Method and system for cross-zone network traffic between different zones using virtual network identifiers and virtual layer-2 broadcast domains

1. A method for processing network traffic, comprising:

receiving, from a remote virtual tunnel end point (VTEP), a virtual layer-3 (VL3) frame comprising a forward-service virtual network identifier (VNI);

decapsulating the VL3 frame to obtain a first unicast media access control (MAC) frame originating from a source, wherein the first unicast MAC frame comprises a forward-service virtual layer-2 (VL2) broadcast domain tag associated with a forward-service VL2 broadcast domain;

determining, using a virtual address resolution protocol (VARP) MAC address, that the VARP MAC address is known on the forward-service VNI;

translating, based on the VARP MAC address being known on the forward-service VNI, the first unicast MAC frame into a original VL2 broadcast domain, to obtain a second unicast MAC frame; and

bridging, through a near network interface (NNI), the second unicast MAC frame to a service device.

2. The method of claim 1 , further comprising:

receiving, from the service device through a far network interface (FNI) and after the service device performs a service function, the second unicast MAC frame;

replacing an existing destination MAC address in the second unicast MAC frame with a next-hop MAC address, to obtain a third unicast MAC frame; and

translating the third unicast MAC frame into a second original VL2 broadcast domain, to obtain a fourth unicast MAC frame.

3. The method of claim 2 , further comprising:

determining, using the next-hop MAC address, that the next-hop MAC address is known on an original VNI;

encapsulating, based on the next-hop MAC address being known on an original VNI, the fourth unicast MAC frame in a second VL3 frame comprising the original VNI; and

transmitting the second VL3 frame towards a service VTEP, wherein a second service device resides behind the service VTEP.

4. The method of claim 2 , wherein the original VNI corresponds to the second original VL2 broadcast domain.

5. The method of claim 3 , wherein the next-hop MAC address is associated with a service network element on which the service VTEP is executing.

6. The method of claim 2 , wherein the existing destination MAC address is the VARP MAC address.

7. The method of claim 2 , further comprising:

determining, using the next-hop MAC address, that the next-hop MAC address is unknown on an original VNI; and

flooding, based on the next-hop MAC address is unknown on an original VNI, the fourth unicast MAC frame to all destinations known on the original VNI.

8. The method of claim 1 , wherein the source is an intercept host or an intercept virtual machine.

9. The method of claim 1 , wherein the VL3 frame is a virtual extensible local area network (VXLAN) frame.

10. The method of claim 1 , further comprising:

receiving, from the service device through a far network interface (FNI) and after the service device performs a service function, the second unicast MAC frame;

mirroring the second unicast MAC frame to obtain a first unicast MAC frame copy;

transmitting the first unicast MAC frame copy through a loop-start interface (LSI);

receiving the first unicast MAC frame copy through a loop-end interface (LEI), wherein the LEI is connected to the LSI;

translating the first unicast MAC frame copy into a reverse-service VL2 broadcast domain, to obtain a second unicast MAC frame copy;

determining, using the VARP MAC address, that the VARP MAC address is unknown on a reverse-service VNI; and

dropping, based on the VARP MAC address being unknown on a reverse-service VNI, the second unicast MAC frame copy.

11. A non-transitory computer readable medium (CRM) comprising computer readable program code, which when executed by a computer processor, enables the computer processor to:

receive, from a remote virtual tunnel end point (VTEP), a virtual layer-3 (VL3) frame comprising a forward-service virtual network identifier (VNI);

decapsulate the VL3 frame to obtain a first unicast media access control (MAC) frame originating from a source, wherein the first unicast MAC frame comprises a forward-service virtual layer-2 (VL2) broadcast domain tag associated with a forward-service VL2 broadcast domain;

determining, using a virtual address resolution protocol (VARP) MAC address, that the VARP MAC address is known on the forward-service VNI;

translate, based on the VARP MAC address being known on the forward-service VNI, the first unicast MAC frame into a original VL2 broadcast domain, to obtain a second unicast MAC frame; and

bridge, through a near network interface (NNI), the second unicast MAC frame to a service device.

12. The non-transitory CRM of claim 11 , further comprising computer readable program code, which when executed by the computer processor, enables the computer processor to:

receive, from the service device through a far network interface (FNI) and after the service device performs a service function, the second unicast MAC frame;

replace an existing destination MAC address in the second unicast MAC frame with a next-hop MAC address, to obtain a third unicast MAC frame; and

translate the third unicast MAC frame into a second original VL2 broadcast domain, to obtain a fourth unicast MAC frame.

13. The non-transitory CRM of claim 12 , further comprising computer readable program code, which when executed by the computer processor, enables the computer processor to:

determining, using the next-hop MAC address, that the next-hop MAC address is known on an original VNI;

encapsulate, based on the next-hop MAC address being known on an original VNI, the fourth unicast MAC frame in a second VL3 frame comprising the original VNI; and

transmit the second VL3 frame towards a service VTEP, wherein a second service device resides behind the service VTEP.

14. The non-transitory CRM of claim 13 , wherein the original VNI corresponds to the second original VL2 broadcast domain.

15. The non-transitory CRM of claim 13 , wherein the next-hop MAC address is associated with a service network element on which the service VTEP is executing.

16. The non-transitory CRM of claim 12 , wherein the existing destination MAC address is the VARP MAC address.

17. The non-transitory CRM of claim 12 , further comprising computer readable program code, which when executed by the computer processor, enables the computer processor to:

determining, using the next-hop MAC address, that the next-hop MAC address is unknown on an original VNI; and

flood, based on the next-hop MAC address being unknown on an original VNI, the fourth unicast MAC frame to all destinations known on the original VNI.

18. The non-transitory CRM of claim 11 , wherein the source is an intercept host or an intercept virtual machine.

19. The non-transitory CRM of claim 11 , wherein the VL3 frame is a virtual extensible local area network (VXLAN) frame.

20. The non-transitory CRM of claim 11 , further comprising computer readable program code, which when executed by the computer processor, enables the computer processor to:

receive, from the service device through a far network interface (FNI) and after the service device performs a service function, the second unicast MAC frame;

mirror the second unicast MAC frame to obtain a first unicast MAC frame copy;

transmit the first unicast MAC frame copy through a loop-start interface (LSI);

receive the first unicast MAC frame copy through a loop-end interface (LEI), wherein the LEI is connected to the LSI;

translate the first unicast MAC frame copy into a reverse-service VL2 broadcast domain, to obtain a second unicast MAC frame copy;

determining, using the VARP MAC address, that the VARP MAC address is unknown on a reverse-service VNI; and

drop, based on the VARP MAC address being unknown on a reverse-service VNI, the second unicast MAC frame copy.