Hitless network traffic policy upgrades
Techniques for implementing hitless network traffic policy upgrades are provided. In one set of embodiments, these techniques allow a hitless upgrade of a network traffic policy to be performed in a manner that guarantees all network packets subject to the policy are evaluated against either the old policy version or the new policy version. Accordingly, these techniques avoid scenarios where some network packets fail to be evaluated against the traffic policy at all during the hitless upgrade process (which can result in incorrect forwarding behavior).
1 . A method performed by a network device for implementing a hitless upgrade of a network traffic policy from an old version to a new version, the network device comprising one or more interfaces that are assigned an existing virtual routing and forwarding (VRF) identifier (ID), the method comprising:
determining a new VRF ID corresponding to the new version of the network traffic policy;
computing a new set of longest prefix match (LPM) entries for the new version of the network traffic policy, each LPM entry in the new set of LPM entries being associated with the new VRF ID;
computing a new set of ternary content-addressable memory (TCAM) entries for the new version of the network traffic policy, each TCAM entry in the new set of TCAM entries being associated with the new VRF ID;
programming the new set of LPM entries into a set of LPM tables of the network device;
programming the new set of TCAM entries into a TCAM of the network device; and
after completing the programming of the new set of LPM entries and the new set of TCAM entries, performing a VRF ID switchover with respect to the one or more interfaces, the VRF ID switchover causing each interface in the one or more interfaces to be assigned the new VRF ID rather than the existing VRF ID.
2 . The method of claim 1 wherein the programming of the new set of LPM entries is performed while an existing set of LPM entries associated with the existing VRF ID is stored in the set of LPM tables.
3 . The method of claim 1 wherein the programming of the new set of TCAM entries is performed while an existing set of TCAM entries associated with the existing VRF ID is stored in the TCAM.
4 . The method of claim 1 wherein the existing VRF ID identifies a VRF to which the old version of the network traffic policy applies.
5 . The method of claim 1 wherein each LPM entry in the new set of LPM entries includes the new VRF ID, an Internet Protocol (IP) prefix taken from a match criterion of a rule in the new version of the network traffic policy, and a label that is mapped to the IP prefix.
6 . The method of claim 1 wherein each TCAM entry in the new set of TCAM entries includes the new VRF ID, a label, and an action taken from a rule in the new version of the network traffic policy that is mapped to the label.
7 . The method of claim 1 wherein the new VRF ID is determined by modifying the existing VRF ID according to a predetermined rule.
8 . The method of claim 1 wherein performing the VRF ID switchover comprises:
modifying interface-to-VRF ID mappings maintained in an interface table of the network device.
9 . The method of claim 1 further comprising, after performing the VRF ID switchover:
deleting the existing set of LPM entries from the set of LPM tables; and
deleting the existing set of TCAM entries from the TCAM.
10 . A network device comprising:
a central processing unit (CPU);
a packet processor;
one or more interfaces that are assigned an existing virtual routing and forwarding (VRF) identifier (ID);
a set of longest prefix match (LPM) tables;
a ternary content-addressable memory (TCAM); and
a main memory having stored thereon program code that, when executed by the CPU, causes the CPU to execute a hitless upgrade of a network traffic policy from an old version to a new version by:
determining a new VRF ID corresponding to the new version of the network traffic policy;
computing a new set of LPM entries for the new version of the network traffic policy, each LPM entry in the new set of LPM entries being associated with the new VRF ID;
computing a new set of TCAM entries for the new version of the network traffic policy, each TCAM entry in the new set of TCAM entries being associated with the new VRF ID;
programming the new set of LPM entries into the set of LPM tables;
programming the new set of TCAM entries into the TCAM; and
after completing the programming of the new set of LPM entries and the new set of TCAM entries, performing a VRF ID switchover with respect to the one or more interfaces, the VRF ID switchover causing each interface in the one or more interfaces to be assigned the new VRF ID rather than the existing VRF ID.
11 . The network device of claim 10 wherein the programming of the new set of LPM entries is performed while an existing set of LPM entries associated with the existing VRF ID is stored in the set of LPM tables, and wherein the programming of the new set of TCAM entries is performed while an existing set of TCAM entries associated with the existing VRF ID is stored in the TCAM.
12 . The network device of claim 10 wherein the existing VRF ID identifies a VRF to which the old version of the network traffic policy applies.
13 . The network device of claim 10 wherein each LPM entry in the new set of LPM entries includes the new VRF ID, an Internet Protocol (IP) prefix taken from a match criterion of a rule in the new version of the network traffic policy, and a first label that is mapped to the IP prefix, and wherein each TCAM entry in the new set of TCAM entries includes the new VRF ID, a second label that is included in at least one LPM entry, and an action taken from a rule in the new version of the network traffic policy that is mapped to the second label.
14 . The network device of claim 10 wherein the new VRF ID is determined by modifying the existing VRF ID according to a predetermined rule.
15 . The network device of claim 10 wherein performing the VRF ID switchover comprises:
modifying interface-to-VRF ID mappings maintained in an interface table of the network device.
16 . The network device of claim 10 wherein the program code further causes the CPU to, after performing the VRF ID switchover:
delete the existing set of LPM entries from the set of LPM tables; and
delete the existing set of TCAM entries from the TCAM.
17 . A method performed by a network device for implementing a hitless upgrade of a network traffic policy from an old version to a new version, the network device comprising one or more interfaces that are assigned an existing virtual routing and forwarding (VRF) identifier (ID), the method comprising:
determining a new VRF ID corresponding to the new version of the network traffic policy;
computing a new set of ternary content-addressable memory (TCAM) entries for the new version of the network traffic policy, each TCAM entry in the new set of TCAM entries being associated with the new VRF ID;
programming the new set of TCAM entries into a TCAM of the network device; and
after completing the programming of the new set of TCAM entries, performing a VRF ID switchover with respect to the one or more interfaces, the VRF ID switchover causing each interface in the one or more interfaces to be assigned the new VRF ID rather than the existing VRF ID.
18 . The method of claim 17 further comprising:
computing a new set of longest prefix match (LPM) entries for the new version of the network traffic policy, each LPM entry in the new set of LPM entries being associated with the new VRF ID; and
programming the new set of LPM entries into a set of LPM tables of the network device.