Global VLAN services

Abstract

One embodiment of the present invention provides a switch in a network of interconnected switches. The switch includes a forwarding domain apparatus and a forwarding apparatus. The forwarding domain apparatus maintains a mapping between a first virtual local area network (VLAN) identifier and a first global VLAN identifier in a local storage device. The global VLAN identifier represents a layer-2 forwarding domain in the network and is distinct from a customer VLAN or a service-provider VLAN. The mapping is independent of a type of the VLAN identifier. During operation, the forwarding apparatus encapsulates a first packet belonging to the first VLAN in a network encapsulation header. The encapsulated packet is forwardable in the network based on the network encapsulation header. The forwarding apparatus includes the first global VLAN identifier in the network encapsulation header of the first packet.

Description

BACKGROUND

Field

This disclosure relates to communication networks. More specifically, this disclosure relates to a system and method for extending virtualized networks.

Related Art

The exponential growth of the Internet has made it a popular delivery medium for a variety of applications running on physical and virtual devices. Such applications have brought with them an increasing demand for bandwidth. As a result, equipment vendors race to build larger and faster switches with versatile capabilities, such as network virtualization and multi-tenancy, to accommodate diverse network demands efficiently. However, the size of a switch cannot grow infinitely. It is limited by physical space, power consumption, and design complexity, to name a few factors. Furthermore, switches with higher capability are usually more complex and expensive. More importantly, because an overly large and complex system often does not provide economy of scale, simply increasing the size and capability of a switch may prove economically unviable due to the increased per-port cost.

A flexible way to improve the scalability of a switch system is to build a fabric switch. A fabric switch is a collection of individual member switches. These member switches form a single, logical switch that can have an arbitrary number of ports and an arbitrary topology. As demands grow, customers can adopt a “pay as you grow” approach to scale up the capacity of the fabric switch.

Meanwhile, layer-2 and layer-3 (e.g., Ethernet and Internet Protocol (IP), respectively) switching technologies continue to evolve. IP facilitates routing and end-to-end data transfer in wide area networks (WANs) while providing safeguards for error-free communication. On the other hand, more routing-like functionalities are migrating into layer-2. Notably, the development of the Transparent Interconnection of Lots of Links (TRILL) protocol allows Ethernet switches to function more like routing devices. TRILL overcomes the inherent inefficiency of the conventional spanning tree protocol, which forces layer-2 switches to be coupled in a logical spanning-tree topology to avoid looping. TRILL allows routing bridges (RBridges) to be coupled in an arbitrary topology without the risk of looping by implementing routing functions in switches and including a hop count in the TRILL header.

As Internet traffic is becoming more diverse, network virtualization is becoming progressively more important as a value proposition for network architects. In addition, the evolution of virtual computing has made multi-tenancy attractive and, consequently, placed additional requirements on the network. For example, virtual servers are being allocated to a large number of tenants while a respective tenant operates multiple virtualized networks. It is often desirable that the network infrastructure can provide a large number of virtualized network to support multi-tenancy and ensure network separation among the tenants.

While today's networks support many desirable features, some issues remain unsolved in efficiently facilitating virtualized networks across multiple networks.

SUMMARY

One embodiment of the present invention provides a switch in a network of interconnected switches. The switch includes a forwarding domain apparatus and a forwarding apparatus. The forwarding domain apparatus maintains a mapping between a first virtual local area network (VLAN) identifier and a first global VLAN identifier in a local storage device. The global VLAN identifier represents a layer-2 forwarding domain in the network and is distinct from a customer VLAN or a service-provider VLAN. The mapping is independent of a type of the VLAN identifier. During operation, the forwarding apparatus encapsulates a first packet belonging to the first VLAN in a network encapsulation header. The encapsulated packet is forwardable in the network based on the network encapsulation header. The forwarding apparatus includes the first global VLAN identifier in the network encapsulation header of the first packet.

In a variation on this embodiment, the mapping maps the first VLAN identifier to an internal identifier, and maps the internal identifier to the first global VLAN identifier. The internal identifier is internal and local to the switch, and is distinct from a VLAN identifier.

In a further variation, the internal identifier and the first global VLAN identifier are specified in a port profile comprising a media access control (MAC) address. In response to identifying the MAC address as a source address in a packet, the forwarding domain apparatus applies the port profile to a local ingress port of the packet.

In a variation on this embodiment, the global VLAN is represented by a first set of bits in a first header field and a second sets of bits in second header field in the network encapsulation header in a continuous representation.

In a variation on this embodiment, the forwarding domain apparatus maintains a mapping between a second VLAN identifier and the first global VLAN identifier. The first and second VLAN identifiers are associated with a same service level for a tenant.

In a further variation, the forwarding apparatus includes the first global VLAN identifier in a network encapsulation header of a packet in response to identifying the first or second VLAN identifier in the packet.

In a variation on this embodiment, a local port operates as a network extension interface for a second packet, which includes a tag representing the first global VLAN identifier. The network extension interface couples a second network of interconnected switches.

In a further variation, the switch also includes a tunnel management apparatus, which encapsulates the second packet in a tunnel encapsulation header. The network extension interface is a tunnel interface. The tunnel encapsulation header is distinct from the network encapsulation header.

In a variation on this embodiment, the switch also includes a spanning tree apparatus, which identifies a spanning tree instance associated with the first VLAN identifier and associates the spanning tree instance with the first global VLAN identifier.

In a further variation, the spanning tree apparatus associates the spanning tree instance with a local port in response to identifying the local port as being configured with the first global VLAN identifier.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1A illustrates an exemplary network with support for global virtual local area networks (VLANs), in accordance with an embodiment of the present invention.

FIG. 1B illustrates exemplary mappings of VLANs to global VLANs, in accordance with an embodiment of the present invention.

FIG. 2A illustrates an exemplary directly coupled network extension with support for global VLANs, in accordance with an embodiment of the present invention.

FIG. 2B illustrates an exemplary tunnel-based network extension with support for global VLANs, in accordance with an embodiment of the present invention.

FIG. 3 illustrates an exemplary network with support for transparent global VLANs, in accordance with an embodiment of the present invention.

FIG. 4 presents a flowchart illustrating the process of a switch initializing global VLANs, in accordance with an embodiment of the present invention.

FIG. 5A presents a flowchart illustrating the process of a switch forwarding a packet received via an edge port based on global VLANs, in accordance with an embodiment of the present invention.

FIG. 5B presents a flowchart illustrating the process of a switch forwarding a packet received via an inter-switch port based on global VLANs, in accordance with an embodiment of the present invention.

FIG. 6 illustrates an exemplary network with support for spanning trees over global VLANs, in accordance with an embodiment of the present invention.

FIG. 7 illustrates an exemplary switch with support for global VLANs, in accordance with an embodiment of the present invention.

In the figures, like reference numerals refer to the same figure elements.

DETAILED DESCRIPTION

The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the claims.

Overview

In embodiments of the present invention, the problem of facilitating large-scale network virtualization in a multi-tenant network is solved by representing tenant virtual local area networks (VLANs) as global VLANs (GVLANs) in the network. The network includes a number of interconnected member switches. A global VLAN has a larger identifier space, and thus can accommodate a plurality of VLANs of a plurality of tenants. The same VLAN of different tenants can map to different global VLANs in the member switches, thereby allowing different tenants to use the full range of VLANs.

Typically, a tenant (e.g., a client or customer) deploys a plurality of end devices (e.g., physical servers or virtual machines) belonging to different VLANs (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1Q VLANs). Since the network can serve a plurality of tenants, each deploying a number of VLANs, a respective member switch of the network can serve a plurality of tenants while a plurality of member switches can serve the same tenant. Furthermore, a tenant can deploy its end devices across different member switches of the network. As a result, a network requires a large number of VLANs which can represent a respective VLAN of a respective tenant within the network. With existing technologies, the total number of VLANs a network can support for a tenant is limited by the number of bits dedicated for a VLAN identifier. Furthermore, a plurality of VLANs of a tenant may need a similar set of operations in the network. As a result, individual processing of these VLANs at the network switches occupies additional resources in the switches.

To solve this problem, the switches in the network use global VLANs to represent VLANs of different tenants in the network. A global VLAN creates a virtual forwarding domain within the network. Typically, a global VLAN is mapped based on a set of classification rules of a member switch. The classification rules can map a tenant VLAN to a global VLAN based on a tenant VLAN identifier and/or a media access control (MAC) address of an end device. In some embodiments, these classification rules can be local for a member switch and/or an edge port. This allows different sets of classification rules at different member switches and/or ports of the network. It should be noted that the end devices associated with the same global VLAN remain within the same forwarding domain even though the corresponding switches use different classification rules. Furthermore, if a group of VLANs of a tenant are associated with a same service level (e.g., run the same tenant application), the member switches in the network map that VLAN group to a same global VLAN. As a result, resources for maintaining the global VLAN mappings can be reduced at the switches.

In some embodiments, a global VLAN can support Internet Protocol (IP) routing. A global VLAN then can be associated with an IP sub-network (subnet) and can operate as a logical layer-3 interface assigned with an IP address from the subnet in a respective switch. A respective switch can maintain a mapping between the global VLAN and the corresponding subnet. In some embodiments, the layer-3 interface operates as a default gateway for the corresponding global VLAN and is assigned a virtual IP address, which is consistent in a respective switch. Because the layer-3 interface is associated with the same virtual IP address in a respective switch, the layer-3 interface operates as a distributed layer-3 gateway, and can operate as a tunnel endpoint to forward traffic across the network.

In some embodiments, the network is a fabric switch. In a fabric switch, any number of switches coupled in an arbitrary topology may logically operate as a single switch. The fabric switch can be an Ethernet fabric switch or a virtual cluster switch (VCS), which can operate as a single Ethernet switch. Any member switch may join or leave the fabric switch in “plug-and-play” mode without any manual configuration. In some embodiments, a respective switch in the fabric switch is a Transparent Interconnection of Lots of Links (TRILL) routing bridge (RBridge). In some further embodiments, a respective switch in the fabric switch is an IP routing-capable switch (e.g., an IP router).

It should be noted that a fabric switch is not the same as conventional switch stacking. In switch stacking, multiple switches are interconnected at a common location (often within the same rack), based on a particular topology, and manually configured in a particular way. These stacked switches typically share a common address, e.g., an IP address, so they can be addressed as a single switch externally. Furthermore, switch stacking requires a significant amount of manual configuration of the ports and inter-switch links. The need for manual configuration prohibits switch stacking from being a viable option in building a large-scale switching system. The topology restriction imposed by switch stacking also limits the number of switches that can be stacked. This is because it is very difficult, if not impossible, to design a stack topology that allows the overall switch bandwidth to scale adequately with the number of switch units.

In contrast, a fabric switch can include an arbitrary number of switches with individual addresses, can be based on an arbitrary topology, and does not require extensive manual configuration. The switches can reside in the same location, or be distributed over different locations. These features overcome the inherent limitations of switch stacking and make it possible to build a large “switch farm,” which can be treated as a single, logical switch. Due to the automatic configuration capabilities of the fabric switch, an individual physical switch can dynamically join or leave the fabric switch without disrupting services to the rest of the network.

Furthermore, the automatic and dynamic configurability of the fabric switch allows a network operator to build its switching system in a distributed and “pay-as-you-grow” fashion without sacrificing scalability. The fabric switch's ability to respond to changing network conditions makes it an ideal solution in a virtual computing environment, where network loads often change with time.

It should also be noted that a fabric switch is distinct from a VLAN. A fabric switch can accommodate a plurality of VLANs. A VLAN is typically identified by a VLAN tag. In contrast, the fabric switch is identified by a fabric identifier (e.g., a VCS identifier), which is assigned to the fabric switch. A respective member switch of the fabric switch is associated with the fabric identifier. Furthermore, when a member switch of a fabric switch learns a media access control (MAC) address of an end device (e.g., via layer-2 MAC address learning), the member switch generates a notification message, includes the learned MAC address in the payload of the notification message, and sends the notification message to all other member switches of the fabric switch. In this way, a learned MAC address is shared with a respective member switch of the fabric switch.

In this disclosure, the term “fabric switch” refers to a number of interconnected physical switches which form a single, scalable logical switch. These physical switches are referred to as member switches of the fabric switch. In a fabric switch, any number of switches can be connected in an arbitrary topology, and the entire group of switches functions together as one single, logical switch. This feature makes it possible to use many smaller, inexpensive switches to construct a large fabric switch, which can be viewed as a single logical switch externally. Although the present disclosure is presented using examples based on a fabric switch, embodiments of the present invention are not limited to a fabric switch. Embodiments of the present invention are relevant to any computing device that includes a plurality of devices operating as a single device.

Although the present disclosure is presented using examples based on an encapsulation protocol, embodiments of the present invention are not limited to networks defined using one particular encapsulation protocol associated with a particular Open System Interconnection Reference Model (OSI reference model) layer. For example, embodiments of the present invention can also be applied to a multi-protocol label switching (MPLS) network. In this disclosure, the term “encapsulation” is used in a generic sense, and can refer to encapsulation in any networking layer, sub-layer, or a combination of networking layers.

The term “end device” can refer to any device external to a network (e.g., which does not perform forwarding in that network). Examples of an end device include, but are not limited to, a physical or virtual machine, a conventional layer-2 switch, a layer-3 router, or any other type of network device. Additionally, an end device can be coupled to other switches or hosts further away from a layer-2 or layer-3 network. An end device can also be an aggregation point for a number of network devices to enter the network. An end device hosting one or more virtual machines can be referred to as a host machine. In this disclosure, the terms “end device” and “host machine” are used interchangeably.

The term “hypervisor” is used in a generic sense, and can refer to any virtual machine manager. Any software, firmware, or hardware that creates and runs virtual machines can be a “hypervisor.” The term “virtual machine” is also used in a generic sense and can refer to software implementation of a machine or device. Any virtual device which can execute a software program similar to a physical device can be a “virtual machine.”

The term “VLAN” is used in a generic sense, and can refer to any virtualized network. Any virtualized network comprising a segment of physical networking devices, software network resources, and network functionality can be can be referred to as a “VLAN.” “VLAN” should not be interpreted as limiting embodiments of the present invention to layer-2 networks. “VLAN” can be replaced by other terminologies referring to a virtualized network or network segment, such as “Virtual Private Network (VPN),” “Virtual Private LAN Service (VPLS),” or “Easy Virtual Network (EVN).”

The term “packet” refers to a group of bits that can be transported together across a network. “Packet” should not be interpreted as limiting embodiments of the present invention to layer-3 networks. “Packet” can be replaced by other terminologies referring to a group of bits, such as “frame,” “cell,” or “datagram.”

The term “switch” is used in a generic sense, and can refer to any standalone or fabric switch operating in any network layer. “Switch” can be a physical device or software running on a computing device. “Switch” should not be interpreted as limiting embodiments of the present invention to layer-2 networks. Any device that can forward traffic to an external device or another switch can be referred to as a “switch.” Examples of a “switch” include, but are not limited to, a layer-2 switch, a layer-3 router, a TRILL RBridge, or a fabric switch comprising a plurality of similar or heterogeneous smaller physical switches.

The term “RBridge” refers to routing bridges, which are bridges implementing the TRILL protocol as described in Internet Engineering Task Force (IETF) Request for Comments (RFC) “Routing Bridges (RBridges): Base Protocol Specification,” available at http://tools.ietf.org/html/rfc6325, which is incorporated by reference herein. Embodiments of the present invention are not limited to application among RBridges. Other types of switches, routers, and forwarders can also be used.

The term “edge port” refers to a port on a network which exchanges data frames with a device outside of the network (i.e., an edge port is not used for exchanging data frames with another member switch of a network). The term “inter-switch port” refers to a port which sends/receives data frames among member switches of the network. The terms “interface” and “port” are used interchangeably.

The term “switch identifier” refers to a group of bits that can be used to identify a switch. Examples of a switch identifier include, but are not limited to, a media access control (MAC) address, an Internet Protocol (IP) address, and an RBridge identifier. Note that the TRILL standard uses “RBridge ID” (RBridge identifier) to denote a 48-bit intermediate-system-to-intermediate-system (IS-IS) System ID assigned to an RBridge, and “RBridge nickname” to denote a 16-bit value that serves as an abbreviation for the “RBridge ID.” In this disclosure, “switch identifier” is used as a generic term, is not limited to any bit format, and can refer to any format that can identify a switch. The term “RBridge identifier” is also used in a generic sense, is not limited to any bit format, and can refer to “RBridge ID,” “RBridge nickname,” or any other format that can identify an RBridge.

The term “tunnel” refers to a data communication where one or more networking protocols are encapsulated using another networking protocol. Although the present disclosure is presented using examples based on a layer-3 encapsulation of a layer-2 protocol, “tunnel” should not be interpreted as limiting embodiments of the present invention to layer-2 and layer-3 protocols. A “tunnel” can be established for and using any networking layer, sub-layer, or a combination of networking layers.

Network Architecture

FIG. 1A illustrates an exemplary network with support for global VLANs, in accordance with an embodiment of the present invention. As illustrated in FIG. 1A, a network 100 includes member switches 101, 102, 103, 104, and 105. Network 100 can be a TRILL network and a respective member switch, such as switch 105, can be a TRILL RBridge. Network 100 can also be an IP network and a respective member switch, such as switch 105, can be an IP-capable switch, which calculates and maintains a local IP routing table (e.g., a routing information base or RIB), and is capable of forwarding packets based on its IP addresses. In some embodiments, network 100 is a fabric switch, and one or more switches in fabric switch 100 can be virtual switches (e.g., a software switch running on a computing device).

Switches 103 and 105 are coupled to end devices 120 and 130, respectively. End devices 120 and 130 are host machines, each hosting a plurality of virtual machines. Member switches in network 100 use edge ports to communicate with end devices and inter-switch ports to communicate with other member switches. For example, switch 103 is coupled to end devices, such as end device 120, via edge ports and to switches 101, 102, and 104 via inter-switch ports. End devices 120 and 130 include hypervisors 121 and 131, respectively. Virtual machines (VMs) 122, 123, 124, 125, and 126 run on hypervisor 121, and virtual machines 132, 133, 134, 135, and 136 run on hypervisor 131.

In this example, virtual machines 124, 125, 126, 134, 135, and 136 belong to a tenant 1 and virtual machines 122, 123, 132, and 133 belong to a tenant 2. Tenant 1 deploys VLANs 112 and 114, and tenant 2 deploys VLAN 112. Hence, the same VLAN identifier for VLAN 112 can be used by multiple tenants. Virtual machines 125, 126, 134, and 135 are in VLAN 112 of tenant 1, virtual machines 124 and 136 are in VLAN 114 of tenant 1, and virtual machines 122, 123, 132, and 133 are in VLAN 112 of tenant 2. Since network 100 is serving a plurality of tenants, each deploying a plurality of VLANs, a respective member switch of network 100 can serve both tenants 1 and 2, and a plurality of member switches can serve the same tenant 1 or 2.

With existing technologies, the total number of VLANs network 100 can support for tenant 1 or 2 is limited by the number of bits dedicated for a VLAN identifier (e.g., 12 bits in an IEEE 802.1Q tag). On the other hand, if tenant 1 or 2 does not need a large number of VLANs, the same number of bits, though unused, remains dedicated for that tenant. If an additional VLAN identifier (e.g., an IEEE 802.1ad tag or TRILL Fine Grain Labels (FGL)) is incorporated in a packet to identify tenant 1 or 2 in network 100, the number of tenants is limited by the number of bits dedicated for the additional VLAN identifier (e.g., an additional 12 bits in the 802.1ad tag).

To overcome this issue, a respective member switch in network 100 supports a corresponding global VLAN that represents a respective tenant VLAN in network 100. A global VLAN creates a virtual forwarding domain within network 100. A global VLAN is distinct from a customer VLAN, as represented by a C-tag, or a service-provider VLAN, as represented by an S-tag. Typically, a global VLAN is mapped based on a set of classification rules in the member switches of network 100. For example, the classification rules can map tenant VLAN 112 to a global VLAN 142 based on a VLAN identifier, a virtual MAC address and an ingress port identifier of virtual machine 125. In this example, VLAN 112 of tenant 1 is mapped to global VLAN 142 in switches 103 and 105.

In some embodiments, the classification rules are local to a member switch (or a port) of network 100 and a respective member switch can maintain its own mapping for global VLANs. For example, VLAN 114 of tenant 1 is mapped to global VLAN 144 in switch 103 and to global VLAN 148 in switch 105. On the other hand, VLAN 112 of tenant 2 is mapped to global VLAN 146 in switches 103 and 105. In this way, the same VLAN of the same tenant can be mapped to different global VLANs in different switches of network 100, and the same VLAN of different tenants can be mapped to different global VLANs in network 100.

Switch 103 maps VLAN 114 of tenant 1 to global VLAN 144 based on the VLAN identifier of VLAN 114. On the other hand, switch 105 maps VLAN 114 of tenant 1 to global VLAN 148 based on the virtual MAC address of virtual machine 136. This allows different sets of classification rules at different member switches and/or ports of the network. Furthermore, the classification rules can also be port-specific. For example, the mapping between VLAN 114 of tenant 1 and global VLAN 144 based on the VLAN identifier of VLAN 114 can be specific to the edge port coupling end device 120. Another edge port of switch 103 can have a different set of classification rules.

Similarly, switch 103 can map VLAN 112 of tenant 2 to global VLAN 146 based on the VLAN identifier of VLAN 112. On the other hand, switch 105 can map VLAN 112 of tenant 2 to global VLAN 146 based on the virtual MAC address of virtual machine 132. It should be noted that since virtual machines 122 and 132 are associated with the same global VLAN 146, virtual machines 122 and 132 remain within the same forwarding domain even when switches 103 and 105 use different classification rules.

In network 100, a classification rule can map a VLAN to an internal identifier in a switch (e.g., switch 103). An internal identifier is internal and local to switch 103, and its scope may not extend beyond switch 103. The internal identifier is for internal processing of switch 103 and is not included in a packet. Switch 103 further maps an internal identifier to a global VLAN and/or an egress port. Upon receiving a packet, switch 103 determines an internal identifier based on one or more fields of the packet and/or an ingress port of the packet (e.g., based on the classification rule). Based on the internal identifier, switch 103 determines a global VLAN identifier and an egress port for the packet.

In some embodiments, a respective global VLAN in network 100 is represented using the combined bits dedicated for both tenant and additional VLAN identifiers in a flat (e.g., a continuous and non-hierarchical) representation. Suppose that a tenant VLAN identifier is represented by A bits and an additional VLAN identifier is represented by B bits. In some embodiments, a respective global VLAN in network 100 is identified by a global VLAN identifier represented by the combined bits of A.B (e.g., a concatenation) in a flat representation. Starting from the most significant bit (MSB), any number of bits in A.B can be used to represent a tenant, and can include a subset of continuous bits in A from the MSB, or all bits of A and a subset of adjacent bits in B. The rest of the bits of A.B can be used to distinctly represent a respective global VLAN for the tenant. The length of A and B can be 12 bits each (e.g., IEEE 802.1ad tag or TRILL FGL). This flat A.B representation provides a 24-bit identifier space for global VLANs in network 100. This facilitates support for up to 16 million virtual forwarding domains in network 100, which surpasses 4096 VLANs supported by an 802.1q VLAN tag.

End devices 120 and 130 can run on different technologies. The way end device 120 or 130 identifies its VLAN domains varies with the link layer technology that the end device employs. As a result, a tenant's virtual machines may run on a heterogeneous pool of equipment. Network 100 should provide network connectivity to end devices 120 and 130 so that the resources are properly utilized. Global VLANs can normalize the forwarding domain within network 100 for end devices 120 and 130 even when end devices 120 and 130 have different VLAN representations at the respective edge ports coupling them.

In some embodiments, a packet forwarded via an inter-switch link in network 100 is encapsulated in an encapsulation header. The encapsulation header can be a fabric encapsulation header (e.g., an encapsulation header used to forward the packet in a fabric switch) or a tunnel header (e.g., an encapsulation header used to forward the packet via a tunnel). Examples of a fabric encapsulation header include, but are not limited to, a TRILL header, an IP header, an Ethernet header, and a combination thereof. Examples of a tunnel include, but are not limited to, Virtual Extensible Local Area Network (VXLAN); Generic Routing Encapsulation (GRE); and GRE variants, such as Network Virtualization using GRE (NVGRE) and openvSwitch GRE. The VLAN identifier of a global VLAN can be included in the encapsulation header.

Suppose that a tenant runs its virtual machines on three end devices, such as end devices 110, 120, and 130. Each of these end devices can use a different link layer technology or protocol. For example, end device 120 can run a virtual switch supporting traditional IEEE 802.1q in hypervisor 121 and end device 130 can run a virtual switch supporting Virtual Ethernet Port Aggregator (VEPA) (IEEE 802.1Qbg) in hypervisor 131. On the other hand, end device 110 can use an overlay network (e.g., a VXLAN tunnel). As a result, packets from end device 120 (e.g., from virtual machine 122) include a traditional VLAN identifier, packets from end device 130 (e.g., from virtual machine 132) include a double tag (e.g., a C-tag and an S-tag), and packets from end device 110 include a VXLAN Network Identifier (VNI).

A respective switch in network 100 can support mapping of each of these identifiers or tags to a corresponding global VLAN. For example, switch 103 can locally map a traditional VLAN identifier of VLAN 112 of tenant 1 to global VLAN 142. Similarly, switch 105 can locally map a double tag of VLAN 112 and tenant 1 to global VLAN 142. In this way, the switches of network 100 normalize different VLAN representations by mapping them into a single global VLAN domain at the ingress ports. When a packet leaves network 100, the egress switch can remove the encapsulation and restore the original packet.

During operation, virtual machine 122 sends a packet 190. Hypervisor 121 obtains packet 190 and sends it to switch 103. Upon receiving packet 190 via an edge port, switch 103 identifies that packet 190 belongs to VLAN 112 of tenant 2. Based on the local mapping, switch 103 determines that VLAN 112 of tenant 2 is mapped to global VLAN 146. Switch 103 encapsulates packet 190 in an encapsulation header to generate a transport packet 192. A packet used to transport traffic via an inter-switch link in network 100 can be referred to as a transport packet. Switch 103 includes the VLAN identifier of global VLAN 146 in the encapsulation header of packet 192 (e.g., in the A.B bits in the encapsulation header) and forwards packet 192 to switch 102. Upon receiving packet 192, switch 102 processes packet 192 based on its header information.

In some embodiments, switches in network 100 receive the mappings from a network manager. An end device 110, which is coupled to switch 101, can operate as a network manager. Examples of a network manager include, but are not limited to, VMWare vCenter, Citrix XenCenter, and Microsoft Virtual Machine Manager. A network administrator can configure the mapping from end device 110, which in turn, provides the mapping to switch 101. Switch 101 distributes the mapping to the corresponding member switch based on an internal information distribution service of network 100. Suppose that the network manager configures a mapping VLAN 112 of tenant 1 and global VLAN 142 for switch 103 from end device 110. Switch 101 receives the mapping and provides the mapping to switch 103.

In some embodiments, a respective member switch of network 100 (e.g., switch 103) runs a control plane with automatic configuration capabilities (e.g., based on IP or Fibre Channel (FC)) and forms a logical Ethernet switch based on the automatic configuration capabilities of the control plane. To an external end device, such as end device 110, network 100 can appear as a single Ethernet switch. Upon joining network 100 via the control plane, a respective member switch receives an automatically assigned identifier corresponding to the logical Ethernet switch. However, unlike an FC fabric, the data packets in network 100 can be encapsulated and forwarded based on another forwarding protocol. Examples of this forwarding protocol include, but are not limited to, Ethernet, TRILL, and IP. Furthermore, a respective member switch of network 100 can be associated with a group identifier, which identifies network 100 as a group of interconnected switches. If network 100 is a fabric switch, this group identifier can be a fabric identifier identifying the fabric switch.

In some embodiments, network 100 maintains a port profile for a respective virtual machine. A port profile represents Fibre Channel over Ethernet (FCoE) configuration, VLAN configuration, data center bridging (DCB) configuration, quality of service (QoS) configuration, and/or security configuration of one or more virtual machines. The VLAN configuration can include the global VLAN configuration for a virtual machine. The MAC address of a virtual machine associates the corresponding port profile to the virtual machine. This MAC address can be an original virtual MAC address (e.g., originally assigned by a hypervisor), a routable MAC address assigned as a virtual MAC address, or a routable MAC address mapped to the original virtual MAC address. Port profile management in a switch is specified in U.S. Patent Publication No. 2011/0299413, titled “Port Profile Management for Virtual Cluster Switching,” the disclosure of which is incorporated herein in its entirety.

If a port profile is configured for a port, an internal identifier is allocated for a respective global VLAN defined in the port profile. This allows a switch to avoid allocation of an internal identifier when a switch learns a new MAC address that is already specified in a port profile. In this way, the internal identifiers of the switch can have better scalability. Furthermore, before the new MAC address is learned at the switch, the correct global VLAN for that MAC address becomes configured. As a result, the initial flooding of an unknown address would be forwarded via the correct VLAN.

In some embodiments, global VLANs support private VLAN (PVLANs). A global VLAN can be a primary or a secondary VLAN for a PVLAN. The classification rules of a VLAN can specify the type and its association. For example, if global VLAN 142 is a primary VLAN, the classification rules specify the PVLAN type. Based on the PVLAN type, the classification is done at a respective port. If an end device is coupled with network 100 via a trunked port (i.e., participating in a trunked link), the port may only allow secondary VLANs.

FIG. 1B illustrates exemplary mappings of VLANs to global VLANs, in accordance with an embodiment of the present invention. In this example, switch 103 maintains an internal identifier mapping 172 (e.g., in a table, which can be a database table in a local persistent storage). An entry in mapping 172 maps one or more fields of a packet header to an internal identifier. This identifier is internal and local to switch 103, and not included in a packet in network 100. Mapping 172 maps VLANs 112 and 114 of tenant 1, and corresponding tenant information, to internal identifiers 182 and 184, respectively, and VLAN 112 of tenant 2, and corresponding tenant information, to internal identifier 186. Examples of the tenant information include, but are not limited to, a tenant identifier, an IP subnet, a MAC address (e.g., the virtual MAC address of a virtual machine belonging to the tenant), an ingress port, and a combination thereof.

Switch 103 also includes a global VLAN mapping 174. An entry in mapping 174 maps an internal identifier to a corresponding global VLAN. Mapping 174 maps internal identifiers 182 and 184 to global VLANs 142 and 144, respectively, and internal identifier 186 to global VLAN 146. In some embodiments, internal identifiers 182, 184, and 186 in switch 103 are mapped to one or more corresponding egress ports, which can be included in mapping 174 or maintained separately. If the header information of an ingress packet matches an internal identifier, switch 103 forwards that packet via the corresponding egress port. In the example in FIG. 1A, upon receiving packet 190, switch 103 determines an internal identifier based on one or more fields and/or an ingress port, retrieves an egress port mapped to the internal identifier, and forwards the packet accordingly.

Network Extensions

FIG. 2A illustrates an exemplary directly coupled network extension with support for global VLANs, in accordance with an embodiment of the present invention. In this example, network 100 is coupled to network 200, which includes member switches 201, 202, 203, 204, and 205. Network 200 can be a TRILL network and a respective member switch, such as switch 205, can be a TRILL RBridge. Network 200 can also be an IP network and a respective member switch, such as switch 205, can be an IP-capable switch, which calculates and maintains a local IP routing table (e.g., a routing information base or RIB), and is capable of forwarding packets based on its IP addresses. In some embodiments, network 200 is a fabric switch, and one or more switches in fabric switch 200 can be virtual switches (e.g., a software switch running on a computing device).

Switch 205 is coupled to end device 220. Member switches in network 200 use edge ports to communicate with end devices and inter-switch ports to communicate with other member switches. For example, switch 205 is coupled to end devices, such as end device 220, via edge ports and to switches 201, 202, and 204 via inter-switch ports. Host machine 220 includes hypervisor 221. Virtual machines 222 and 223 run on hypervisor 221 and belong to tenant 2. Virtual machines 222 and 223 are in VLAN 112 of tenant 2. In this example, VLAN 112 of tenant 2 is mapped to global VLAN 246 in network 200.

Suppose that packet 190 is destined to virtual machine 222 in host machine 220 coupled to network 200. With existing technologies, when transport packet 192, which includes packet 190 in its payload, reaches switch 102, switch 102 removes the encapsulation header, extracts packet 190, and forwards packet 190 to network 200 (e.g., either to switch 201 or 203). As a result, packet 190 can only carry the identifier (e.g., 12 bits in an IEEE 802.1Q tag) of tenant VLAN 112. Hence, the total number of VLANs a port of switch 102 coupling network 200 can support for tenant 1 is limited by the number of bits dedicated for the VLAN identifier.

To solve this problem, interconnections between networks 100 and 200 are established via network extension interfaces. Through network extension interfaces, global VLAN 146 in network 100 and global VLAN 246 in network 200 are translated at the network extension interfaces to form a unified layer-2 forwarding domain (e.g., a unified VLAN domain).

The network extension interfaces between networks 100 and 200 can be one or more pseudo-QinQ (i.e., IEEE 802.1ad) interfaces. The pseudo QinQ-interface may not support explicit S-tag configuration. Instead, a respective packet forwarded via the network extension interfaces includes the QinQ double tagging to indicate a global VLAN identifier. A respective switch in network 100 maintains a mapping between a global VLAN identifier and a corresponding QinQ double tag (e.g., S-tag and C-tag) for the packets leaving network 100. Similarly, a respective switch in network 200 maintains a mapping between a global VLAN identifier and a corresponding QinQ double tag for the packets leaving network 200.

In some embodiments, a respective network maintains separate global VLAN mappings. For example, VLAN 112 of tenant 1 is mapped to global VLAN 146 in network 100 and to global VLAN 246 in network 200. As a result, even though global VLANs 146 and 246 are part of the same layer-2 forwarding domain, they have separate global VLAN identifiers. Switches participating in the network extension interfaces can maintain a mapping between a remote QinQ double tag and the corresponding local global VLAN identifier. Upon receiving a packet, such a switch can translate the QinQ double tag of the packet to a local global VLAN identifier.

Switch 102 can include a QinQ double tag associated with global VLAN 146 in the header of packet 190 to generate an extension packet 212. A packet sent via the network extension interfaces can be referred to as an extension packet. Switch 102 then forwards packet 212 to network 200. Suppose that switch 201 receives packet 212. Upon detecting the QinQ double tag in its header, switch 201 identifies the corresponding VLAN identifier of global VLAN 246. Switch 201 strips the QinQ double tag from packet 212 to obtain packet 190. Switch 201 encapsulates packet 190 in an encapsulation header to generate transport packet 214, includes the VLAN identifier of global VLAN 246 in the encapsulation header, and forwards packet 214 to switch 205. In this way, network extension interfaces facilitate a unified layer-2 forwarding domain spanning networks 100 and 200.

In some embodiments, a network extension interface can be a tunnel interface. FIG. 2B illustrates an exemplary tunnel-based network extension with support for global VLANs, in accordance with an embodiment of the present invention. In this example, networks 100 and 200 are coupled via a layer-3 network 280. Hence, the network extension interfaces of networks 100 and 200 are tunnel interfaces (e.g., a VXLAN or NVGRE tunnel interface). One or more switches of network 100 establish corresponding tunnels 270 with one or more switches of network 200 via network 280.

Upon generating extension packet 212, which includes the QinQ double tag, switch 102 encapsulates packet 212 in a tunnel encapsulation header (e.g., a VXLAN or NVGRE header) to generate tunnel-encapsulated extension packet 216. Suppose that switch 201 of network 200 is the remote tunnel endpoint of the tunnel. Switch 102 sets the switch identifier (e.g., an IP address) of switch 201 as the destination switch identifier of the tunnel encapsulation header, identifies the local port associated with the tunnel interface, and forwards packet 216 via the port. Switch 201 receives packet 216, identifies the local switch as the destination switch, and decapsulates the tunnel encapsulation header to obtain packet 212. Switch 201 then processes packet 212 based on the QinQ double tag, as described in conjunction with FIG. 2A.

In some embodiments, a global VLAN can support Internet Protocol (IP) routing and can be associated with an IP subnet. A global VLAN can operate as a logical layer-3 interface assigned with an IP address, which can be a virtual IP address, from the subnet in switches 101 and 102. Switches 101 and 102 can maintain a mapping between the global VLAN and the corresponding subnet. In some embodiments, the layer-3 interface operates as a default gateway for a respective global VLAN. Because the layer-3 interface is associated with the same virtual IP address in switches 101 and 102, the layer-3 interface operates as a distributed layer-3 gateway, and can operate as the tunnel endpoint address for the tunnels between networks 100 and 200.

Transparent Global VLANs

If a group of VLANs of a tenant are associated with a same service level (e.g., run the same tenant application), the member switches in the network map that VLAN group to a same global VLAN. This global VLAN can be referred to as a transparent global VLAN (T-GVLAN). FIG. 3 illustrates an exemplary network with support for transparent global VLANs, in accordance with an embodiment of the present invention. In this example, switches 103 and 105 are coupled to end devices 320 and 330, respectively. End devices 320 and 330 are host machines, each hosting a plurality of virtual machines.

End devices 320 and 330 include hypervisors 321 and 331, respectively. Virtual machines 322, 323, and 324 run on hypervisor 321, and virtual machines 332 and 333 run on hypervisor 331. Virtual machines 322 and 333 belong to VLAN 312 of tenant 1, virtual machine 323 belongs to VLAN 314 of tenant 1, and virtual machines 324 and 332 belong to VLAN 112 of tenant 2. Different service levels are needed to meet the requirements of a tenant. Transparent global VLANs facilitate a single layer-2 forwarding domain in network 100 for a VLAN group instead of an individual tenant VLAN. A VLAN group can represent a specific tenant application. The services associated with the transparent VLAN can collectively represent a respective VLAN in the VLAN group that participates in the tenant application.

Suppose that VLANs 312 and 314 are associated with a same service level (e.g., a Service Level Agreement (SLA) level). Hence, VLANs 312 and 314 can be mapped to a transparent global VLAN 340. VLANs 312 and 314 share the same layer-2 forwarding domain represented by transparent global VLAN 340 in network 100. As a result, flooding domains are not separated for VLANs 312 and 314. It should be noted that, since transparent global VLANs provide a layer-2 forwarding domain, respective virtual MAC addresses of virtual machines 322, 323, and 333 should be unique. Switches in network 100 may not maintain VLAN isolation for VLANs 112 and 114. On the other hand, VLAN 112 of tenant 2 is mapped to global VLAN 146. Hence, switches 103 and 105 can map some VLANs to global VLANs and some other VLANs to transparent global VLANs.

In some embodiments, a classification rule can map a range of tenant VLANs to a transparent global VLAN. A transparent global VLAN can also be configured for a trunk port. The trunk port can support coexistence of classification rules for both global VLANs and transparent global VLANs. However, a tenant VLAN can be mapped to either a global VLAN or a transparent global VLAN. It should be noted that, since a transparent global VLAN is associated with a plurality of VLANs, network 100 does not implement per-VLAN spanning trees for a transparent global VLAN.

Suppose that switch 103 receives a control packet via transparent global VLAN 340. Switch 103 determines whether the packet is tagged (i.e., includes a VLAN tag) or not. If the packet is an untagged packet, switch 103 processes the packet based on the corresponding protocol configuration (e.g. trap, drop, or forward). If the packet is a tagged packet, switch 103 forwards the packet similarly to a data packet. However, if the packet is received via global VLAN 146, switch 103 processes the packet based on the corresponding protocol configuration.

Initialization and Operations

In the example in FIG. 1A, a respective member switch in network 100 initializes global VLANs 142, 144, and 146. FIG. 4 presents a flowchart illustrating the process of a switch initializing global VLANs, in accordance with an embodiment of the present invention. During operation, the switch identifies a tenant (operation 402). The switch then obtains tenant VLAN identifiers and tenant information associated with the tenant (operation 404). Tenant information includes one or more of: MAC addresses of tenant devices, port identifiers of ports coupling tenant devices, and IP subnets of the tenant. The switch determines a set of global VLAN identifiers corresponding to the tenant VLAN identifiers (operation 406). The switch then maps a respective tenant VLAN identifier and corresponding tenant information to a corresponding global VLAN identifier (operation 408).

FIG. 5A presents a flowchart illustrating the process of a switch forwarding a packet received via an edge port based on global VLANs, in accordance with an embodiment of the present invention. During operation, the switch receives a packet via a local edge port (operation 502) and determines an internal identifier for the packet based on the local port (e.g., a port identifier) and/or one or more fields in the packet's header (operation 504). The switch obtains a global VLAN identifier mapped to the determined internal identifier from the local mapping (operation 506). The switch encapsulates the packet in an encapsulation header to generate a transport packet (operation 508) and includes the obtained global VLAN identifier in the encapsulation header (operation 510), as described in conjunction with FIG. 1A. The switch then determines an egress port for the packet based on the determined internal identifier and transmits the packet via the port (operation 512). If the packet is a multi-destination packet, a plurality of egress ports can be mapped to the internal identifier.

FIG. 5B presents a flowchart illustrating the process of a switch forwarding a packet received via an inter-switch port based on global VLANs, in accordance with an embodiment of the present invention. During operation, the switch receives a packet via a local inter-switch port (operation 552) and checks whether the packet is destined for the local switch (operation 554). If the packet is not destined for the local switch, the switch forwards the packet based on the egress switch identifier and global VLAN identifier in the encapsulation header of the packet (operation 556). If the packet is destined for the local switch, the switch decapsulates the encapsulation header to obtain the inner packet (e.g., an Ethernet frame) (operation 558). This inner packet can be a tenant packet.

The switch then checks whether the destination address of the inner packet (e.g., a destination MAC address) is reachable via a local network extension interface (operation 560). If the destination of the inner packet is not reachable via a local network extension interface, the packet is for a device coupled via a local edge port. The switch then forwards the inner packet based on the destination switch identifier (e.g., the destination MAC address) and a tenant VLAN identifier in the header of the inner packet (operation 562). If the destination of the inner packet is reachable via a local network extension interface, the switch determines an internal identifier for the packet based on the local port (e.g., a port identifier) and one or more fields in the packet's header (operation 564).

The switch identifies a network extension interface associated with the internal identifier (operation 566) and obtains a global VLAN identifier mapped to the internal identifier (operation 568). The switch includes the obtained global VLAN identifier in the packet header of the inner packet (e.g., as a QinQ tag) to generate an extension packet (operation 570), as described in conjunction with FIG. 2A. If the network extension interface is a tunnel interface, the switch identifies the tunnel interface of the network extension interface and encapsulates the extension packet in a corresponding tunnel header (operation 572), as described in conjunction with FIG. 2B. The switch determines an egress port associated with the network extension interface for the (encapsulated) extension packet and transmits the packet via the port (operation 574).

Spanning Trees

In network 100, tenant VLANs are configured for edge ports and global VLANs are configured for inter-switch ports. Typically, network 100 supports only a single Spanning Tree Protocol (STP) domain of any variation of STP that sends untagged Bridge Protocol Data Units (BPDUs). Examples of such variations include, but are not limited to, Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP). As a result, ports participating in an STP should include VLANs with identical configurations. FIG. 6 illustrates an exemplary network with support for spanning trees over global VLANs, in accordance with an embodiment of the present invention. In this example, network 100 is coupled to virtual data centers 602, 604, and 606. To establish loop-free communication via network 100, virtual data centers 602, 604, and 606 may not have any physical connectivity among them.

If the variant of STP is RSTP, each of virtual data centers 602, 604, and 606 can participate in the RSTP. It should be noted that an RSTP instance is unaware of a global VLAN. Network 100, operating as a single switch, forms a single RSTP topology with virtual data centers 602, 604, and 606.

Loops between network 100 and virtual data centers 602, 604, and 606 are detected by this RSTP topology. If a port of a switch in network 100 cannot participate in the RSTP instance (e.g., due to a configuration conflict), a user may configure that port to put it in a blocking state. The default state for a global VLAN can be “no blocking.”

If the variant of STP is MSTP, switches in network 100 create a spanning tree instance for a group of VLANs in network 100, and virtual data centers 602, 604, and 606. The spanning instance should be the same in network 100 and virtual data centers 602, 604, and 606. Network 100, operating as a single switch, forms an MSTP topology for a respective MSTP instance with virtual data centers 602, 604, and 606. Loops between network 100 and virtual data centers 602, 604, and 606 are detected by this topology associated with the MSTP instance. If a port of a switch in network 100 cannot participate in an MSTP instance, a user may configure that port to put it in a blocking state. The default state for a global VLAN for that MSTP instance can be “no blocking.”

For Per-VLAN Spanning Tree (PVST), switches in network 100 create a spanning tree instance for a respective global VLAN. Since network 100 participates in PVST instances with virtual data centers 602, 604, and 606, a PVST instance can be enabled for a global VLAN if the classification rule for that global VLAN includes a corresponding tenant VLAN. Virtual data centers 602, 604, and 606 participate in the PVST instance based on the tenant VLAN. It should be noted that the tenant VLAN should not conflict with other global VLAN configurations in network 100.

In some embodiments, a respective switch in network 100 runs an edge loop detection algorithm. A member switch of network 100 sends an edge loop detection packet for a respective global VLAN via a respective port associated with the global VLAN. If any switch in network 100 receives a loop detection packet originated from network 100, that switch detects a loop for that global VLAN.

Network 100 can use tunneling over a spanning tree. Since network 100 is a multi-tenant network, network 100 can participate in a spanning tree instance of any of the tenants. However, if network 100 only supports one spanning tree, only the ports associated with that spanning tree can provide tunneling over a spanning tree. Other ports may not support tunneling for the spanning tree. Hence, these ports should be removed from a corresponding global VLAN (i.e., removed from the corresponding layer-2 flooding domain).

Exemplary Switch

FIG. 7 illustrates an exemplary switch with support for global VLANs, in accordance with an embodiment of the present invention. In this example, a switch 700 includes a number of communication ports 702, a packet processor 710, a forwarding domain apparatus 730, a forwarding apparatus 760, and a storage device 750. In some embodiments, packet processor 710 adds an encapsulation header to a packet. In some embodiments, switch 700 includes a network management apparatus 720, which maintains a membership in a network of interconnected switches. A respective switch of the network is associated with a group identifier identifying the network.

In some embodiments, the network is a fabric switch. Switch 700 maintains a configuration database in storage 750 that maintains the configuration state of a respective switch within the fabric switch. Switch 700 maintains the state of the fabric switch, which is used to join other switches. Under such a scenario, communication ports 702 can include inter-switch communication channels for communication within a fabric switch. This inter-switch communication channel can be implemented via a regular communication port and based on any open or proprietary format (e.g., a TRILL or IP protocol).

Forwarding domain apparatus 730 maintains a mapping between a first VLAN identifier and a first global VLAN identifier in storage device 750. During operation, forwarding apparatus 760 encapsulates a first packet belonging to the first VLAN in a network encapsulation header and includes the first global VLAN identifier in the network encapsulation header of the first packet. The mapping can map the first VLAN identifier to an internal identifier and the internal identifier to the first global VLAN identifier. In some embodiments, if forwarding apparatus 760 identifies a MAC address as a source address in a packet, forwarding apparatus 760 applies a port profile comprising the MAC address, the internal identifier, and the first global VLAN identifier to the ingress port of the packet.

Forwarding domain apparatus 730 can maintain a mapping between a second VLAN identifier and the first global VLAN identifier. The first and second VLAN identifiers are in the same VLAN group and associated with a same service level for a tenant. If forwarding apparatus 760 identifies the first or second VLAN identifier in the packet, forwarding apparatus 760 includes the first global VLAN identifier in a network encapsulation header of a packet. In some embodiments, switch 700 also includes a tunnel management apparatus 740, which encapsulates an extension packet in a tunnel encapsulation header. Switch 700 can also include a spanning tree apparatus 732, which identifies a spanning tree instance associated with the first VLAN identifier and associates the spanning tree instance with the first global VLAN identifier. Spanning tree apparatus 732 associates the spanning tree instance with a local port in response to identifying the local port as being configured with the first global VLAN identifier.

Note that the above-mentioned modules can be implemented in hardware as well as in software. In one embodiment, these modules can be embodied in computer-executable instructions stored in a memory which is coupled to one or more processors in switch 700. When executed, these instructions cause the processor(s) to perform the aforementioned functions.

In summary, embodiments of the present invention provide a switch and a method for providing global VLAN services. In one embodiment, the switch is in a network of interconnected switches. The switch includes a forwarding domain apparatus and a forwarding apparatus. The forwarding domain apparatus maintains a mapping between a first VLAN identifier and a first global VLAN identifier in a local storage device. The global VLAN identifier represents a layer-2 forwarding domain in the network and is distinct from a customer VLAN or a service-provider VLAN. The mapping is independent of a type of the VLAN identifier. During operation, the forwarding apparatus encapsulates a first packet belonging to the first VLAN in a network encapsulation header. The encapsulated packet is forwardable in the network based on the network encapsulation header. The forwarding apparatus includes the first global VLAN identifier in the network encapsulation header of the first packet.

The methods and processes described herein can be embodied as code and/or data, which can be stored in a computer-readable non-transitory storage medium. When a computer system reads and executes the code and/or data stored on the computer-readable non-transitory storage medium, the computer system performs the methods and processes embodied as data structures and code and stored within the medium.

The methods and processes described herein can be executed by and/or included in hardware modules or apparatus. These modules or apparatus may include, but are not limited to, an application-specific integrated circuit (ASIC) chip, a field-programmable gate array (FPGA), a dedicated or shared processor that executes a particular software module or a piece of code at a particular time, and/or other programmable-logic devices now known or later developed. When the hardware modules or apparatus are activated, they perform the methods and processes included within them.

The foregoing descriptions of embodiments of the present invention have been presented only for purposes of illustration and description. They are not intended to be exhaustive or to limit this disclosure. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. The scope of the present invention is defined by the appended claims.

Claims

1. A switch in a network of interconnected switches, wherein the switch comprises: a storage device;forwarding domain circuitry configured to maintain a mapping that maps a first virtual local area network (VLAN) identifier and an internal virtual identifier to a first global VLAN identifier in the storage device, wherein the global VLAN identifier represents a layer-2 forwarding domain in the network of interconnected switches and is distinct from a customer VLAN or a service-provider VLAN, and wherein the internal virtual identifier is local and internal to the switch, and not included in a packet; andforwarding circuitry configured to: encapsulate a first packet belonging to the first VLAN in a network encapsulation header, wherein the encapsulated packet is forwardable in the network of interconnected switches based on the network encapsulation header; andinclude the first global VLAN identifier in the network encapsulation header encapsulating the first packet, wherein a set of bits representing the global VLAN identifier in the network encapsulation header indicates a single value.

2. The switch of claim 1, wherein the mapping further maps the internal identifier to an egress port associated with the first global VLAN identifier; and wherein the internal identifier is distinct from a VLAN identifier.

3. The switch of claim 1, wherein the internal identifier and the first global VLAN identifier are specified in a port profile comprising a media access control (MAC) address, wherein the port profile represents a set of configurations for a port; and wherein the forwarding domain circuitry is further configured to, in response to identifying the MAC address as a source address in a packet, apply the port profile to a local ingress port of the packet.

4. The switch of claim 1, wherein the set of bits representing the global VLAN identifier includes a first subset of bits in a first header field and a second subset of bits in a second header field in the network encapsulation header in a continuous representation indicating the single value.

5. The switch of claim 1, wherein the forwarding domain circuitry is further configured to maintain a second mapping between a second VLAN identifier and the first global VLAN identifier, wherein the first and second VLAN identifiers are associated with a same service level for a tenant.

6. The switch of claim 5, wherein the forwarding circuitry is further configured to include the first global VLAN identifier in a second network encapsulation header encapsulating a second packet in response to identifying the second VLAN identifier in the second packet.

7. The switch of claim 1, wherein the forwarding circuitry is further configured to determine a port of the switch as a network extension interface for a second packet, wherein the network extension interface is an egress port associated with a second network of interconnected switches, and wherein the second packet includes a tag representing the first global VLAN identifier.

8. The switch of claim 7, further comprising tunnel management circuitry configured to encapsulate the second packet in a tunnel encapsulation header, wherein the network extension interface is a tunnel interface, and wherein the tunnel encapsulation header is distinct from the network encapsulation header.

9. The switch of claim 1, further comprising spanning tree circuitry configured to: identify a spanning tree instance associated with the first VLAN identifier; andassociate the spanning tree instance with the first global VLAN identifier.

10. The switch of claim 9, wherein the spanning tree circuitry is further configured to associate the spanning tree instance with a local port in response to identifying the local port as being configured with the first global VLAN identifier.

11. A computer-executable method, comprising: maintaining a mapping that maps a first virtual local area network (VLAN) identifier and an internal virtual identifier to a first global VLAN identifier in a storage device of a switch in a network of interconnected switches, wherein the global VLAN identifier represents a layer-2 forwarding domain in the network of interconnected switches and is distinct from a customer VLAN or a service-provider VLAN, and wherein the internal virtual identifier is local and internal to the switch, and not included in a packet;encapsulating a first packet belonging to the first VLAN in a network encapsulation header, wherein the encapsulated packet is forwardable in the network of interconnected switches based on the network encapsulation header; andincluding the first global VLAN identifier in the network encapsulation header encapsulating the first packet, wherein a set of bits representing the global VLAN identifier in the network encapsulation header indicates a single value.

12. The method of claim 11, wherein the mapping further maps the internal identifier to an egress port associated with the first global VLAN identifier; and wherein the internal identifier is distinct from a VLAN identifier.

13. The method of claim 11, wherein the internal identifier and the first global VLAN identifier are specified in a port profile comprising a media access control (MAC) address, wherein the port profile represents a set of configurations for a port; and wherein the method further comprises, in response to identifying the MAC address as a source address in a packet, applying the port profile to a local ingress port of the packet.

14. The method of claim 11, wherein the set of bits representing the global VLAN identifier includes a first subset of bits in a first header field and a second subset of bits in a second header field in the network encapsulation header in a continuous representation indicating the single value.

15. The method of claim 11, further comprising maintaining a second mapping between a second VLAN identifier and the first global VLAN identifier, wherein the first and second VLAN identifiers are associated with a same service level for a tenant.

16. The method of claim 15, further comprising including the first global VLAN identifier in a second network encapsulation header encapsulating a second packet in response to identifying the second VLAN identifier in the second packet.

17. The method of claim 11, further comprising determining a port of the switch as a network extension interface for a second packet, wherein the network extension interface is an egress port associated with a second network of interconnected switches, and wherein the second packet includes a tag representing the first global VLAN identifier.

18. The method of claim 17, further comprising encapsulating the second packet in a tunnel encapsulation header, wherein the network extension interface is a tunnel interface, and wherein the tunnel encapsulation header is distinct from the network encapsulation header.

19. The method of claim 11, further comprising: identifying a spanning tree instance associated with the first VLAN identifier; andassociating the spanning tree instance with the first global VLAN identifier.

20. The method of claim 19, further comprising associating the spanning tree instance with a local port in response to identifying the local port as being configured with the first global VLAN identifier.

21. A computing system, comprising: a processor; anda memory storing instructions that when executed by the processor cause the system to perform a method, the method comprising: maintaining a mapping that maps a first virtual local area network (VLAN) identifier and an internal virtual identifier to a first global VLAN identifier in a storage device of a switch in a network of interconnected switches, wherein the global VLAN identifier represents a layer-2 forwarding domain in the network of interconnected switches and is distinct from a customer VLAN or a service-provider VLAN, and wherein the internal virtual identifier is local and internal to the switch, and not included in a packet;encapsulating a first packet belonging to the first VLAN in a network encapsulation header, wherein the encapsulated packet is forwardable in the network of interconnected switches based on the encapsulation header; andincluding the first global VLAN identifier in the network encapsulation header encapsulating the first packet, wherein a set of bits representing the global VLAN identifier in the network encapsulation header indicates a single value.