Providing services with guest VM mobility
Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (I) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane.
1. A method of specifying a sequence of services, the method comprising:
identifying, for a data message associated with a source machine executing on a source host computer, a plurality of service nodes to perform a plurality of service operations on the data message, the plurality of service nodes defining a service path in a network, the service path comprising the plurality of service nodes;
distributing to the source host computer a service insertion rule to use to identify the plurality of service nodes as the data message traverses along an egress path from the source host computer to a destination host computer; and
distributing, to each of a plurality of host computers that each executes at least one service node, at least one next-hop forwarding rule that comprises a network address of a next-hop service node in a service path, each host computer using each next-hop forwarding rule to retrieve the network address of a next-hop service node to forward the data message after a service node on the host computer performs a service operation on the data message.
2. The method of claim 1 , wherein
each next-hop forwarding rule further comprises a rule identifier that is specified by reference to a service path identifier (SPI) value that identifies the service path,
the rule identifier used at each service hop to match with a SPI value embedded in a header of the data message in order to match the next-hop forwarding rule to the data message and thereby to retrieve the next hop network address from the matching rule.
3. The method of claim 2 , wherein
the rule identifier of each rule is further specified by reference to a service index (SI) value,
the SI value is embedded in the data message header and the SI value is adjusted in this header at each hop, and
the embedded SPI and SI values are used at each hop to match with the SPI and SI values of next-hop forwarding rules to identify a matching forwarding rule that specifies the next hop's network address.
4. The method of claim 1 , wherein
each next-hop forwarding rule is an exact match rule that has a rule identifier comprising a service path identifier (SPI) value that identifies the service path and a service index (SI) value that identifies a hop's service node location in the service path,
the rule identifier of a forwarding rule compared with SPI and SI values associated with a data message processed by a hop's service node to identify the matching forwarding rule, which then provides the network address for a next hop service node.
5. The method of claim 4 , wherein distributing the forwarding rules comprises distributing different forwarding rules for different service-node hops along the service path, the different forwarding rules specifying different SI values corresponding to different locations of the service nodes along the service path.
6. The method of claim 5 , wherein
each service node that executes on a host computer is a service machine,
a service proxy executes on each host computer for each service machine,
the service proxy for each hop's service machine examines the SPI/SI values of a plurality of next-hop forwarding rules stored for the service machine on the host computer to identify a next-hop forwarding rule that matches a data message, the next-hop forwarding rules for each service machine associated with a plurality of service paths that contain the service machine.
7. The method of claim 5 , wherein the SPI/SI values are embedded in a data message header by a module executing on the source host computer that initially receives the data message for the source machine executing on the source host computer, and the SI value is decremented at each hop after the service is performed by the service node of that hop.
8. The method of claim 7 , wherein the data message is part of a data message flow, and the source host computer selects the service path for the data message flow based on the service insertion rule.
9. The method of claim 1 further comprising:
identifying a service chain that specifies a sequences of service operations for the data messages;
identifying, for the identified service chain, a set of one or more service paths, each service path specifying a different set of service nodes for performing the service operations, and
generating and distributing next-hop forwarding rules for each service node along each service path.
10. The method of claim 9 , wherein at least two different service paths include at least one service node in common.
11. A non-transitory machine readable medium storing a program for execution by at least one processing unit and for specifying a sequence of services, the program comprising sets of instructions for:
identifying, for a data message associated with a source machine executing on a source host computer, a plurality of service nodes to perform a plurality of service operations on the data message, the plurality of service nodes defining a service path in a network, the service path comprising the plurality of service nodes;
distributing to the source host computer a service insertion rule to use to identify the plurality of service nodes as the data message traverses along an egress path from a source host computer to a destination host computer; and
distributing, to each of a plurality of host computers that each executes at least one service node, at least one next-hop forwarding rule that comprises a network address of a next-hop service node in a service path, each host computer using each next-hop forwarding rule to retrieve the network address of a next-hop service node to forward the data message after a service node on the host computer performs a service operation on the data message.
12. The non-transitory machine readable medium of claim 11 , wherein
each next-hop forwarding rule further comprises a rule identifier that is specified by reference to a service path identifier (SPI) value that identifies the service path,
the rule identifier used at each service hop to match with a SPI value embedded in a header of the data message in order to match the next-hop forwarding rule to the data message and thereby to retrieve the next hop network address from the matching rule.
13. The non-transitory machine readable medium of claim 12 , wherein
the rule identifier of each rule is further specified by reference to a service index (SI) value,
the SI value is embedded in the data message header and the SI value is adjusted in this header at each hop, and
the embedded SPI and SI values are used at each hop to match with the SPI and SI values of next-hop forwarding rules to identify a matching forwarding rule that specifies the next hop's network address.
14. The non-transitory machine readable medium of claim 11 , wherein
each next-hop forwarding rule is an exact match rule that has a rule identifier comprising a service path identifier (SPI) value that identifies the service path and a service index (SI) value that identifies a hop's service node location in the service path,
the rule identifier of a forwarding rule compared with SPI and SI values associated with a data message processed by a hop's service node to identify the matching forwarding rule, which then provides the network address for a next hop service node.
15. The non-transitory machine readable medium of claim 14 , wherein the set of instructions for distributing the forwarding rules comprises a set of instructions for distributing different forwarding rules for different service-node hops along the service path, the different forwarding rules specifying different SI values corresponding to different locations of the service nodes along the service path.
16. The non-transitory machine readable medium of claim 15 , wherein
each service node that executes on a host computer is a service machine,
a service proxy executes on each host computer for each service machine,
the service proxy for each hop's service machine examines the SPI/SI values of a plurality of next-hop forwarding rules stored for the service machine on the host computer to identify a next-hop forwarding rule that matches a data message, the next-hop forwarding rules for each service machine associated with a plurality of service paths that contain the service machine.
17. The non-transitory machine readable medium of claim 15 , wherein the SPI/SI values are embedded in a data message header by a module executing on a first the source host computer that initially receives the data message for the source machine executing on the source host computer, and the SI value is decremented at each hop after the service is performed by the service node of that hop.
18. The non-transitory machine readable medium of claim 17 , wherein the data message is part of a data message flow, and the source host computer selects the service path for the data message flow based on the service insertion rule.
19. The non-transitory machine readable medium of claim 11 , wherein the program further comprises sets of instructions for:
identifying a service chain that specifies a sequences of service operations for the data messages;
identifying, for the identified service chain, a set of one or more service paths, each service path specifying a different set of service nodes for performing the service operations, and
generating and distributing next-hop forwarding rules for each service node along each service path.
20. The non-transitory machine readable medium of claim 19 , wherein at least two different service paths include at least one service node in common.