Network partition filter
A networking device and system are described, among other things. An illustrative system is disclosed to include a switch programmed to route a received packet to an egress port based on a combination of a destination address associated with the received packet and an identification of an ingress port from which the packet was received by the switch.
1 . A system for providing dynamic logical port isolation, the system comprising:
a processor; and
a memory device coupled with the processor, wherein the memory device comprises data stored thereon that, when processed by the processor, enables the processor to:
receive a packet via an ingress port, wherein the packet is associated with a destination address;
determine, based on the ingress port and the destination address associated with the packet, one or more egress ports are authorized to transmit packets both received via the ingress port and associated with the destination address; and
in response to determining the one or more egress ports are authorized to transmit packets both received via the ingress port and associated with the destination address, forward the packet to the destination address via at least one of the one or more egress ports.
2 . The system of claim 1 , wherein the processor is provided in a flow manager of a switch.
3 . The system of claim 1 , wherein the packet is received from a switch.
4 . The system of claim 1 , wherein a filter table is referenced to determine that the one or more egress ports are authorized to transmit the packet.
5 . The system of claim 4 , wherein the filter table lists, for each of a plurality of destination addresses, one or more pairs of ingress ports and egress ports authorized for transmission.
6 . The system of claim 5 , wherein determining the one or more egress ports are authorized to transmit packets both received via the ingress port and associated with the destination address comprises determining the ingress port and the destination address match a pair of ingress ports and egress ports.
7 . The system of claim 4 , wherein the filter table is modified based at least in part on traffic data received by the system.
8 . The system of claim 1 , wherein determining the one or more egress ports are authorized to transmit packets both received via the ingress port and associated with the destination address is based at least in part on traffic data received by the system.
9 . The system of claim 1 , wherein for packets associated with a particular destination address, one or more ingress ports are isolated from one or more egress ports.
10 . The system of claim 1 , wherein a second one or more egress ports are not authorized to transmit packets both received via the ingress port and associated with the destination address.
11 . A switch, comprising a processor to perform:
receiving a packet via an ingress port, wherein the packet is associated with a destination address;
determining, based on the ingress port and a destination address associated with the packet, one or more egress ports are authorized to transmit packets both received via the ingress port and associated with the destination address; and
in response to determining the one or more egress ports are authorized to transmit packets received via the ingress port and associated with the destination address, forwarding the packet to the destination address via at least one of the one or more egress ports.
12 . The switch of claim 11 , wherein the processor is provided in a flow manager of the switch.
13 . The switch of claim 11 , wherein the packet is received from a second switch.
14 . The switch of claim 11 , wherein a filter table is referenced to determine that the one or more egress ports are authorized to transmit the packet.
15 . The switch of claim 14 , wherein the filter table lists, for each of a plurality of destination addresses, one or more pairs of ingress ports and egress ports authorized for transmission.
16 . The method of claim 15 , wherein determining the one or more egress ports are authorized to transmit packets both received via the ingress port and associated with the destination address comprises determining the ingress port and the destination address match a pair of ingress ports and egress ports.
17 . The switch of claim 11 , wherein for packets associated with a particular destination address, one or more ingress ports are isolated from one or more egress ports.
18 . A networking device, comprising a processor to perform:
receiving a packet via an ingress port, wherein the packet is associated with a destination address;
determining, based on the ingress port and a destination address associated with the packet, one or more egress ports are authorized to transmit packets both received via the ingress port and associated with the destination address; and
in response to determining the one or more egress ports are authorized to transmit packets received via the ingress port and associated with the destination address, forwarding the packet to the destination address via at least one of the one or more egress ports.
19 . The networking device of claim 18 , wherein a filter table is referenced to determine that the one or more egress ports are authorized to transmit the packet.
20 . The networking device of claim 19 , wherein the filter table lists, for each of a plurality of destination addresses, one or more pairs of ingress ports and egress ports authorized for transmission.