Inband group-based network policy using SRV6
The present technology pertains to a group-based network policy using Segment Routing over an IPv6 dataplane (SRv6). After a source application sends a packet, an ingress node can receive the packet, and if the source node is capable, it can identify an application policy and apply it. The ingress node indicates that the policy has been applied by including policy bits in the packet encapsulation. When the packet is received by the egress node, it can determine whether the policy was already applied, and if so, the packet is forward to the destination application. If the egress node determines that the policy has not be applied the destination application can apply the policy. Both the ingress node and egress nodes can learn of source application groups, destination application groups, and applicable policies through communication with aspects of the segment routing fabric.
1. A method comprising:
first receiving, at an ingress node, a first data packet;
second receiving, after receiving the first data packet, a source application group for the first data packet;
determining, in response to the second receiving, whether the ingress node is configured to apply network policies;
in response to a determination that the ingress node is configured to apply network policies:
third receiving, by the ingress node, a destination application group for a destination application and a network policy;
applying the network policy;
dropping the first data packet in response to the network policy having a drop action; and
adding a Segment Routing over an IPv6 dataplane (SRv6) encapsulation to the first data packet in response to the network policy lacking a drop action.
2. The method of claim 1 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
3. The method of claim 1 , further comprising:
adding a SRv6 encapsulation to the first data packet in response to a determination that the ingress node is not configured to apply network policies.
4. The method of claim 3 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
5. The method of claim 1 , further comprising:
requesting, between the first and second receiving, the source application group for the first data packet from a fabric connectivity system; and
the second receiving comprising receiving a reply from the fabric connectivity system.
6. The method of claim 1 , further comprising:
encoding the source application group into the SRv6 encapsulation; and
transmitting, after the encoding, the first data packet to a fabric connectivity system.
7. The method of claim 3 , further comprising:
encoding the source application group into the SRv6 encapsulation; and
transmitting, after the encoding, the first data packet to a fabric connectivity system.
8. A non-transitory computer readable medium storing instructions which are programmed to cause a system including electronic computer hardware in combination with software to perform operations comprising:
first receiving, at an ingress node, a first data packet;
second receiving, after receiving the first data packet, a source application group for the first data packet;
determining, in response to the second receiving, whether the ingress node is configured to apply network policies;
in response to a determination that the ingress node is configured to apply network policies:
third receiving, by the ingress node, a destination application group for a destination application and a network policy;
applying the network policy;
dropping the first data packet in response to the network policy having a drop action; and
adding a Segment Routing over an Ipv6 dataplane (SRv6) encapsulation to the first data packet in response to the network policy lacking a drop action.
9. The non-transitory computer readable medium of claim 8 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
10. The non-transitory computer readable medium of claim 8 , the operations further comprising:
adding a SRv6 encapsulation to the first data packet in response to a determination that the ingress node is not configured to apply network policies.
11. The non-transitory computer readable medium of claim 10 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
12. The non-transitory computer readable medium of claim 8 , the operations further comprising:
requesting, between the first and second receiving, the source application group for the first data packet from a fabric connectivity system; and
the second receiving comprising receiving a reply from the fabric connectivity system.
13. The non-transitory computer readable medium of claim 8 , the operations further comprising:
encoding the source application group into the SRv6 encapsulation; and
transmitting, after the encoding, the first data packet to a fabric connectivity system.
14. The non-transitory computer readable medium of claim 10 , the operations further comprising:
encoding the source application group into the SRv6 encapsulation; and
transmitting, after the encoding, the first data packet to a fabric connectivity system.
15. A system, comprising:
a processor;
a non-transitory computer readable medium storing instructions which are programmed to cause the processor to perform operations comprising:
first receiving, at an ingress node, a first data packet;
second receiving, after receiving the first data packet, a source application group for the first data packet;
determining, in response to the second receiving, whether the ingress node is configured to apply network policies;
in response to a determination that the ingress node is configured to apply network policies:
third receiving, by the ingress node, a destination application group for a destination application and a network policy;
applying the network policy;
dropping the first data packet in response to the network policy having a drop action; and
adding a Segment Routing over an IPv6 dataplane (SRv6) encapsulation to the first data packet in response to the network policy lacking a drop action.
16. The system of claim 15 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
17. The system of claim 15 , the operations further comprising:
adding a SRv6 encapsulation to the first data packet in response to a determination that the ingress node is not configured to apply network policies.
18. The system of claim 17 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
19. The system of claim 15 , the operations further comprising:
requesting, between the first and second receiving, the source application group for the first data packet from a fabric connectivity system; and
the second receiving comprising receiving a reply from the fabric connectivity system.
20. The system of claim 15 , the operations further comprising:
encoding the source application group into the SRv6 encapsulation; and
transmitting, after the encoding, the first data packet to a fabric connectivity system.