Systems and methods for tunneling network traffic to apply network functions
The systems and methods described herein provide a mechanism to apply network functions to a packet. The packet received by a network switch from a host may be configured so that the packet may be transmitted and forwarded to a target destination with desired network function, such as desired security settings, traffic path control or policy enforcement. In one example, the system may include a network switch and a network controller. The packet from hosts may enter the network switch through network ports (Px). The packet may then be tunneled and further transmitted to a server insertion to add a service identifier for the packet. The packet with the service modifier is then transmitted to a service block over the network. The service block may apply specific network functions to be processed or already processed to the packets. Subsequently, the packet with the specific network functions may then routes to the target destination with the desired network functions.
1 . A method for applying network functions to a packet, comprising:
receiving a packet via a network interface port of a network switch, wherein the packet is directed to a destination node other than the network switch;
tunneling, by the network switch, the packet to a service insertion point controlled by a network controller, wherein the packet includes identification information and a host identifier;
storing in a memory cache of a network controller, a first look-up table comprising a collection of service identifiers;
determining, by the service insertion point, a service identifier by mapping the identification information of the packet to the service identifier within the look-up table;
adding, by the service insertion point, the service identifier to the packet;
forwarding, by the service insertion point, the packet with the service identifier to a service block;
storing in the cache of the network controller, a second look-up table having a key comprising the host identifier and the service identifier;
determining, by the service block, based on the host identifier and the service identifier, one or more network functions to apply to the packet;
applying, by the service block, the one or more network functions to the packet; and
forwarding, by the service block, the packet with the network function to the destination node.
2 . The method of claim 1 , wherein the network function comprises network security functionality.
3 . The method of claim 2 , wherein the network security functionality comprises one or more of network address translation (NAT), encryption, access control list (ACL) filtering, firewalling, intrusion detection, IP packet encryption (IPSec) or policy enforcement.
4 . The method of claim 1 , wherein adding, by the one or more processors, the service identifier further comprises:
rewriting, by the one or more processors, a destination MAC of the packet to encode the service identifier.
5 . The method of claim 1 , wherein applying, by the one or more processors, the network function to the packet further comprises:
performing, by the one or more processors, a second look-up process;
using, by the one or more processors, a host identifier and service identifier as search keys during the second look-up process.
6 . The method of claim 5 , wherein the host identifier comprises source IP address or MAC address.
7 . The method of claim 1 , wherein forwarding, by the one or more processors, the packet to the service insertion point further comprises:
tunneling, by the one or more processors, the packet from the network switch based on different ports received from the network switch.
8 . The method of claim 7 , wherein the different ports of the network switch are configured in different VLANs.
9 . The method of claim 1 , wherein the service identifier comprises a MAC address field, VLAN tag field, Generic Routing Encapsulation header field, or Multiprotocol Label Switching header field associated with the packet.
10 . A network system for applying network functions to a packet, comprising:
one or more processors;
tangible computer readable media storing computer executable instructions, which when executed by the processor cause the processors to:
receive a packet via a network interface port of a network switch in the network system, wherein the packet is directed to a destination node other than the network switch;
tunnel the packet to a service insertion point controlled by a network controller in the network system wherein the packet includes identification information and a host identifier;
store a first look-up table in a cache memory cache of a network controller, the first look-up table comprising a collection of service identifiers;
determine by the service insertion point, a service identifier by mapping the identification information of the packet to the service identifier within the first lookup table;
add by the service insertion point, a service identifier to the packet;
forward by the service insertion point, the packet with the service identifier to a service block;
store a second look-up table in the cache of the network controller, the second look-up table comprising a key value based on the host identifier and the service identifier;
determine by the service block, based on the host identifier and the service identifier, one or more network functions to apply to the packet;
apply by the service block, a network function to the packet; and
forward by the service block, the packet with the network function applied to the destination node.
11 . The network system of claim 10 , wherein the network function comprises network security functionality.
12 . The network system of claim 10 , wherein the one or more processors are further configured to:
rewrite, by the one or more processors, a destination MAC of the pocket to encode the service identifier.
13 . The network system of claim 10 , wherein the one or more processors are further configured to:
perform, by the one or more processors, a second look-up process;
use, by the one or more processors, a host identifier and service identifier as search keys during the second look-up process.
14 . The network system of claim 10 , wherein the host identifier comprises source IP address or MAC address.
15 . The network system of claim 10 , further comprising:
tunnel, by the one or more processors, the packet from the network switch based on different ports received from the network switch prior to forwarding the packet to a service insertion point.
16 . The network system of claim 15 , wherein the different ports of the network switch is configured in different VLANs.
17 . The network system of claim 10 , wherein the network controller comprises a software defined network controller.
18 . A network switch, comprising:
one or more processors;
tangible computer readable media storing computer executable instructions, which when executed by the processor cause the processor to:
receive a packet via a network interface port of the network switch from a host to the network switch, wherein the packet is directed to a destination node other than the network switch;
tunnel the packet to a service insertion point based on ports configured in the network switch, wherein the different ports of the network switch are configured in different VLANs;
determine by the service insertion point a service identifier by mapping the identification information of the packet to the service identifier within a look-up table stored in a memory cache of a network look-controller, the look-up table comprising a collection of service identifiers; and
forward the packet with the service identifier to a service block to apply a network function to the packet.