Enforcement of inter-segment traffic policies by network fabric control plane
This disclosure describes techniques to operate a control plane in a network fabric. The techniques include determining a stateless rule corresponding to communication between a first segment of the network fabric and a second segment of the network fabric. The techniques further include configuring the control plane to enforce the stateless rule.
1. A method comprising:
determining a stateless rule corresponding to communication between a first virtual forwarding and routing (VRF) segment of a network fabric and a second VRF segment of the network fabric, the stateless rule being usable to enforce network policy on communications between the first and second VRF segments;
receiving first network layer prefixes associated with first subscriber devices in the first VRF segment and second network layer prefixes associated with second subscriber devices in the second VRF segment;
receiving a packet sent from a first subscriber device of the first VRF, the packet having a source address that is included in the first network layer prefixes and a destination address included in the second network layer prefixes; and
determining, using the stateless rule, the source address, and the destination address, that the packet is allowed to be communicated from the first VRF and to the second VRF.
2. The method of claim 1 , wherein the network fabric is of a BGP EVPN type.
3. The method of claim 1 , wherein:
the first network layer prefixes and second network layer prefixes are received at a network device of the network fabric;
the first network layer prefixes and second network layer prefixes are pushed to the network device according to push model of communication; and
the first network layer prefixes and second network layer prefixes are received at the network device prior to the packet being received.
4. The method of claim 1 , wherein the first network layer prefixes and second network layer prefixes are received, from a centralized router reflector, at a network device of the network fabric that is of a BGP EVPN type.
5. The method of claim 1 , further comprising:
determining an overlap between the source address associated with the first VRF segment and the destination address associated with the second VRF segment; and
enabling communication between the first VRF segment and the second VRF segment based at least in part on the overlap.
6. The method of claim 1 , wherein stateless rule is enforced by a firewall device, further comprising sending, from the firewall device, an advertisement message indicating routes associated with at least one of the first network layer prefixes or the second network layer prefixes.
7. The method of claim 6 , wherein the advertisement message includes an indication of a specific prefix, to attract inter-VRF segment communication from at least one subscriber associated with the specific prefix.
8. A network device comprising:
one or more processors; and
one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a stateless rule corresponding to communication between a first virtual forwarding and routing (VRF) segment of a network fabric and a second VRF segment of the network fabric, the stateless rule being usable to enforce network policy on communications between the first and second VRF segments;
receiving first network layer prefixes associated with first subscriber devices in the first VRF segment and second network layer prefixes associated with second subscriber devices in the second VRF segment;
receiving a packet sent from a first subscriber device of the first VRF, the packet having a source address that is included in the first network layer prefixes and a destination address included in the second network layer prefixes; and
determining, using the stateless rule, the source address, and the destination address, that the packet is allowed to be communicated from the first VRF and to the second VRF.
9. The network device of claim 8 , wherein the network fabric is of a BGP EVPN type.
10. The network device of claim 8 , wherein:
the first network layer prefixes and second network layer prefixes are pushed to the network device according to push model of communication; and
the first network layer prefixes and second network layer prefixes are received at the network device prior to the packet being received.
11. The network device of claim 8 , wherein the first network layer prefixes and second network layer prefixes are received, from a centralized router reflector, at a network device of the network fabric that is of a BGP EVPN type.
12. The network device of claim 8 , the operations further comprising:
determining an overlap between the source address associated with the first VRF segment and the destination address associated with the second VRF segment; and
enabling communication between the first VRF segment and the second VRF segment based at least in part on the overlap.
13. The network device of claim 8 , wherein network device is a4 firewall device, the operations further comprising sending, from the firewall device, an advertisement message indicating routes associated with at least one of the first network layer prefixes or the second network layer prefixes.
14. The network device of claim 13 , wherein the advertisement message includes an indication of a specific prefix, to attract inter-VRF segment communication from at least one subscriber associated with the specific prefix.
15. A system comprising:
one or more processors; and
one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a stateless rule corresponding to communication between a first virtual forwarding and routing (VRF) segment of a network fabric and a second VRF segment of the network fabric, the stateless rule being usable to enforce network policy on communications between the first and second VRF segments;
receiving first network layer prefixes associated with first subscriber devices in the first VRF segment and second network layer prefixes associated with second subscriber devices in the second VRF segment;
receiving a packet sent from a first subscriber device of the first VRF, the packet having a source address that is included in the first network layer prefixes and a destination address included in the second network layer prefixes; and
determining, using the stateless rule, the source address, and the destination address, that the packet is allowed to be communicated from the first VRF and to the second VRF.
16. The system of claim 15 , wherein the network fabric is of a BGP EVPN type.
17. The system of claim 15 , wherein:
the first network layer prefixes and second network layer prefixes are pushed to a network device of the system according to push model of communication; and
the first network layer prefixes and second network layer prefixes are received at the network device prior to the packet being received.
18. The system of claim 15 , wherein the first network layer prefixes and second network layer prefixes are received, from a centralized router reflector, at a network device of the system in the network fabric that is of a BGP EVPN type.
19. The system of claim 15 , wherein system includes a firewall device, the operations further comprising sending, from the firewall device, an advertisement message indicating routes associated with at least one of the first network layer prefixes or the second network layer prefixes.
20. The system of claim 19 , wherein the advertisement message includes an indication of a specific prefix, to attract inter-VRF segment communication from at least one subscriber associated with the specific prefix.