Inband group-based network policy using SRV6
The present technology pertains to a group-based network policy using Segment Routing over an IPv6 dataplane (SRv6). After a source application sends a packet, an ingress node can receive the packet, and if the source node is capable, it can identify an application policy and apply it. The ingress node indicates that the policy has been applied by including policy bits in the packet encapsulation. When the packet is received by the egress node, it can determine whether the policy was already applied, and if so, the packet is forward to the destination application. If the egress node determines that the policy has not be applied the destination application can apply the policy. Both the ingress node and egress nodes can learn of source application groups, destination application groups, and applicable policies through communication with aspects of the segment routing fabric.
1. A method comprising:
receiving, at an egress node located downstream from an ingress node, a first data packet with Segment Routing over an IPv6 dataplane (SRv6) encapsulation, the first data packet being associated with a source application to a destination application;
removing the SRv6 encapsulation from the first data packet;
forwarding the unencapsulated first data packet to the destination application in response to content in the SRv6 encapsulation indicating that a first policy was applied at the ingress node;
in response to the content in the SRv6 encapsulation indicating that the first policy was not applied at the ingress node:
applying a second policy to the unencapsulated first data packet;
forwarding the unencapsulated first data packet to the destination application in response to the second policy allowing forwarding of the unencapsulated first data packet; and
dropping the unencapsulated first data packet in response to the second policy prohibiting forwarding of the unencapsulated first data packet.
2. The method of claim 1 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
3. The method of claim 1 , further comprising:
retrieving from the SRv6 encapsulation, in response to the receiving, the content.
4. The method of claim 1 , further comprising:
in response to the content indicating that the first policy was not applied at the ingress node:
identifying a destination application group corresponding to a destination application of the first data packet; and
identifying the second policy from at least the destination application group.
5. The method of claim 4 , wherein the identifying a destination application group comprises:
requesting the destination application group for the first data packet from a fabric connectivity system between the ingress node and the egress node.
6. The method of claim 4 , wherein the identifying the second policy comprises:
requesting the second policy from a fabric connectivity system between the ingress node and the egress node.
7. The method of claim 4 , further comprising:
retrieving from the SRv6 encapsulation, in response to the receiving, a source application group corresponding to the source application; and
the identifying the second policy is further based on the retrieved source application group.
8. A non-transitory computer readable media storing instructions which are programmed to cause a system including electronic computer hardware in combination with software to perform operations comprising:
receive, at an egress node located downstream from an ingress node, a first data packet with Segment Routing over an IPv6 dataplane (SRv6) encapsulation, the first data packet being associated with from a source application to a destination application;
remove the SRv6 encapsulation from the first data packet;
forward the unencapsulated first data packet to the destination application in response to content in the SRv6 encapsulation indicating that a first policy was applied at the ingress node;
in response to the content in the SRv6 encapsulation indicating that the first policy was not applied at the ingress node:
apply a second policy to the unencapsulated first data packet;
forward the unencapsulated first data packet to the destination application in response to the second policy allowing forwarding of the unencapsulated first data packet; and
drop the unencapsulated first data packet in response to the second policy prohibiting forwarding of the unencapsulated first data packet.
9. The non-transitory computer readable media of claim 8 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
10. The non-transitory computer readable media of claim 8 , the operations further comprising:
retrieve from the SRv6 encapsulation, in response to the receiving, the content.
11. The non-transitory computer readable media of claim 8 , the operations further comprising:
in response to the content indicating that the first policy was not applied at the ingress node:
identify a destination application group corresponding to a destination application of the first data packet; and
identify the second policy from at least the destination application group.
12. The non-transitory computer readable media of claim 11 , wherein the identifying a destination application group comprises:
request the destination application group for the first data packet from a fabric connectivity system between the ingress node and the egress node.
13. The non-transitory computer readable media of claim 11 , wherein the identifying the second policy comprises:
request the second policy from a fabric connectivity system between the ingress node and the egress node.
14. The non-transitory computer readable media of claim 11 , the operations further comprising:
retrieve from the SRv6 encapsulation, in response to the receiving, a source application group corresponding to the source application; and
the identify the second policy is further based on the retrieved source application group.
15. A system, comprising:
a processor;
a non-transitory computer readable media storing instructions which are programmed to cause the processor to perform operations comprising:
receive, at an egress node located downstream from an ingress node, a first data packet with Segment Routing over an IPv6 dataplane (SRv6) encapsulation, the first data packet being associated with from a source application to a destination application;
remove the SRv6 encapsulation from the first data packet;
forward the unencapsulated first data packet to the destination application in response to content in the SRv6 encapsulation indicating that a first policy was applied at the ingress node;
in response to the content in the SRv6 encapsulation indicating that the first policy was not applied at the ingress node:
apply a second policy to the unencapsulated first data packet;
forward the unencapsulated first data packet to the destination application in response to the second policy allowing forwarding of the unencapsulated first data packet; and
drop the unencapsulated first data packet in response to the second policy prohibiting forwarding of the unencapsulated first data packet.
16. The system of claim 15 , where in the SRv6 encapsulation includes an outer IPv6 header and a segment routing header.
17. The system of claim 15 , the operations further comprising:
retrieve from the SRv6 encapsulation, in response to the receiving, the content.
18. The system of claim 15 , the operations further comprising:
in response to the content indicating that the first policy was not applied at the ingress node:
identify a destination application group corresponding to a destination application of the first data packet; and
identify the second policy from at least the destination application group.
19. The system of claim 18 , wherein the identifying a destination application group comprises:
request the destination application group for the first data packet from a fabric connectivity system between the ingress node and the egress node.
20. The system of claim 18 , wherein the identifying the second policy comprises:
request the second policy from a fabric connectivity system between the ingress node and the egress node.