Routing table selection in a policy based routing system
A method implemented by a network device for selection of a routing table in a Policy Based Routing (PBR) system is described. The method may include receiving a packet from a first network domain; generating a firewall mark for the packet, wherein the firewall mark includes a network domain indication and a packet classification indication; determining a match between the network domain indication of the packet and a selector of a matched rule in a set of rules; and upon determining the match between the network domain indication of the packet and the selector of the matched rule, inputting the firewall mark to a function of the matched rule to identify a routing table for the packet.
1. A method, implemented by a network device, for selection of a routing table in a Policy Based Routing (PBR) system, the method compromising:
receiving a packet from a first network domain;
generating a firewall mark for the packet, wherein the firewall mark includes a network domain indication and a packet classification indication;
determining a match between the network domain indication of the packet and a selector of a matched rule in a set of rules; and
upon determining the match between the network domain indication of the packet and the selector of the matched rule, inputting the firewall mark to a function of the matched rule to identify a routing table for the packet.
2. The method of claim 1 , further comprising:
routing the packet to a next-hop according to an entry in the routing table.
3. The method of claim 1 , wherein determining a match includes applying a mask to the firewall mark to mask the packet classification indication of the firewall mark and identify the network domain indication of the firewall mark.
4. The method of claim 1 , wherein the function of the matched rule provides a one-to-one mapping between firewall mark values and routing tables in a first set of routing tables associated with the first network domain.
5. The method of claim 4 , wherein the routing table of the packet is in the first set of routing tables.
6. The method of claim 4 , wherein the set of rules includes a rule corresponding to a second network domain,
wherein the rule corresponding to the second network domain includes a selector that matches an identifier of the second network domain and a function that provides a one-to-one mapping between firewall mark values and routing tables from a second set of routing tables associated with the second network domain.
7. The method of claim 6 , wherein the network domain indication of the matched rule corresponding to the first network domain is of a first length and the network domain indication of the rule corresponding to the second network domain is of a second length, and
wherein the first length and the second length are different.
8. The method of claim 1 , wherein the set of rules includes a rule with a selector and a discrete action to be taken in direct response to a match with the selector.
9. The method of claim 1 , wherein the packet classification indication describes one or more of information in the packet or information associated with the packet.
10. The method of claim 1 , wherein the packet classification indication describes one or more of a hash of an address of the packet and a category of data within the packet.
11. The method of claim 1 , wherein the network domain indication is set to an identifier of the first network domain.
12. The method of claim 1 , wherein the set of rules are part of a Route Policy Database (RPDB).
13. A network device comprising:
a non-transitory machine-readable storage medium having stored therein a classifier and a routing policy engine; and
a processor coupled to the non-transitory machine-readable storage medium, the processor configured to execute the classifier and the routing policy engine,
wherein the classifier is configured to receive a packet from a first network domain and generate a firewall mark for the packet, wherein the firewall mark includes a network domain indication and a packet classification indication, and
wherein the routing policy engine is configured to determine a match between the network domain indication of the packet and a selector of a matched rule in a set of rules and upon determining the match between the network domain indication of the packet and the selector of the matched rule, input the firewall mark to a function of the matched rule to identify a routing table for the packet.
14. The network device of claim 13 , wherein determining a match includes applying a mask to the firewall mark to mask the packet classification indication of the firewall mark and identify the network domain indication of the firewall mark.
15. The network device of claim 13 , wherein the function of the matched rule provides a one-to-one mapping between firewall mark values and routing tables in a first set of routing tables associated with the first network domain.
16. The network device of claim 15 , wherein the routing table of the packet is in the first set of routing tables.
17. The network device of claim 15 , wherein the set of rules includes a rule corresponding to a second network domain,
wherein the rule corresponding to the second network domain includes a selector that matches an identifier of the second network domain and a function that provides a one-to-one mapping between firewall mark values and routing tables from a second set of routing tables associated with the second network domain.
18. The network device of claim 13 , wherein the packet classification indication describes one or more of information in the packet or information associated with the packet.
19. The network device of claim 18 , wherein the network device is a control plane device configured to implement a control plane of a software defined networking (SDN).
20. The network device of claim 13 , wherein the network device is a computing device configured to execute a plurality of virtual machines, the plurality of virtual machines implementing network function virtualization (NFV).