Fault tolerance for SDN gateways using network switches
A virtual network comprising virtual machines executing at a computing environment is implemented. A software defined networking (SDN) appliance is configured to provide a connection to computing resources via a virtual network of a virtual computing environment. The SDN appliance includes a network interface card that are operable to interact with multiple field-programmable gate array (FPGA) devices are configured to be a hardware acceleration device for processing data traffic, and the FPGA device is configured to ingress a packet to a dataflow on one port and egress the packet from a different port associated with a different dataflow.
1. A system for implementing policies in a software defined network (SDN) of a virtual computing environment, the system comprising:
one or more processors; and
a memory in communication with the one or more processors, the memory having computer-readable instructions stored thereupon that, when executed by the one or more processors, cause the system to perform operations comprising:
receiving, at an ingress port from a first of two network switches, a data packet addressed to an endpoint in a virtual network of the virtual computing environment, the virtual computing environment comprising two SDN appliances communicatively coupled to the two network switches, the two SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment, the SDN appliances comprising a plurality of flexible network interface cards configured to be elastically attached and detached from a network interface card (NIC) associated with a VM running on a host;
forwarding, by the first network switch, the data packet to a first of the two SDN appliances;
mapping, by the first SDN appliance, a policy associated with the endpoint based on the virtual network associated with the data packet;
applying, by the first SDN appliance, the policy to the data packet; wherein the policy is dynamically adjustable based on the endpoint;
determining that a corresponding egress port on the first network switch is not accessible; and
in response to determining that a corresponding egress port on the first network switch is not accessible, forwarding, via a second egress port on a second of the network switches, the data packet to the endpoint via the flexible network interface cards;
wherein the data packet is forwarded via the second egress port of the second network switch using current TCP flow states for the data packet, thereby enabling the data packet to be forwarded via the second egress port of the second network switch.
2. The system of claim 1 , wherein the current flow states comprise a Transmission Control Protocol (TCP) flow state and locality.
3. The system of claim 1 , wherein hashing, layered hashing, or portchannel-based hashing is used to enable switching between ports.
4. The system of claim 3 , further comprising implementing equal-cost multi-path (ECMP) routing.
5. The system of claim 1 , wherein the first port is part of a first bank of ports and the second port is part of a second bank of ports.
6. The system of claim 1 , wherein failed ports that become operational are reinstated in a staggered fashion.
7. A method for implementing policies in a software defined network (SDN) of a virtual computing environment comprising two SDN appliances communicatively coupled to two network switches, the two SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment and from the two network switches, the method comprising:
receiving, at an ingress port from a first of the two network switches, a data packet addressed to an endpoint in a virtual network of the virtual computing environment;
forwarding, by the first network switch, the data packet to a first of the two SDN appliances, the SDN appliances comprising a plurality of flexible network interface cards configured to be elastically attached and detached from a network interface card (NIC) associated with a VM running on a host;
mapping, by the first SDN appliance, a policy associated with the endpoint based on the virtual network associated with the data packet;
applying, by the first SDN appliance, the policy to the data packet; wherein the policy is dynamically adjustable based on the endpoint;
determining that a corresponding egress port on the first network switch is not accessible; and
in response to determining that a corresponding egress port on the first network switch is not accessible, forwarding, via a second egress port on a second of the network switches, the data packet to the endpoint via the flexible network interface cards;
wherein the data packet is forwarded via the second egress port of the second network switch using current TCP flow states for the data packet, thereby enabling the data packet to be forwarded via the second egress port of the second network switch without transferring flow state mapping information between the first and second network switches.
8. The method of claim 7 , wherein the policy is dynamically adjustable further based on a networking environment.
9. The method of claim 8 , wherein the policy is dynamically adjustable further based on one or more criteria.
10. The method of claim 7 , wherein the flow states comprise a Transmission Control Protocol (TCP) flow state and locality.
11. The method of claim 7 , wherein the host is not a virtual machine.
12. The method of claim 7 , wherein hashing, layered hashing, or portchannel-based hashing is used to enable switching between ports.
13. The method of claim 12 , further comprising implementing equal-cost multi-path (ECMP) routing.
14. The method of claim 7 , wherein the first port is part of a first bank of ports and the second port is part of a second bank of ports.
15. A non-transitory computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the computing device to:
receive, at an ingress port from a first of two network switches communicatively coupled to two software-defined networking (SDN) appliances of a virtual computing environment, a data packet addressed to an endpoint in a virtual network of the virtual computing environment, the two SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment;
forward, by the first network switch, the data packet to a first of the two SDN appliances, the SDN appliances comprising a plurality of flexible network interface cards configured to be elastically attached and detached from a network interface card (NIC) associated with a VM running on a host;
map, by the first SDN appliance, a policy associated with the endpoint based on the virtual network associated with the data packet;
apply, by the first SDN appliance, the policy to the data packet; wherein the policy is dynamically adjustable based on the endpoint;
determine that a corresponding egress port on the first network switch is not accessible; and
in response to determining that a corresponding egress port on the first network switch is not accessible, forward, via a second egress port on a second of the network switches, the data packet to the endpoint via the flexible network interface cards;
wherein the data packet is forwarded via the second egress port of the second network switch using current TCP flow states for the data packet, thereby enabling the data packet to be forwarded via the second egress port of the second network switch.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the current flow states comprise a Transmission Control Protocol (TCP) flow state and locality.
17. The non-transitory computer-readable storage medium of claim 15 , wherein hashing, layered hashing, or portchannel-based hashing is used to enable switching between ports.
18. The non-transitory computer-readable storage medium of claim 17 , further comprising implementing equal-cost multi-path (ECMP) routing.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the first port is part of a first bank of ports and the second port is part of a second bank of ports.
20. The non-transitory computer-readable storage medium of claim 15 , wherein failed ports that become operational are reinstated in a staggered fashion.