Methods for micro-segmentation in SD-WAN for virtual networks

Abstract

Some embodiments of the invention provide a method for micro-segmenting traffic flows in a software defined wide area network (SD-WAN). At a first edge forwarding node of a first multi-machine site in the SD-WAN, the method receives, from a particular forwarding element, a first packet of a packet flow originating from a second multi-machine site that is external to the SD-WAN, the packet flow destined for a particular machine at the first multi-machine site. The method uses deep packet inspection (DPI) on the first packet to identify contextual information not provided by the particular forwarding element about the first packet and the packet flow. Based on the identified contextual information, the method applies one or more policies to the first packet before forwarding the first packet to the particular machine.

Description

BACKGROUND

Today, virtual local area networks (VLANs) and related interfaces are used to map against level 3 (L3) segments, and the traffic that ingress through them derive respective L3 segment identifiers inside of the SD-WAN overlay. As a result, once the overlay packets ingress to the edge node, they are mapped to a single segment and the corresponding segment-specific policy is applied over the packets despite there being three application types (i.e., virtual network identifiers (VNIs)) spread across three service classes of traffic (i.e., real-time, transactional, and bulk traffic). Moreover, when the traffic is a generic overlay traffic (e.g., Geneve), it can be considered as only user datagram protocol (UDP) traffic, and additional information about the packet, such as application traffic type, is not inferred. In turn, application-based business policy level quality of service (QoS) and other optimizations cannot be leveraged, and default UDP policies are applied over Geneve overlay-based traffic, which may then be treated as bulk/transactional traffic with low QoS prioritization.

BRIEF SUMMARY

Some embodiments of the invention provide a novel method for micro segmenting traffic flows in a software-defined wide area network (SD-WAN) by mapping virtual network identifiers (VNIs), or groups of VNIs, to level 3 (L3) segments as defined by the SD-WAN. A first edge forwarding node of a first multi-machine site in the SD-WAN receives a first packet of a packet flow originating from a second multi-machine site that is external to the SD-WAN and destined for a particular machine at the first multi-machine site. The first edge forwarding node determines that the first packet includes a GENEVE overlay encapsulation, and uses deep packet inspection (DPI) on the first packet to identify contextual information about the first packet and the packet flow. Based on the identified contextual information, the first edge forwarding node applies one or more policies to the first packet before forwarding the first packet to the particular machine.

In some embodiments, the first edge forwarding node receives the first packet from a switch that tags packets with a particular VLAN (virtual local area network) tag, which gets mapped to a single segment on the first edge forwarding node. In some embodiments, the single VLAN segment encompasses a set of VNI-based micro-segments, which are not specified by the VLAN tag. Each micro-segment in the set of micro-segments in some embodiments includes machines dedicated to one of a web server, a database server, and an application server.

While the VLAN tag does not specify the particular micro-segment to which the particular destination machine belongs, the identified contextual information learned by the first edge forwarding node through DPI, in some embodiments, includes at least a VNI that identifies a particular micro-segment in the set of micro-segments, as well as an AppID for the packet flow. Thus, the first edge forwarding node in some embodiments uses the identified VNI to forward the first packet to the correct micro-segment where the particular machine is located.

In some embodiments, the one or more policies applied to the first packet include micro-segment based application policies. These micro-segment based application policies, in some embodiments, are associated with VNIs that correspond to different micro-segments, such as the set of micro-segments on the first edge forwarding node. In some embodiments, the micro-segment based application policies are attached to respective L3 segments within the SD-WAN. Examples of micro-segment based application policies include quality of service (QoS) policies, firewall policies, business policies, other security policies (e.g., intrusion detection, intrusion prevention, etc.), middlebox policies (e.g., load balancing policies), and forwarding policies (e.g., gateway forwarding policies, etc.). The policies, in some embodiments, are user-defined (e.g., defined by a network administrator) and specific to each micro-segment.

The preceding Summary is intended to serve as a brief introduction to some embodiments of the invention. It is not meant to be an introduction or overview of all inventive subject matter disclosed in this document. The Detailed Description that follows and the Drawings that are referred to in the Detailed Description will further describe the embodiments described in the Summary as well as other embodiments. Accordingly, to understand all the embodiments described by this document, a full review of the Summary, the Detailed Description, the Drawings, and the Claims is needed. Moreover, the claimed subject matters are not to be limited by the illustrative details in the Summary, the Detailed Description, and the Drawings.

BRIEF DESCRIPTION OF FIGURES

The novel features of the invention are set forth in the appended claims. However, for purposes of explanation, several embodiments of the invention are set forth in the following figures.

FIG. 1 illustrates an example of a virtual network that is created for a particular entity using SD-WAN forwarding elements deployed at branch sites, datacenters, and public clouds, in some embodiments.

FIG. 2 illustrates a more in-depth view of part of a virtual network created for a particular entity using SD-WAN forwarding elements deployed at branch sites, datacenters, and public clouds, in some embodiments.

FIG. 3 illustrates a frame of a UDP packet having a Geneve encapsulation, in some embodiments.

FIG. 4 illustrates a process performed by an edge node in some embodiments upon receipt of a packet with a Geneve overlay.

FIG. 5 illustrates a more detailed view of an edge forwarding node, according to some embodiments.

FIG. 6 illustrates two example diagrams of how policies and services for the different micro-segments (VNIs) can be defined in some embodiments.

FIG. 7 conceptually illustrates a computer system with which some embodiments of the invention are implemented.

DETAILED DESCRIPTION

In the following detailed description of the invention, numerous details, examples, and embodiments of the invention are set forth and described. However, it will be clear and apparent to one skilled in the art that the invention is not limited to the embodiments set forth and that the invention may be practiced without some of the specific details and examples discussed.

Some embodiments of the invention provide a novel method for micro segmenting traffic flows in a software-defined wide area network (SD-WAN) by mapping virtual network identifiers (VNIs), or groups of VNIs, to level 3 (L3) segments as defined by the SD-WAN. A first edge forwarding node of a first multi-machine site in the SD-WAN receives a first packet of a packet flow originating from a second multi-machine site that is external to the SD-WAN and destined for a particular machine at the first multi-machine site. The first edge forwarding node determines that the first packet includes a GENEVE overlay encapsulation, and uses deep packet inspection (DPI) on the first packet to identify contextual information about the first packet and the packet flow. Based on the identified contextual information, the first edge forwarding node applies one or more policies to the first packet before forwarding the first packet to the particular machine.

In some embodiments, the first edge forwarding node receives the first packet from a switch that tags packets with a particular VLAN (virtual local area network) tag, which gets mapped to a single segment on the first edge forwarding node. In some embodiments, the single VLAN segment encompasses a set of VNI-based micro-segments, which are not specified by the VLAN tag. Each micro-segment in the set of micro-segments in some embodiments includes machines dedicated to one of a web server, a database server, and an application server.

While the VLAN tag does not specify the particular micro-segment to which the destination particular machine belongs, the identified contextual information learned by the first edge forwarding node through DPI, in some embodiments, includes at least a VNI that identifies a particular micro-segment in the set of micro-segments, as well as an AppID for the packet flow. Thus, the first edge forwarding node in some embodiments uses the identified VNI to forward the first packet to the correct micro-segment where the particular machine is located.

In some embodiments, the one or more policies applied to the first packet include micro-segment based application policies. These micro-segment based application policies, in some embodiments, are associated with VNIs that correspond to different micro-segments, such as the set of micro-segments on the first edge forwarding node. In some embodiments, the micro-segment based application policies are attached to respective L3 segments within the SD-WAN. Examples of micro-segment based application policies include quality of service (QoS) policies, firewall policies, business policies, other security policies (e.g., intrusion detection, intrusion prevention, etc.), middlebox policies (e.g., load balancing policies), and forwarding policies (e.g., gateway forwarding policies, etc.). The policies, in some embodiments, are user-defined (e.g., defined by a network administrator) and specific to each micro-segment.

FIG. 1 illustrates an example of a virtual network 100 that is created for a particular entity using SD-WAN forwarding elements deployed at branch sites, datacenters, and public clouds. Examples of public clouds are public clouds provided by Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, etc., while examples of entities include a company (e.g., corporation, partnership, etc.), an organization (e.g., a school, a non-profit, a government entity, etc.), etc.

In FIG. 1, the SD-WAN forwarding elements include cloud gateway 105 and SD-WAN forwarding elements 130, 132, 134, 136. The cloud gateway (CGW) in some embodiments is a forwarding element that is in a private or public datacenter 110. The CGW 105 in some embodiments has secure connection links (e.g., tunnels) with edge forwarding elements (e.g., SD-WAN edge forwarding elements (FEs) 130, 132, 134, and 136) at the particular entity's multi-machine sites (e.g., SD-WAN edge sites 120, 122, 124, and 126), such as branch offices, datacenters, etc. These multi-machine sites are often at different physical locations (e.g., different buildings, different cities, different states, etc.) and are referred to below as multi-machine sites or nodes.

Four multi-machine sites 120-126 are illustrated in FIG. 1, with three of them being branch sites 120-124, and one being a datacenter 126. Each branch site is shown to include an edge forwarding node 130-134, while the datacenter site 126 is shown to include a hub forwarding node 136. The datacenter SD-WAN forwarding node 136 is referred to as a hub node because in some embodiments this forwarding node can be used to connect to other edge forwarding nodes of the branch sites 120-124. The hub node in some embodiments provides services (e.g., middlebox services) for packets that it forwards from one branch site to another branch site. The hub node also provides access to the datacenter resources 156, as further described below.

Each edge forwarding element (e.g., SD-WAN edge FEs 130-134) exchanges data messages with one or more cloud gateways 105 through one or more connection links 115 (e.g., multiple connection links available at the edge forwarding element). In some embodiments, these connection links include secure and unsecure connection links, while in other embodiments they only include secure connection links. As shown by edge node 134 and gateway 105, multiple secure connection links (e.g., multiple secure tunnels that are established over multiple physical links) can be established between one edge node and a gateway.

When multiple such links are defined between an edge node and a gateway, each secure connection link in some embodiments is associated with a different physical network link between the edge node and an external network. For instance, to access external networks, an edge node in some embodiments has one or more commercial broadband Internet links (e.g., a cable modem, a fiber optic link) to access the Internet, an MPLS (multiprotocol label switching) link to access external networks through an MPLS provider's network, a wireless cellular link (e.g., a 5G LTE network), etc. In some embodiments, the different physical links between the edge node 134 and the cloud gateway 105 are the same type of links (e.g., are different MPLS links).

In some embodiments, one edge forwarding node 130-134 can also have multiple direct links 115 (e.g., secure connection links established through multiple physical links) to another edge forwarding node 130-134, and/or to a datacenter hub node 136. Again, the different links in some embodiments can use different types of physical links or the same type of physical links. Also, in some embodiments, a first edge forwarding node of a first branch site can connect to a second edge forwarding node of a second branch site (1) directly through one or more links 115, (2) through a cloud gateway or datacenter hub to which the first edge forwarding node connects through two or more links 115, or (3) through another edge forwarding node of another branch site that can augment its role to that of a hub forwarding node, as will be described in more detail below. Hence, in some embodiments, a first edge forwarding node (e.g., 134) of a first branch site (e.g., 124) can use multiple SD-WAN links 115 to reach a second edge forwarding node (e.g., 130) of a second branch site (e.g., 120), or a hub forwarding node 136 of a datacenter site 126.

The cloud gateway 105 in some embodiments is used to connect two SD-WAN forwarding nodes 130-136 through at least two secure connection links 115 between the gateway 105 and the two forwarding elements at the two SD-WAN sites (e.g., branch sites 120-124 or datacenter site 126). In some embodiments, the cloud gateway 105 also provides network data from one multi-machine site to another multi-machine site (e.g., provides the accessible subnets of one site to another site). Like the cloud gateway 105, the hub forwarding element 136 of the datacenter 126 in some embodiments can be used to connect two SD-WAN forwarding nodes 130-134 of two branch sites through at least two secure connection links 115 between the hub 136 and the two forwarding elements at the two branch sites 120-124.

In some embodiments, each secure connection link between two SD-WAN forwarding nodes (i.e., CGW 105 and edge forwarding nodes 130-136) is formed as a VPN tunnel between the two forwarding nodes. In this example, the collection of the SD-WAN forwarding nodes (e.g., forwarding elements 130-136 and gateways 105) and the secure connections 115 between the forwarding nodes forms the virtual network 100 for the particular entity that spans at least the public or private cloud datacenter 110 to connect the branch and datacenter sites 120-126.

In some embodiments, secure connection links are defined between gateways in different public cloud datacenters to allow paths through the virtual network to traverse from one public cloud datacenter to another, while no such links are defined in other embodiments. Also, in some embodiments, the gateway 105 is a multi-tenant gateway that is used to define other virtual networks for other entities (e.g., other companies, organizations, etc.). Some such embodiments use tenant identifiers to create tunnels between a gateway and edge forwarding element of a particular entity, and then use tunnel identifiers of the created tunnels to allow the gateway to differentiate data message flows that it receives from edge forwarding elements of one entity from data message flows that it receives along other tunnels of other entities. In other embodiments, gateways are single-tenant and are specifically deployed to be used by just one entity.

FIG. 1 illustrates a cluster of controllers 140 that serve as a central point for managing (e.g., defining and modifying) configuration data that is provided to the edge nodes and/or gateways to configure some or all of the operations. In some embodiments, this controller cluster 140 is in one or more public cloud datacenters, while in other embodiments it is in one or more private datacenters. In some embodiments, the controller cluster 140 has a set of manager servers that define and modify the configuration data, and a set of controller servers that distribute the configuration data to the edge forwarding elements (FEs), hubs and/or gateways. In some embodiments, the controller cluster 140 directs edge forwarding elements and hubs to use certain gateways (i.e., assigns a gateway to the edge forwarding elements and hubs). The controller cluster 140 also provides next hop forwarding rules and load balancing criteria in some embodiments. Also in some embodiments, the controller cluster 140 provides micro-segmentation policies to each of the sites 120-126, as illustrated by the policies 165 sent along the connection links 160.

FIG. 2 illustrates a more in-depth view of part of a virtual network 200 created for a particular entity using SD-WAN forwarding elements deployed at branch sites, datacenters, and public clouds, in some embodiments. This part of the virtual network 200 includes SD-WAN edge forwarding nodes 220 and 222 at the datacenter site 210, and edge forwarding node 224 at branch site 212. The datacenter 210 also includes a switching element 205 that connects the edge forwarding node 224 at the branch site to the edge forwarding nodes 220 and 222 at the datacenter site.

In addition to the edge forwarding nodes 220-222 and the switching element 205, the datacenter 210 also includes an application server 240 and a video server 242. The application server 240 includes three micro-segments (e.g., web, application, and database) on a forwarding element 250. Each micro-segment includes a set of VMs 260a, 260b, and 260c, respectively, which each have a corresponding VNI (e.g., 10001, 20002, and 30003). Similarly, the video server 242 also includes three micro-segments (e.g., web, application, and database) on a forwarding element 252. Each micro-segment includes a respective set of VMs 262a, 262b, and 262c, which also each have a corresponding VNI (e.g., 10001, 20002, and 30003) matching their counterparts on the application server 240.

Similarly, the branch site 212 includes a forwarding element 254 to which a first pair of VMs 264a belonging to VNI 10001 connect, and to which a second pair of VMs 264b belonging to VNI 20002 connect. The branch site 212 connects to the datacenter 210 through the tunnel 274 between the edge forwarding node 224 and switching element 205. In some embodiments, the tunnel 274 is a dynamic multipath optimization (DMPO) tunnel that uses real-time performance metrics of WAN links in order to deliver a resilient overlay network to connect different sites in the SD-WAN.

In some embodiments, in order to allow multiple isolated layer 2 (L2) networks on a single layer 3 (L3) segment, such as the micro-segments in the datacenter 210, a particular tunneling mechanism is provided, such as a Geneve overlay, which creates layer 2 (L2) logical networks encapsulated in user datagram protocol (UDP) packets. In some such embodiments, forwarding elements, such as the switching element 205 do not parse packets deep enough to extract the addition contextual information of a packet having a Geneve overlay encapsulation before forwarding the packet toward its final destination.

For example, FIG. 3 illustrates a frame of a UDP packet having a Geneve encapsulation, in some embodiments. In some embodiments, when a UDP packet is received by a switching element (e.g., 205), the switching element will parse the packet and stop once it reaches row 310 which indicates the packet is a UDP packet. As a result, the switching element tags the packet with a VLAN tag that maps to a single segment on an edge node to which the packet is destined, and forwards the packet to the edge node for delivery to its final destination, according to some embodiments.

When the packet reaches the edge node, the edge node performs DPI on the packet to identify the additional contextual information not provided by the switching element. For example, through DPI, the edge node can identify the particular micro-segment to which the packet is destined, and determine the traffic type of the packet in order to apply any applicable policies to the packet based on the traffic type. In this example packet frame 300, the row 320 (outlined for emphasis) indicates that the packet is a Geneve overlay packet and is destined to a micro-segment associated with the VNI 0x00078b. It should be noted that in some embodiments, more than one VNI can be mapped to a single segment.

Additionally, the last row 330 of the packet frame 300 indicates the packet should be classified as ICMP traffic. Without this pertinent contextual information, the edge node in some embodiments would not be able to apply appropriate policies to the packet and would not be able to correctly forward the packet to its destination.

For example, the dashed lines 280 and 282 represent packet flows from the branch site 212 to the datacenter 210. In some embodiments, without the edge nodes performing DPI to identify the additional contextual information, the packets may end up at VMs belonging to different micro-segments than what was intended for the packet as the switching element views the micro-segments on each edge node as a single segment. For example, rather than path 280 terminating at the third VM in the group 260a, the edge node may direct the packet to the VM 260c in the third micro-segment, in some embodiments.

FIG. 4 illustrates a process 400 performed by an edge node in some embodiments upon receipt of a packet with a Geneve overlay. The process 400 will be described with reference to FIG. 2 and FIG. 5, which illustrates a more detailed view of an edge forwarding node 500, according to some embodiments.

The process 400 starts, at 405, when the edge node receives a packet of a packet flow. For example, in the virtual network 200 the edge forwarding node 220 can receive a packet from the switching element 205 via the tunnel 270. Next, the edge node uses, at 410, DPI on the packet to identify contextual information including the VNI associated with the packet and the AppID (i.e., traffic type) of the packet.

In the example edge node 500, once a packet is received, the packet processor 510 can provide the packet to the DPI engine 520 to identify contextual information of the packet. Once the additional contextual information is identified, the edge node determines, at 415, whether any policies are applicable to the identified VNI and/or AppID. In the edge node 500, for example, after the DPI engine 520 identifies the contextual information, the information is provided to the traffic classifier 530 to determine the traffic type based on the identified AppID. The traffic classifier 530 then provides the information to the policy enforcer 540, which uses the traffic classification and the VNI of the packet to determine whether any policies from the policy storage 550 should be applied to the packet.

When the edge node determines, at 415, that there are no applicable policies for the packet, the process transitions to 425 to forward the packet to the micro-segment to which the destination machine of the packet belongs. Otherwise, when the edge node determines, at 415, that there are applicable policies for the packet based on the VNI and/or traffic classification, the process transitions to 420 to apply the applicable policies to the packet. The edge node then forwards, at 425, the packet to the micro-segment to which the destination machine of the packet belongs.

In the edge node 500, for example, when the policy enforcer 540 identifies one or more applicable policies from the policy storage 550, the policy enforcer then applies the policies to the packet and provides the packet back to the packet processor 510. The packet processor then forwards the processed packet to its destination.

After the packet has been forwarded at 425, the edge node determines, at 430, whether there are additional packets to process. If there are no additional packets to process, the process ends. Otherwise, when the edge node determines that there are additional packets, the process transitions back to 405 to continue to receive packets.

In some embodiments, policies and services are defined for particular traffic classes (i.e., real-time, transactional, and bulk traffic), as well as on a per-VNI basis. The per-VNI policies and services, in some embodiments, include business policies, firewall policies, etc. In some embodiments, VNI group-based policies and services can also be defined. As illustrated in the virtual network 100, the controller cluster in some embodiments provides these policies to the edge nodes for application and enforcement. In some embodiments, the policies are defined by a user (e.g., network administrator) through a manager, which passes the policies to controller for distribution.

FIG. 6 illustrates two example diagrams 600a and 600b of how policies and services for the different micro-segments (VNIs) can be defined in some embodiments. When packets are sent to any of the VNIs 620, 622, and 624, the packets hit the single VDI segment due to VLAN-level mappings in the SD-WAN. As described for the figures above, when packets destined for any of the VNIs on the single segment are received at the edge node, the edge node uses DPI on the packet to identify additional contextual information for the packet, such as VNI and traffic type, and uses that information to identify and apply any applicable policies and/or services.

For example, in the first diagram 600a, when the support VNI 620 receives traffic from application 1, the traffic is treated as high/transactional traffic. Conversely, the same traffic is treated as low/bulk traffic when received at the finance VNI 622, and realtime/high traffic when it's received at the engineering VNI 624. Similarly, traffic from application 2 is treated as realtime/high traffic when destined to the support VNI 620, high/transaction traffic when destined for finance VNI 622, and low/bulk traffic when destined for the engineering VNI 624. In some embodiments, traffic from a particular application may be treated the same by each of the VNIs.

In the second diagram 600b, a different firewall policy is defined for each of the different VNIs. For the support VNI 620, Apache Hadoop traffic is only allowed for the subnet “192.168.100.0/24”. On the finance VNI 622, all UDP traffic destined for the subnet “192.168.11.0/24”. Lastly, all torrent traffic is blocked on the engineering VNI 624 for all subnets. While these are just a few examples of firewall policies that can be defined for each micro-segment, additional, fewer, or other policies may be defined for each of the micro-segments in some embodiments.

Many of the above-described features and applications are implemented as software processes that are specified as a set of instructions recorded on a computer readable storage medium (also referred to as computer readable medium). When these instructions are executed by one or more processing unit(s) (e.g., one or more processors, cores of processors, or other processing units), they cause the processing unit(s) to perform the actions indicated in the instructions. Examples of computer readable media include, but are not limited to, CD-ROMs, flash drives, RAM chips, hard drives, EPROMs, etc. The computer readable media does not include carrier waves and electronic signals passing wirelessly or over wired connections.

In this specification, the term “software” is meant to include firmware residing in read-only memory or applications stored in magnetic storage, which can be read into memory for processing by a processor. Also, in some embodiments, multiple software inventions can be implemented as sub-parts of a larger program while remaining distinct software inventions. In some embodiments, multiple software inventions can also be implemented as separate programs. Finally, any combination of separate programs that together implement a software invention described here is within the scope of the invention. In some embodiments, the software programs, when installed to operate on one or more electronic systems, define one or more specific machine implementations that execute and perform the operations of the software programs.

FIG. 7 conceptually illustrates a computer system 700 with which some embodiments of the invention are implemented. The computer system 700 can be used to implement any of the above-described hosts, controllers, gateway and edge forwarding elements. As such, it can be used to execute any of the above described processes. This computer system includes various types of non-transitory machine readable media and interfaces for various other types of machine readable media. Computer system 700 includes a bus 705, processing unit(s) 710, a system memory 725, a read-only memory 730, a permanent storage device 735, input devices 740, and output devices 745.

The bus 705 collectively represents all system, peripheral, and chipset buses that communicatively connect the numerous internal devices of the computer system 700. For instance, the bus 705 communicatively connects the processing unit(s) 710 with the read-only memory 730, the system memory 725, and the permanent storage device 735.

From these various memory units, the processing unit(s) 710 retrieve instructions to execute and data to process in order to execute the processes of the invention. The processing unit(s) may be a single processor or a multi-core processor in different embodiments. The read-only-memory (ROM) 730 stores static data and instructions that are needed by the processing unit(s) 710 and other modules of the computer system. The permanent storage device 735, on the other hand, is a read-and-write memory device. This device is a non-volatile memory unit that stores instructions and data even when the computer system 700 is off. Some embodiments of the invention use a mass-storage device (such as a magnetic or optical disk and its corresponding disk drive) as the permanent storage device 735.

Other embodiments use a removable storage device (such as a floppy disk, flash drive, etc.) as the permanent storage device. Like the permanent storage device 735, the system memory 725 is a read-and-write memory device. However, unlike storage device 735, the system memory is a volatile read-and-write memory, such as random access memory. The system memory stores some of the instructions and data that the processor needs at runtime. In some embodiments, the invention's processes are stored in the system memory 725, the permanent storage device 735, and/or the read-only memory 730. From these various memory units, the processing unit(s) 710 retrieve instructions to execute and data to process in order to execute the processes of some embodiments.

The bus 705 also connects to the input and output devices 740 and 745. The input devices enable the user to communicate information and select commands to the computer system. The input devices 740 include alphanumeric keyboards and pointing devices (also called “cursor control devices”). The output devices 745 display images generated by the computer system. The output devices include printers and display devices, such as cathode ray tubes (CRT) or liquid crystal displays (LCD). Some embodiments include devices such as touchscreens that function as both input and output devices.

Finally, as shown in FIG. 7, bus 705 also couples computer system 700 to a network 765 through a network adapter (not shown). In this manner, the computer can be a part of a network of computers (such as a local area network (“LAN”), a wide area network (“WAN”), or an Intranet), or a network of networks (such as the Internet). Any or all components of computer system 700 may be used in conjunction with the invention.

Some embodiments include electronic components, such as microprocessors, storage and memory that store computer program instructions in a machine-readable or computer-readable medium (alternatively referred to as computer-readable storage media, machine-readable media, or machine-readable storage media). Some examples of such computer-readable media include RAM, ROM, read-only compact discs (CD-ROM), recordable compact discs (CD-R), rewritable compact discs (CD-RW), read-only digital versatile discs (e.g., DVD-ROM, dual-layer DVD-ROM), a variety of recordable/rewritable DVDs (e.g., DVD-RAM, DVD-RW, DVD+RW, etc.), flash memory (e.g., SD cards, mini-SD cards, micro-SD cards, etc.), magnetic and/or solid state hard drives, read-only and recordable Blu-Ray® discs, ultra-density optical discs, any other optical or magnetic media, and floppy disks. The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations. Examples of computer programs or computer code include machine code, such as is produced by a compiler, and files including higher-level code that are executed by a computer, an electronic component, or a microprocessor using an interpreter.

While the above discussion primarily refers to microprocessor or multi-core processors that execute software, some embodiments are performed by one or more integrated circuits, such as application specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs). In some embodiments, such integrated circuits execute instructions that are stored on the circuit itself.

As used in this specification, the terms “computer”, “server”, “processor”, and “memory” all refer to electronic or other technological devices. These terms exclude people or groups of people. For the purposes of the specification, the terms “display” or “displaying” mean displaying on an electronic device. As used in this specification, the terms “computer readable medium,” “computer readable media,” and “machine readable medium” are entirely restricted to tangible, physical objects that store information in a form that is readable by a computer. These terms exclude any wireless signals, wired download signals, and any other ephemeral or transitory signals.

While the invention has been described with reference to numerous specific details, one of ordinary skill in the art will recognize that the invention can be embodied in other specific forms without departing from the spirit of the invention. For instance, several of the above-described embodiments deploy gateways in public cloud datacenters. However, in other embodiments, the gateways are deployed in a third party's virtual private cloud datacenters (e.g., datacenters that the third party uses to deploy cloud gateways for different entities in order to deploy virtual networks for these entities). Thus, one of ordinary skill in the art would understand that the invention is not to be limited by the foregoing illustrative details, but rather is to be defined by the appended claims.

Claims

1. A method for micro segmenting traffic flows in a software defined wide area network (SD-WAN), the method comprising: at a first edge forwarding node of a first multi-machine site in the SD-WAN, receiving, from a particular forwarding element, a first packet of a packet flow originating from a second multi-machine site that is external to the SD-WAN, the packet flow destined for a particular machine at the first multi-machine site;using deep packet inspection (DPI) on the first packet to identify contextual information about the first packet and the packet flow, said identified contextual information including a parameter that identifies a traffic type associated with the packet flow;assigning the packet flow to a micro-segment based on a virtual network identifier (VNI), wherein each of a plurality of VNIs corresponds to a predefined micro-segment that is associated with a combination of traffic type, service type, and policy set;and based on the traffic type identified by the parameter, identifying a set of one or more policies and applying the identified set of policies to the first packet before forwarding the first packet to the particular machine, the one or more policies comprising micro-segmentation policies provided by a controller cluster;wherein contextual information includes at least a virtual network identifier (VNI) and an AppID, the AppID is the parameter that identifies the traffic type, the first edge forwarding node forwards traffic for a set of micro-segments, and the VNI identifies a particular segment in the set of micro-segments to which the particular machine belongs.

2. The method of claim 1, wherein the packet flow is a first packet flow and the particular machine is a first machine of a first segment, the method further comprising: at the first edge forwarding node, receiving, from the particular forwarding element, a second packet belonging to a second packet flow destined for a second machine of a second segment at the first multi-machine site;using deep packet inspection (DPI) on the second packet to identify contextual information about the second packet and the second packet flow;based on the identified contextual information, identifying another set of one or more policies and applying the other set of policies to the second packet before forwarding the second packet to the second machine, wherein the second machine is in a different segment than the first machine.

3. The method of claim 1, wherein the particular forwarding element is a switching element that tags packets with a particular virtual local area network (VLAN) tag that gets mapped to a single segment on the first edge forwarding node.

4. The method of claim 3, wherein the single VLAN segment comprises a set of VNI-based micro-segments, wherein the VLAN tag does not identify a particular VNI-based micro-segment to which the first packet is destined.

5. The method of claim 4, wherein each VNI-based micro-segment in the set of VNI-based micro-segments comprises machines dedicated to one of a web server, a database server, and an application server.

6. The method of claim 5, wherein applying one or more policies to the first packet based on the identified contextual information comprises applying one or more policies based on the VNI-based micro-segment to which the first packet is destined.

7. The method of claim 1, wherein the first multi-machine site is a multi-tenant datacenter site of the SD-WAN.

8. The method of claim 7, wherein the second multi-machine site is a branch site of the SD-WAN.

9. The method of claim 1, wherein the one or more policies comprise any of firewall policies, middlebox service policies, quality of service (QoS) policies, forwarding policies, and business policies.

10. A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for micro segmenting traffic flows in a software defined wide area network (SD-WAN), the program comprising sets of instructions for: at a first edge forwarding node of a first multi-machine site in the SD-WAN, receiving, from a particular forwarding element, a first packet of a packet flow originating from a second multi-machine site that is external to the SD-WAN, the packet flow destined for a particular machine at the first multi-machine site;using deep packet inspection (DPI) on the first packet to identify contextual information about the first packet and the packet flow, said identified contextual information including a parameter that identifies a traffic type associated with the packet flow;assigning the packet flow to a micro-segment based on a virtual network identifier (VNI), wherein each of a plurality of VNIs corresponds to a predefined micro-segment that is associated with a combination of traffic type, service type, and policy set;and based on the traffic type identified by the parameter, identifying a set of one or more policies and applying the identified set of policies to the first packet before forwarding the first packet to the particular machine, the one or more policies comprising micro-segmentation policies provided by a controller cluster;wherein contextual information includes at least a virtual network identifier (VNI) and an AppID, the AppID is the parameter that identifies the traffic type, the first edge forwarding node forwards traffic for a set of micro-segments, and the VNI identifies a particular segment in the set of micro-segments to which the particular machine belongs.

11. The non-transitory machine readable medium of claim 10, wherein the packet flow is a first packet flow and the particular machine is a first machine of a first segment, the program further comprising sets of instructions for: at the first edge forwarding node, receiving, from the particular forwarding element, a second packet belonging to a second packet flow destined for a second machine of a second segment at the first multi-machine site;using deep packet inspection (DPI) on the second packet to identify contextual information about the second packet and the second packet flow;assigning the packet flow to a micro-segment based on a virtual network identifier (VNI), wherein each of a plurality of VNIs corresponds to a predefined micro-segment that is associated with a combination of traffic type, service type, and policy set; andbased on the identified contextual information, identifying another set of one or more policies and applying the other set of policies to the second packet before forwarding the second packet to the second machine, wherein the second machine is in a different segment than the first machine, the one or more policies comprising micro-segmentation policies provided by a controller cluster.

12. The non-transitory machine readable medium of claim 10, wherein the particular forwarding element is a switching element that tags packets with a particular virtual local area network (VLAN) tag that gets mapped to a single segment on the first edge forwarding node.

13. The non-transitory machine readable medium of claim 12, wherein the single VLAN segment comprises a set of VNI-based micro-segments, wherein the VLAN tag does not identify a particular VNI-based micro-segment to which the first packet is destined.

14. The non-transitory machine readable medium of claim 13, wherein each VNI-based micro-segment in the set of VNI-based micro-segments comprises machines dedicated to one of a web server, a database server, and an application server, wherein the set of instructions for applying one or more policies to the first packet based on the identified contextual information comprises a set of instructions for applying one or more policies based on the VNI-based micro-segment to which the first packet is destined.

15. The non-transitory machine readable medium of claim 10, wherein (i) the first multi-machine site is a multi-tenant datacenter site of the SD-WAN, and (ii) the second multi-machine site is a branch site of the SD-WAN.

16. The non-transitory machine readable medium of claim 10, wherein the one or more policies comprise any of firewall policies, middlebox service policies, quality of service (QoS) policies, forwarding policies, and business policies.