Policy plane integration across multiple domains
Systems, methods, and computer-readable media for providing cross-domain policy enforcement. In some examples, transit VRFs for a destination network domain and a source network domain are created. Route advertisements for nodes coupled to source VRFs in the source network domain are created that include identifications of the source VRFs. The route advertisements can be transmitted from a source transit VRF in the source network domain to a destination transit VRF in the destination network domain. The route advertisements can then be filtered at the destination transit VRF based on a cross-domain policy using the identifications of the source VRFs to export routes to destination VRFs in the destination network domain according to the cross-domain policy.
1. A method comprising:
creating transit virtual routing and forwarding instances (VRFs) for a software-defined enterprise network domain and a software-defined networking (SDN) datacenter domain;
generating, at a source transit VRF of the transit VRFs in a source network domain of one of the software-defined enterprise network domain and the SDN datacenter domain, a first route advertisement for a first route to a first node coupled to a first source VRF in the source network domain and a second route advertisement for a second route to a second node coupled to a second source VRF in the source network domain, wherein the first route advertisement includes an identification of the first source VRF and the second route advertisement includes an identification of the second source VRF;
transmitting the first route advertisement and the second route advertisement to a destination transit VRF in a destination network domain of one of the software-defined enterprise network domain and the SDN datacenter domain;
filtering, at the destination transit VRF, the first route advertisement and the second route advertisement based on a cross-domain policy using the identification of the first source VRF and the identification of the second source VRF to export the first route and the second route to one or more destination VRFs in the destination network domain according to the cross-domain policy;
determining whether there is address overlap between the first route to the first node and the second route to the second node; and
merging the first route advertisement and the second route advertisement into a combined route advertisement and transmitting the combined route advertisement from the source transit VRF to the destination transit VRF if it is determined that the first route and the second route lack address overlap.
2. The method of claim 1 , wherein the source network domain is the software-defined enterprise network domain and the destination network domain is the SDN datacenter domain.
3. The method of claim 1 , wherein the source network domain is the SDN datacenter domain and the destination network domain is the software-defined enterprise network domain.
4. The method of claim 1 , further comprising:
generating the second route advertisement at a second source transit VRF separate from the source transit VRF used to create the first route advertisement if it is determined that the first route and the second route have address overlap; and
transmitting the second route advertisement to the destination network domain separate from the first route advertisement using the second source transit VRF if it is determined that the first route and the second route have address overlap.
5. The method of claim 1 , wherein filtering the first route advertisement and the second route advertisement at the destination transit VRF further comprises:
filtering a route to only the first source VRF from the first route advertisement to export only the first route to the first node coupled to the first source VRF from the first route advertisement to the one or more destination VRFs; and
filtering a route to only the second source VRF from the second route advertisement to export only the second route to the second node coupled to the second source VRF from the second route advertisement to the one or more destination VRFs.
6. The method of claim 5 , wherein an absence of the route to only the first source VRF and the route to only the second source VRF at the one or more destination VRFs enforces reachability policy between one or more nodes in the destination network domain and the first node and the second node in the source network domain.
7. The method of claim 1 , wherein the destination transit VRF is configured to operate according to the source transit VRF by:
generating route advertisements for routes of nodes coupled to the one or more destination VRFs in the destination network domain, wherein the route advertisements include identifications of the one or more destination VRFs; and
transmit the route advertisements to the source transit VRF for exporting the routes to the first node and the second node in the source network domain through filtering of the route advertisements based on the cross-domain policy using the identifications of the one or more destination VRFs.
8. The method of claim 1 , wherein the first route advertisement includes an endpoint identifier address of the first node in the source network domain and the second route advertisement includes an endpoint identifier address of the second node in the source network domain and the destination transit VRF is configured to utilize the endpoint identifier address of the first node and the endpoint identifier address of the second node to export the first route and the second route to the one or more destination VRFs in the destination network domain.
9. The method of claim 1 , further comprising importing the first route and the second route at the source transit VRF and associating the identification of the first source VRF with the first route and the identification of the second source VRF with the second route.
10. The method of claim 1 , wherein filtering the first route advertisement at the destination transit VRF further comprises:
registering an endpoint identifier address of the first node and the identification of the first source VRF in a policy of the destination network domain; and
determining whether to allow or deny traffic mappings between one or more nodes coupled to the one or more destination VRFs in the destination network domain and the first node according to the cross-domain policy using the identification of the first source VRF.
11. The method of claim 10 , further comprising:
determining whether the cross-domain policy allows the one or more destination VRFs acting as source VRFs in the destination network domain to reach the first node acting as a destination node in the source network domain based on the identification of the first source VRF coupled to the first node in the source network domain; and
allowing the traffic mappings between the one or more nodes coupled to the one or more destination VRFs and the first node if it is determined that the cross-domain policy allows the one or more destination VRFs acting as the source VRFs in the destination network domain to reach the first node acting as the destination node in the source network domain.
12. The method of claim 11 , further comprising denying the traffic mappings between the one or more nodes coupled to the one or more destination VRFs and the first node if it is determined that the cross-domain policy does not allow the one or more destination VRFs acting as the source VRFs in the destination network domain to reach the first node acting as the destination node in the source network domain.
13. The method of claim 10 , wherein the destination network domain utilizes demand-based and/or pull-based control planes to control network traffic in the destination network domain according.
14. A system comprising:
one or more processors; and
at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
creating transit virtual routing and forwarding instances (VRFs) for a software-defined enterprise network domain and a software-defined networking (SDN) datacenter domain;
generating, at a source transit VRF of the transit VRFs in a source network domain of one of the software-defined enterprise network domain and the SDN datacenter domain, a first route advertisement for a first route to a first node coupled to a first source VRF in the source network domain and a second route advertisement for a second route to a second node coupled to a second source VRF in the source network domain, wherein the first route advertisement includes an identification of the first source VRF and the second route advertisement includes an identification of the second source VRF;
transmitting the first route advertisement and the second route advertisement to a destination transit VRF in a destination network domain of one of the software-defined enterprise network domain and the SDN datacenter domain, wherein the destination transit VRF is configured to filter the first route advertisement and the second route advertisement based on a cross-domain policy using the identification of the first source VRF and the identification of the second source VRF to export the first route and the second route to one or more destination VRFs in the destination network domain according to the cross-domain policy;
determining whether there is address overlap between the first route to the first node and the second route to the second node; and
merging the first route advertisement and the second route advertisement into a combined route advertisement and transmitting the combined route advertisement from the source transit VRF to the destination transit VRF if it is determined that the first route and the second route lack address overlap.
15. The system of claim 14 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
determining whether there is address overlap between the first route to the first node and the second route to the second node; and
merging the first route advertisement and the second route advertisement into a combined route advertisement and transmitting the combined route advertisement from the source transit VRF to the destination transit VRF if it is determined that the first route and the second route lack address overlap.
16. The system of claim 15 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
generating the second route advertisement at a second source transit VRF separate from the source transit VRF used to create the first route advertisement if it is determined that the first route and the second route have address overlap; and
transmitting the second route advertisement to the destination network domain separate from the first route advertisement using the second source transit VRF if it is determined that the first route and the second route have address overlap.
17. The system of claim 14 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
registering an endpoint identifier address of the first node and the identification of the first source VRF in a policy of the destination network domain; and
determining whether to allow or deny traffic mappings between one or more nodes coupled to the one or more destination VRFs in the destination network domain and the first node according to the cross-domain policy using the identification of the first source VRF.
18. The system of claim 17 , wherein the instructions which, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
determining whether the cross-domain policy allows the one or more destination VRFs acting as source VRFs in the destination network domain to reach the first node acting as a destination node in the source network domain based on the identification of the first source VRF coupled to the first node in the source network domain; and
allowing the traffic mappings between the one or more nodes coupled to the one or more destination VRFs and the first node if it is determined that the cross-domain policy allows the one or more destination VRFs acting as the source VRFs in the destination network domain to reach the first node acting as the destination node in the source network domain.
19. A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising:
creating transit virtual routing and forwarding instances (VRFs) for a software-defined enterprise network domain and a software-defined networking (SDN) datacenter domain;
generating, at a source transit VRF of the transit VRFs in a source network domain of one of the software-defined enterprise network domain and the SDN datacenter domain, a first route advertisement for a first route to a first node coupled to a first source VRF in the source network domain, wherein the first route advertisement includes an identification of the first source VRF;
transmitting the first route advertisement to a destination transit VRF in a destination network domain of one of the software-defined enterprise network domain and the SDN datacenter domain;
filtering, at the destination transit VRF, the first route advertisement based on a cross-domain policy using the identification of the first source VRF to selectively export the first route to one or more destination VRFs in the destination network domain according to the cross-domain policy;
determining whether there is address overlap between the first route to the first node and another route to a second node; and
merging the first route advertisement and the another route advertisement into a combined route advertisement and transmitting the combined route advertisement from the source transit VRF to the destination transit VRF if it is determined that the first route and the another route lack address overlap.