Processing traffic in a virtualised environment
Traffic is processed in a virtualised environment comprising: (i) a physical underlay network; (ii) a first overlay network (an overlay of the physical underlay network and associated with a first set of network addresses, IP 1 ); (iii) a second overlay network (an overlay of the first overlay network and associated with a second set of network addresses, IP 2 ); and (iv) virtualised applications each having an execution environment and being associated with at least one network address in each of the first and second sets of network addresses, IP 1 and IP 2 . In the execution environment of a first virtualised application: (i) traffic communicated from the first virtualised application to the first overlay network is encapsulated; and/or (ii) traffic communicated from the first overlay network to the first virtualised application is decapsulated. Tenant separation processing is performed outside the execution environments of the virtualised applications.
1. A method of processing traffic in a virtualised environment, the virtualised environment comprising:
a physical underlay network;
a first overlay network, the first overlay network being an overlay of the physical underlay network and being associated with a first set of network addresses;
a second overlay network, the second overlay network being an overlay of the first overlay network and being associated with a second set of network addresses; and
a plurality of virtualised applications, each of the virtualised applications in the plurality of virtualised applications having an execution environment and being associated with at least one network address in the first set of network addresses and at least one network address in the second set of network addresses,
the method comprising performing, in the execution environment of a first virtualised application in the plurality of virtualised applications, encapsulation of traffic communicated from the first virtualised application to the first overlay network and/or decapsulation of traffic communicated from the first overlay network to the first virtualised application, wherein the execution environment of the first virtualised application comprises the first virtualised application and a networking component, and wherein said encapsulation and/or decapsulation is performed by the networking component, and
wherein tenant separation processing is performed outside the execution environments of the plurality of virtualised applications.
2. The method of claim 1 , wherein the tenant separation processing is performed in the physical underlay network and/or is performed by a hypervisor.
3. The method of claim 1 , wherein the tenant separation processing is performed using Virtual Local Area Network, VLAN, tags and/or at least one Access Control List, ACL.
4. The method of claim 1 , wherein:
said encapsulation and/or decapsulation comprises Virtual Extensible Local Area Network, VXLAN, encapsulation and/or decapsulation; and/or
the other component is packaged in the execution environment of the first virtual application as a Data Plane Development Kit, DPDK, module.
5. The method of claim 1 , wherein:
the first virtualised application is associated with:
a first network address in the first set of network addresses; and
first and second network addresses in the second set of network addresses; and
a second virtualised application in the plurality of virtualised applications is associated with:
a second network address in the first set of network addresses;
the first network address in the second set of network addresses; and
a third network address in the second set of network addresses.
6. The method of claim 5 , wherein the first set of network addresses comprises first and second subsets of network addresses associated with first and second clouds respectively, wherein the first network address in the first set of network addresses is associated with the first cloud, and wherein the second network address in the first set of network addresses is associated with the second cloud.
7. The method of claim 5 , wherein the first network address in the second set of network addresses is a virtual IP address.
8. The method of claim 5 , wherein the first virtualised application serves as a primary virtualised application for a Virtualised Network Function, VNF, and the second virtualised application serves as a backup virtualised application for the VNF.
9. The method of claim 5 , comprising:
receiving, at a third virtualised application in the plurality of virtualised applications, traffic directed to the first network address in the second set of network addresses;
determining, by the third virtualised application, whether the second or third network address in the second set of network addresses is currently associated with the first network address in the second set of network addresses; and
transmitting, by the third virtualised application and via the first overlay network:
encapsulated data comprising the received traffic to the first virtualised application using the first network address in the first set of network addresses in response to determining that the second network address in the second set of network addresses is currently associated with the first network address in the second set of network addresses; or
encapsulated data comprising the received traffic to the second virtualised application using the second network address in the first set of network addresses in response to determining that the third network address in the second set of network addresses is currently associated with the first network address in the second set of network addresses.
10. The method of claim 9 , wherein the traffic is received from an application having a network address associated with a network different from the first and second overlay networks.
11. The method of claim 10 , wherein the application is a non-virtualised application.
12. The method of claim 9 , wherein the third virtualised application provides gateway functionality.
13. The method of claim 1 , wherein a given virtualised application of the plurality of virtualised applications communicates traffic with the first overlay network without said encapsulation and/or decapsulation being performed within the execution environment of the given virtualisation application.
14. The method of claim 1 , wherein at least one of the plurality of virtualised applications provides telephony network element functionality.
15. The method of claim 14 , wherein the telephony network element functionality comprises:
Session Border Controller, SBC, functionality;
Telephony Application Server, TAS, functionality;
cellular network core functionality; and/or
application server, AS, functionality.
16. A virtualised environment configured to perform the method of claim 1 .
17. A method of processing traffic in a virtualised environment, the virtualised environment comprising a physical underlay, an overlay network, and a virtualised application, wherein the physical underlay and/or the overlay network comprises a security element configured to provide tenant separation processing, the method comprising:
receiving encapsulated traffic from the overlay network, the encapsulated traffic having been subject to tenant separation processing by the security element;
decapsulating the received traffic; and
providing the decapsulated traffic to the virtualised application,
wherein the method is performed by a networking component in the execution environment of the virtualised application, and
wherein the networking component is separate from the virtualised application.
18. A virtualised environment comprising: a physical underlay, an overlay network, and a plurality of virtualised applications,
wherein an execution environment of a first virtualised application of the plurality of virtualised applications comprises a networking component configured to perform one or both of:
(i) encapsulating traffic received from the first virtualised application and providing the encapsulated traffic to the overlay network; and
(ii) decapsulating encapsulated traffic received from the overlay network and providing the decapsulated traffic to the first virtualised application, and
wherein an execution environment of a second virtualised application of the plurality of virtualised applications is configured to perform one or both of:
(i) providing traffic received from the first virtualised application to the overlay network without performing said encapsulating; and
(ii) providing traffic received from the overlay network to the first virtualised application without performing said decapsulating.