DHCP snooping with host mobility
This disclosure describes methods of operating a leaf node device, such as a switch device, connected to a switch fabric of a network. The leaf node device receives, from another leaf node device via the switch fabric, an indication of a secure route to a host device. In response to receiving the indication of the secure route, the leaf node device creates or updates a routing entry for the host device in a routing information base of the leaf node device and creates or updates an entry for the host device in a Dynamic Host Configuration Protocol (DHCP) snoop database of the leaf node device. The leaf node may thereby communicate with the host device that is attached to the leaf node device as a result of moving from the other leaf node device.
1. A method of operating a first leaf node device connected to a switch fabric, comprising:
receiving, at the first leaf node device and from a second leaf node device, a Border Gateway Protocol (BGP) update message including an advertisement of a route from the switch fabric to a host device using an Internet Protocol (IP) to Media Access Control (MAC) pairing, wherein the first leaf node device includes a first Dynamic Host Configuration Protocol (DHCP) snoop database and the second leaf node device includes a second DHCP snoop database storing an indication that the route from the switch fabric to the host device is authenticated as secure;
determining, at the first leaf node device, that the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the IP-to-MAC pairing is valid and the route from the switch fabric and to the host device is authenticated as secure;
by the first leaf node device, in response to determining that the BGP update message includes the value that indicates the IP-to-MAC pairing is valid and the route to the host device is secure, creating or updating an entry indicating the route for the host device in the first DHCP snoop database of the first leaf node device; and
based at least in part on the entry in the first DHCP snoop database, enabling, by the first leaf node device, secure data traffic from the host device prior to the host device otherwise communicating with the first leaf node device to make the first leaf node device aware that the host device is connected to the first leaf node device.
2. The method of claim 1 , further comprising:
by the first leaf node device, determining from the first DHCP snoop database of the first leaf node device that the route to the host device is secure and, based at least in part on the determining, communicating with the host device attached to the first leaf node device.
3. The method of claim 1 , wherein the switch fabric is an underlay for an Ethernet Virtual Private Network (EVPN) overlay.
4. The method of claim 1 , further comprising:
by the first leaf node device, receiving from the second leaf node device, via the switch fabric, an indication of a lease renewal time for the route, wherein creating or updating the entry for the host device in the first DHCP snoop database includes providing the lease renewal time in the entry.
5. The method of claim 1 , wherein updating the entry for the host device in the first DHCP snoop database includes updating a lease expiration time for the host device in the entry.
6. The method of claim 1 , further comprising:
receiving an address resolution protocol (ARP) message from the host device;
caching the ARP message; and
validating the cached ARP message at least in part using the entry for the host device in the first DHCP snoop database of the first leaf node device.
7. The method of claim 1 , wherein the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the route is authenticated as secure.
8. A first leaf node device, comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations of:
receiving, from a second leaf node device, via a switch fabric, a Border Gateway Protocol (BGP) update message including an advertisement of a route from the switch fabric to a host device using an Internet Protocol (IP) to Media Access Control (MAC) pairing, wherein the first leaf node device includes a first Dynamic Host Configuration Protocol (DHCP) snoop database and the second leaf node device includes a second DHCP snoop database storing an indication that the route from the switch fabric to the host device is authenticated as secure;
determining that the BGP update message includes data that indicates the IP-to-MAC pairing is valid and the route from the switch fabric and to the host device is authenticated as secure;
in response to determining that the BGP message includes the data that indicates the IP-to-MAC pairing is valid and the route to the host device is secure, creating or updating an entry indicating the route for the host device in the first DHCP snoop database of the first leaf node device; and
based at least in part on the entry in the first DHCP snoop database, enabling, by the first leaf node device, secure data traffic from the host device prior to the host device otherwise communicating with the first leaf node device to make the first leaf node device aware that the host device is connected to the first leaf node device.
9. The first leaf node device of claim 8 , wherein the switch fabric is an underlay for an Ethernet Virtual Private Network (EVPN) overlay.
10. The first leaf node device of claim 8 , the operations further comprising:
receiving from the second leaf node device, via the switch fabric, an indication of a lease renewal time for the route, wherein creating or updating the entry for the host device in the first DHCP snoop database includes providing the lease renewal time in the entry.
11. The first leaf node device of claim 8 , wherein updating the entry for the host device in the first DHCP snoop database includes updating a lease expiration time for the host device in the entry.
12. The first leaf node device of claim 11 further comprising transmitting to other leaf node devices in the switch fabric the updated lease expiration time for the host device using a BGP Extended Community attribute.
13. The first leaf node device of claim 8 , the operations further comprising:
receiving an address resolution protocol (ARP) message from the host device;
caching the ARP message; and
validating the cached ARP message at least in part using the entry for the host device in the first DHCP snoop database of the first leaf node device.
14. The first leaf node device of claim 8 , wherein the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the route is authenticated as secure.
15. One or more non-transitory computer-readable storage media storing computer-readable instructions that, when executed, instruct a processing unit of a first leaf node device connected to a switch fabric to perform operations comprising:
receiving, at the first leaf node device and from a second leaf node device, a Border Gateway Protocol (BGP) update message including an advertisement of a route from the switch fabric to a host device using an Internet Protocol (IP) to Media Access Control (MAC) pairing, wherein the first leaf node device includes a first Dynamic Host Protocol Configuration (DHCP) snoop database and the second leaf node device includes a second DHCP snoop database storing an indication that the route from the switch fabric to the host device is authenticated as secure;
determining, at the first leaf node device, that the BGP update message includes data that indicates the IP-to-MAC pairing is valid and the route from the switch fabric and to the host device is authenticated as secure;
in response to determining that the BGP update message includes the data that indicates the IP-to-MAC pairing is valid and the route to the host device is secure, creating or updating an entry indicating the route for the host device in the first DHCP snoop database of the first leaf node device; and
based at least in part on the entry in the first DHCP snoop database, enabling, by the first leaf node device, secure data traffic from the host device prior to the host device otherwise communicating with the first leaf node device to make the first leaf node device aware that the host device is connected to the first leaf node device.
16. The one or more non-transitory computer-readable storage media of claim 15 , wherein the operations further comprise:
receiving from the second leaf node device, via the switch fabric, an indication of a lease renewal time for the route, wherein creating or updating the entry for the host device in the first DHCP snoop database includes providing the lease renewal time in the entry.
17. The one or more non-transitory computer-readable storage media of claim 15 , wherein updating the entry for the host device in the first DHCP snoop database includes updating a lease expiration time for the host device in the entry.
18. The one or more non-transitory computer-readable storage media of claim 15 , the operations further comprising:
receiving an address resolution protocol (ARP) message from the host device;
caching the ARP message; and
validating the cached ARP message at least in part using the entry for the host device in the first DHCP snoop database of the first leaf node device.
19. The one or more non-transitory computer-readable storage media of claim 15 , wherein the switch fabric is an underlay for an Ethernet Virtual Private Network (EVPN) overlay.
20. The one or more non-transitory computer-readable storage media of claim 15 , wherein the BGP update message includes a BGP Extended Community attribute that is populated with a value that indicates the route is authenticated as secure.