Dynamic chain of service functions for processing network traffic
The technology disclosed herein enables a dynamic chain of service functions for processing network traffic. In a particular embodiment, a method includes, in a logical router for a logical network connecting service functions, receiving a network packet from a service function over the logical network after the network packet has been processed by the service function. The method further includes determining a new classification of the network packet and determining a next service function based on application of a service chain policy to the new classification. The method also includes directing the network packet to the next service function over the logical network.
1. A method comprising:
in a logical router for a logical network connecting service functions:
receiving a network packet from a service function over the logical network after the network packet has been processed by the service function;
determining a new classification of the network packet; and
determining a next service function based on application of a service chain policy to the new classification; and
directing the network packet to the next service function over the logical network.
2. The method of claim 1 , comprising:
after the network packet has been processed by the next service function and before the logical router passes the network packet to a second next service function, determining the second next service function based on application of the service chain policy to the new classification; and
directing the network packet from the logical router to the second next service function.
3. The method of claim 1 , wherein determining the new classification comprises:
processing the network packet to identify information about the network packet, wherein the information indicates the new classification.
4. The method of claim 3 , wherein the information comprises an Ethernet encapsulation of the network packet by the one service function.
5. The method of claim 3 , wherein the information comprises data contained in a header of the network packet.
6. The method of claim 3 , wherein processing the network packet comprises:
performing deep packet inspection (DPI) on the network packet to obtain the information.
7. The method of claim 1 , comprising:
determining an initial classification of the network packet;
determining the service function based on application of the service chain policy to the initial classification; and
directing the network packet to the service function over the logical network.
8. The method of claim 7 , wherein determining the initial classification comprises:
classifying the network packet based on a source of the network packet.
9. The method of claim 1 , comprising:
receiving an update for the service chain policy in the logical router, wherein the update for the service chain policy indicates a different next service function than the next service function for subsequent network packets having the new classification.
10. The method of claim 1 , wherein the logical router comprises a distributed logical router executing on one or more host computing systems.
11. An apparatus comprising:
one or more physical host computing systems configured to implement a logical router for a logical network connecting service functions;
the logical router configured to:
receive a network packet from a service function over the logical network after the network packet has been processed by the service function;
determine a new classification of the network packet; and
determine a next service function based on application of a service chain policy to the new classification; and
direct the network packet to the next service function over the logical network.
12. The apparatus of claim 11 , wherein the logical router is configured to:
after the network packet has been processed by the next service function and before the logical router passes the network packet to a second next service function, determine the second next service function based on application of the service chain policy to the new classification; and
direct the network packet from the logical router to the second next service function.
13. The apparatus of claim 11 , wherein to determine the new classification, the logical router is configured to:
process the network packet to identify information about the network packet, wherein the information indicates the new classification.
14. The apparatus of claim 13 , wherein the information comprises an Ethernet encapsulation of the network packet by the one service function.
15. The apparatus of claim 13 , wherein the information comprises data contained in a header of the network packet.
16. The apparatus of claim 13 , wherein to process the network packet, the logical router is configured to:
perform deep packet inspection (DPI) on the network packet to obtain the information.
17. The apparatus of claim 11 , wherein the logical router is configured to:
determine an initial classification of the network packet;
determine the service function based on application of the service chain policy to the initial classification; and
direct the network packet to the service function over the logical network.
18. The apparatus of claim 17 , wherein to determine the initial classification, the logical router is configured to:
classify the network packet based on a source of the network packet.
19. The apparatus of claim 11 , wherein the logical router is configured to:
receive an update for the service chain policy in the logical router, wherein the update for the service chain policy indicates a different next service function than the next service function for subsequent network packets having the new classification.
20. The apparatus of claim 11 , wherein the logical router comprises a distributed logical router executing on the one or more host computing systems.