The method of claim 5 , wherein the security controls comprise parameters for Trust on Every Use (TOEU), Trust on First Use (TOFU), and/or IP binding limits for the logical ports.
7. The method of claim 1 , wherein the IP address discovery configuration comprises one or more manual IP address bindings to at least one logical port of the one or more logical ports.
8. The method of claim 1 , wherein the IP address discovery configuration indicates whether any manual IP address bindings take precedence over discovered IP address bindings.
9. The method of claim 1 , wherein updating one or more realized lists for the one or more logical ports is further based on one or more blacklists or one or more duplicate address lists.
10. The method of claim 1 further comprising, in the control plane, reporting the one or more realized lists to one or more services.
11. A computing apparatus comprising:
a storage system;
a processing system operatively coupled to the storage system; and
program instructions stored on the storage system to manage Internet Protocol (IP) address discovery in a software defined network (SDN) environment that, when executed by the processing system, direct the processing system to:
in a control plane for the SDN environment, obtain an IP address discovery configuration;
in a hypervisor of the SDN environment, discover a first set of one or more IP addresses associated with one or more logical ports from two or more sources;
in the hypervisor, aggregate the first set of one or more IP addresses into a discovered list for the one or more logical ports;
in the hypervisor, pass the discovered list to the control plane;
in the control plane, update one or more realized lists for the one or more logical ports based on the discovered list and the IP address discovery configuration.
12. The computing apparatus of claim 11 , wherein the two or more sources comprise one or more protocols and/or addressing information provided by one or more agents in virtual nodes coupled to the one or more logical ports.
13. The computing apparatus of claim 12 , wherein the two or more sources comprise Address Resolution Protocol (ARP) traffic, Dynamic Host Configuration Protocol (DHCP) traffic, or Neighbor Discovery Protocol traffic.
14. The computing apparatus of claim 11 , wherein the IP address discovery configuration comprises at least security controls associated with limiting IP address bindings to logical ports in the SDN environment.
15. The computing apparatus of claim 14 , wherein the security controls comprise parameters for Trust on Every Use (TOEU), Trust on First Use (TOFU), and/or IP binding limits for the logical ports.
16. The computing apparatus of claim 11 , wherein the IP address discovery configuration comprises one or more manual IP address bindings to at least one logical port of the one or more logical ports.
17. The computing apparatus of claim 11 , wherein the IP address discovery configuration indicates whether any manual IP address bindings take precedence over discovered IP address bindings.
18. The computing apparatus of claim 11 , wherein updating one or more realized lists for the one or more logical ports is further based on one or more blacklists or one or more duplicate address lists.
19. The computing apparatus of claim 11 , wherein the program instructions further direct the processing system to, in the control plane, report the one or more realized lists to one or more services, wherein the one or more services comprise at least a firewall service.
20. A method comprising:
in a control plane for a software defined networking (SDN) environment:
obtaining an IP address discovery configuration;
in a hypervisor of the SDN environment, discovering a first set of one or more IP addresses associated with one or more logical ports from two or more sources;
in the hypervisor, aggregating the first set of one or more IP addresses into a discovered list for the one or more logical ports;
in the hypervisor, passing the discovered list to the control plane;
in the control plane, updating one or more realized lists for the one or more logical ports based on the discovered list and the IP address discovery configuration.