Systems and methods for externalizing network functions via packet trunking
The methods and systems described herein provide a mechanism to externalize network functions through a direct link between a network switch and an external packet processor. The network switch is configured to receive a packet directed to a destination node via a first network interface. The network switch is also configured to forward the received packet to a packet processor, via a second network interface, over a direct physical link between the network switch and the packet processor. The packet is forwarded with an identifier for a virtualized network function executing on the packet processor and a destination MAC address of the packet is different from a MAC address of the packet processor.
1. A network system for externalizing network functions, comprising:
a network switch configured to:
receive a packet via a first network interface, wherein the packet is directed to a destination node other than the network switch;
forward the received packet to a packet processor for processing, via a second network interface, over a direct physical link between the network switch and the packet processor, wherein:
the network switch forwards the packet along with an identifier for a virtualized network function executing on the packet processor,
the identifier for the virtualized network function is included in one of a MAC address field, VLAN tag field, Generic Routing Encapsulation header field, or Multiprotocol Label Switching header field associated with the packet, and
a destination MAC address of the packet is different from a MAC address of the packet processor;
receive from the packet processor the processed packet; and
forward the processed packet over a third network interface towards the destination node; and
the packet processor, comprising a general purpose computer processor, configured to:
execute a plurality of different virtualized network function modules, including at least two of a network address translation module, a policy enforcement module, an encryption module, an access control list filtering module, a firewalling module, and an intrusion detection module, wherein the packet processor is configured to recognize at least two identifiers associated with at least one of the virtualized network functions, including a first identifier for identifying a version of the virtualized network function to be executed on locally generated packets and a second identifier for a version of the network function to be executed on remotely generated packets;
receive the packet from the network switch;
route the received packet within the packet processor to one of the plurality of virtualized network function modules executing on the packet processor based on the identifier included with the packet for processing; and
send the processed packet back to the network switch.
2. The system of claim 1 , wherein the processed packet includes an identifier that identifies a network function that has been carried out in processing the packet.
3. A network switch comprising:
a processor;
non-transitory computer readable media storing computer executable instructions, which when executed by the processor cause the processor to:
receive a packet via a first network interface, wherein the packet is directed to a destination node other than the network switch;
modify a field within the header of the packet to include an identifier for a virtualized network function executing on the packet processor, wherein the identifier for the virtualized network function is included in one of a MAC address field, VLAN tag field, Generic Routing Encapsulation header field, or Multiprotocol Label Switching header field associated with the packet;
forward the received packet with the modified header to a packet processor comprising a general purpose computer processor, via a second network interface, over a direct physical link between the network switch and the packet processor, wherein:
the network switch forwards the packet with a destination MAC address that is different from a MAC address of the packet processor,
the packet processor executes a plurality of different virtualized network function modules, including at least two of a network address translation module, a policy enforcement module, an encryption module, an access control list filtering module, a firewalling module, and an intrusion detection module,
the identifier corresponds to one of the plurality of virtualized network function modules,
the packet processor is configured to recognize at least two identifiers associated with at least one of the virtualized network functions, including a first identifier for identifying a version of the virtualized network function to be executed on locally generated packets and a second identifier for a version of the network function to be executed on remotely generated packets,
and
the packet processor uses the identifier to route the packet within the packet processor to the corresponding virtualized network function module;
receive from the packet processor the packet after it has been processed by the identified virtualized network function; and
forward the processed packet over a third network interface towards the destination node.
4. The apparatus of claim 3 , wherein the processed packet includes an identifier that identifies a network function that has been carried out in processing the packet.
5. A packet processor, comprising:
a general purpose computer processor;
non-transitory computer readable media storing computer executable instructions, which when executed by the processor cause the processor to:
execute a plurality of different virtualized network function modules, including at least two of a network address translation module, a policy enforcement module, an encryption module, an access control list filtering module, a firewalling module, and an intrusion detection module;
receive a packet from a network switch, over a direct physical link between the network switch and the packet processor, wherein:
the received packet includes an identifier corresponding to one of the virtualized network function modules executing on the packet processor to be carried out on the packet,
the identifier for the virtualized network function is included in one of a MAC address field, VLAN tag field, Generic Routing Encapsulation header field, or Multiprotocol Label Switching header field associated with the packet,
wherein the packet processor is configured to recognize at least two identifiers associated with at least one virtualized network function, including a first identifier for identifying a version of the virtualized network function to be executed on locally generated packets and a second identifier for a version of the network function to be executed on remotely generated packets, and
a destination MAC address of the received packet is different from a MAC address of the packet processor;
route the received packet within the packet processor to the network function module corresponding to the identifier;
process the packet using the corresponding network function module; and
send the processed packet back to the network switch over the direct physical link.
6. The apparatus according to claim 5 , wherein the computer executable instructions, when executed by the processor, cause the processor to, after the packet has been processed by the network function module, modify the packet header to include an identifier that indicates that the identified network function has been carried out on the packet.