Network extension groups of global VLANs in a fabric switch

Abstract

One embodiment of the present invention provides a switch in a network of interconnected switches. The switch includes a network extension module, which maintains a mapping between a first virtual local area network (VLAN) identifier and a first global VLAN identifier of a network extension group. The network extension group is represented by a range of global VLAN identifiers for a tenant. A global VLAN identifier is persistent in a respective switch of the network and represents a virtual forwarding domain in the network. During operation, the network extension module includes the global VLAN identifier in a packet belonging to the first VLAN.

Description

BACKGROUND

Field

This disclosure relates to communication networks. More specifically, this disclosure relates to a system and method for virtualized network extension.

Related Art

The exponential growth of the Internet has made it a popular delivery medium for a variety of applications running on physical and virtual devices. Such applications have brought with them an increasing demand for bandwidth. As a result, equipment vendors race to build larger and faster switches with versatile capabilities, such as network virtualization and multi-tenancy, to accommodate diverse network demands efficiently. However, the size of a switch cannot grow infinitely. It is limited by physical space, power consumption, and design complexity, to name a few factors. Furthermore, switches with higher capability are usually more complex and expensive. More importantly, because an overly large and complex system often does not provide economy of scale, simply increasing the size and capability of a switch may prove economically unviable due to the increased per-port cost.

A flexible way to improve the scalability of a switch system is to build a fabric switch. A fabric switch is a collection of individual member switches. These member switches form a single, logical switch that can have an arbitrary number of ports and an arbitrary topology. As demands grow, customers can adopt a “pay as you grow” approach to scale up the capacity of the fabric switch.

Meanwhile, layer-2 and layer-3 (e.g., Ethernet and Internet Protocol (IP), respectively) switching technologies continue to evolve. IP facilitates routing and end-to-end data transfer in wide area networks (WANs) while providing safeguards for error-free communication. On the other hand, more routing-like functionalities are migrating into layer-2. Notably, the recent development of the Transparent Interconnection of Lots of Links (TRILL) protocol allows Ethernet switches to function more like routing devices. TRILL overcomes the inherent inefficiency of the conventional spanning tree protocol, which forces layer-2 switches to be coupled in a logical spanning-tree topology to avoid looping. TRILL allows routing bridges (RBridges) to be coupled in an arbitrary topology without the risk of looping by implementing routing functions in switches and including a hop count in the TRILL header.

As Internet traffic is becoming more diverse, network virtualization is becoming progressively more important as a value proposition for network architects. In addition, the evolution of virtual computing has make multi-tenancy attractive and, consequently, placed additional requirements on the network. For example, virtual servers are being allocated to a large number of tenants while a respective tenant operating multiple virtualized networks. It is often desirable that the network infrastructure can provide a large number virtualized network to support multi-tenancy and ensure network separation among the tenants.

While today's networks support many desirable features, some issues remain unsolved in efficiently facilitating virtualized networks across multiple networks.

SUMMARY

One embodiment of the present invention provides a switch in a network of interconnected switches. The switch includes a network extension module, which maintains a mapping between a first virtual local area network (VLAN) identifier and a first global VLAN identifier of a network extension group. The network extension group is represented by a range of global VLAN identifiers for a tenant. A global VLAN identifier is persistent in a respective switch of the network and represents a virtual forwarding domain in the network. During operation, the network extension module includes the global VLAN identifier in a packet belonging to the first VLAN.

In a variation on this embodiment, the mapping maps the first VLAN identifier to an internal identifier, and maps the internal identifier to the first global VLAN identifier. The internal identifier is internal and local to the switch, and is distinct from a VLAN identifier.

In a variation on this embodiment, the range is represented by: (i) a first and a second sets of bits in a continuous representation, and (ii) a tenant bit length indicating a number of bits dedicated to represent the tenant in the continuous representation.

In a variation on this embodiment, the switch is an edge switch. The first global VLAN identifier is then an edge global VLAN identifier of the network extension group. An edge global VLAN identifier corresponds to an individual VLAN of the tenant.

In a variation on this embodiment, the switch is an aggregate switch for one or more edge switches. The first global VLAN identifier is then an aggregate global VLAN identifier of the network extension group. The aggregate global VLAN identifier corresponds to a respective VLAN of the tenant.

In a further variation, the switch also includes an interface module, which maintains a network extension interface forwarding the packet comprising the first global VLAN identifier. The network extension interface couples a second network of interconnected switches.

In a further variation, the switch also includes a tunnel management module, which encapsulates the packet in a tunnel encapsulation header. The network extension interface is then a tunnel interface.

In a further variation, the network extension group is persistent in the second network and represents a virtual forwarding domain in the second network.

In a variation on this embodiment, the switch is an aggregate switch for one or more aggregate switches in remote networks of interconnected switches. The first global VLAN identifier is then an aggregate global VLAN identifier. The aggregate global VLAN identifier corresponds to a plurality of aggregate VLANs of the remote networks.

In a variation on this embodiment, the switch also includes a packet processor, which encapsulates the packet in an encapsulation header. The encapsulation header includes the first global VLAN identifier.

In a variation on this embodiment, the network is a switch group operating as a single Ethernet switch. A respective switch of the network is associated with a group identifier identifying the switch group.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1A illustrates an exemplary network with support for network extension groups, in accordance with an embodiment of the present invention.

FIG. 1B illustrates an exemplary network extension group, in accordance with an embodiment of the present invention.

FIG. 1C illustrates exemplary mappings for supporting network extension groups, in accordance with an embodiment of the present invention.

FIG. 2A illustrates an exemplary network extension based on network extension groups, in accordance with an embodiment of the present invention.

FIG. 2B illustrates an exemplary tunnel-based network extension based on network extension groups, in accordance with an embodiment of the present invention.

FIG. 2C illustrates an exemplary hierarchical network extension based on network extension groups, in accordance with an embodiment of the present invention.

FIG. 3 presents a flowchart illustrating the process of a switch initializing a network extension group, in accordance with an embodiment of the present invention.

FIG. 4A presents a flowchart illustrating the process of an edge switch forwarding a packet based on a network extension group, in accordance with an embodiment of the present invention.

FIG. 4B presents a flowchart illustrating the process of an aggregate switch forwarding a packet based on a network extension group, in accordance with an embodiment of the present invention.

FIG. 5 illustrates an exemplary switch with support for network extension groups, in accordance with an embodiment of the present invention.

In the figures, like reference numerals refer to the same figure elements.

DETAILED DESCRIPTION

The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the claims.

Overview

In embodiments of the present invention, the problem of facilitating efficient network virtualization is solved by creating a network extension group consistent within a network and persistent across multiple networks. A network can include a number of interconnected member switches. Typically, a tenant (e.g., a client or customer) deploys a plurality of end devices (e.g., physical servers or virtual machines) belonging to different virtual local area networks (VLANs) (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1Q VLANs). Since the network can serve a plurality of tenants, each deploying a number of VLANs, a respective member switch of the network can serve a plurality of tenants while a plurality of member switches can serve the same tenant. Furthermore, a tenant can deploy its end devices across different networks. As a result, a network requires a large number of VLANs which are consistent within the network and persistent across multiple networks.

With existing technologies, the total number of VLANs a network can support for a tenant is limited by the number of bits dedicated for a VLAN identifier. On the other hand, if a tenant does not need a large number of VLANs, the same number of bits, though unused, remains dedicated for that tenant. If an additional VLAN identifier is incorporated in a packet to identify a respective tenant in a network, the number of tenants is limited by the number of bits dedicated for the additional VLAN identifier.

To solve this problem, member switches in a network provides a network extension group for a respective tenant. The network extension group is consistent within a network and can be persistent across multiple networks. The network extension group includes a range of global VLANs. A global VLAN creates a virtual forwarding domain within the network. A respective switch can select a global VLAN from the range as an aggregate global VLAN and the rest can operate as edge global VLANs. In some embodiments, a respective global VLAN in a network extension group is represented using the combined bits dedicated for both tenant and additional VLAN identifiers in a flat representation. As a result, a global VLAN identifier can be represented using any number of bits in the combined bits for representing a tenant and using the rest of the bits for representing a respective VLAN for the tenant.

An edge switch of a network, which receives packets via a local edge port from a device of a tenant, maps tenant VLANs to corresponding edge global VLANs specified in the network extension group for the tenant. This mapping can be local to the edge switch. In other words, the same tenant VLAN can be mapped to different edge global VLANs in different edge switches. On the other hand, an aggregate switch, which does not couple a device of the tenant via a local edge port, maintains the aggregate global VLAN specified in the network extension group for all VLANs for that tenant. Since the aggregate switch uses less hardware resources to support fewer numbers of aggregate global VLANs, the network extension group provides scalability within the network and allows an aggregate switch to support multiple edge switches.

Furthermore, a network extension group can be persistent in multiple networks. An aggregate switch can include the aggregate global VLAN identifier in a packet sent via the interconnection between the networks. In this way, a persistent network extension group allows interconnectivity of networks without being limited by the tenant VLANs at the interconnection. This increases the number of VLANs a tenant may have in a network. The persistent network extension group also facilitates a better representation of a tenant in the network. For example, the network can support more tenants than the number of tenants supported by an additional VLAN identifier (e.g., an IEEE 802.1ad tag). This allows a provider to deploy multiple smaller networks to form a large network, thereby facilitating isolation of network management and fault detection within respective small networks.

In some embodiments, a global VLAN of a network extension group can support Internet Protocol (IP) routing. A global VLAN then can be associated with an IP sub-network (subnet) and can operate as a logical layer-3 interface assigned with an IP address from the subnet in a respective aggregate switch. A respective aggregate switch can maintain a mapping between the global VLAN and the corresponding subnet. In some embodiments, the layer-3 interface operates as a default gateway for the corresponding global VLAN and is assigned a virtual IP address, which is consistent in a respective aggregate switch. Because the layer-3 interface is associated with the same virtual IP address in a respective aggregate switch, the layer-3 interface operates as a distributed layer-3 gateway, and can operate as a tunnel endpoint to forward traffic across network.

In some embodiments, the network is a fabric switch. In a fabric switch, any number of switches coupled in an arbitrary topology may logically operate as a single switch. The fabric switch can be an Ethernet fabric switch or a virtual cluster switch (VCS), which can operate as a single Ethernet switch. Any member switch may join or leave the fabric switch in “plug-and-play” mode without any manual configuration. In some embodiments, a respective switch in the fabric switch is a Transparent Interconnection of Lots of Links (TRILL) routing bridge (RBridge). In some further embodiments, a respective switch in the fabric switch is an Internet Protocol (IP) routing-capable switch (e.g., an IP router).

It should be noted that a fabric switch is not the same as conventional switch stacking. In switch stacking, multiple switches are interconnected at a common location (often within the same rack), based on a particular topology, and manually configured in a particular way. These stacked switches typically share a common address, e.g., an IP address, so they can be addressed as a single switch externally. Furthermore, switch stacking requires a significant amount of manual configuration of the ports and inter-switch links. The need for manual configuration prohibits switch stacking from being a viable option in building a large-scale switching system. The topology restriction imposed by switch stacking also limits the number of switches that can be stacked. This is because it is very difficult, if not impossible, to design a stack topology that allows the overall switch bandwidth to scale adequately with the number of switch units.

In contrast, a fabric switch can include an arbitrary number of switches with individual addresses, can be based on an arbitrary topology, and does not require extensive manual configuration. The switches can reside in the same location, or be distributed over different locations. These features overcome the inherent limitations of switch stacking and make it possible to build a large “switch farm,” which can be treated as a single, logical switch. Due to the automatic configuration capabilities of the fabric switch, an individual physical switch can dynamically join or leave the fabric switch without disrupting services to the rest of the network.

Furthermore, the automatic and dynamic configurability of the fabric switch allows a network operator to build its switching system in a distributed and “pay-as-you-grow” fashion without sacrificing scalability. The fabric switch's ability to respond to changing network conditions makes it an ideal solution in a virtual computing environment, where network loads often change with time.

It should also be noted that a fabric switch is distinct from a VLAN. A fabric switch can accommodate a plurality of VLANs. A VLAN is typically identified by a VLAN tag. In contrast, the fabric switch is identified a fabric identifier (e.g., a VCS identifier), which is assigned to the fabric switch. A respective member switch of the fabric switch is associated with the fabric identifier. Furthermore, when a member switch of a fabric switch learns a media access control (MAC) address of an end device (e.g., via layer-2 MAC address learning), the member switch generates a notification message, includes the learned MAC address in the payload of the notification message, and sends the notification message to all other member switches of the fabric switch. In this way, a learned MAC address is shared among a respective member switch of the fabric switch.

In this disclosure, the term “fabric switch” refers to a number of interconnected physical switches which form a single, scalable logical switch. These physical switches are referred to as member switches of the fabric switch. In a fabric switch, any number of switches can be connected in an arbitrary topology, and the entire group of switches functions together as one single, logical switch. This feature makes it possible to use many smaller, inexpensive switches to construct a large fabric switch, which can be viewed as a single logical switch externally. Although the present disclosure is presented using examples based on a fabric switch, embodiments of the present invention are not limited to a fabric switch. Embodiments of the present invention are relevant to any computing device that includes a plurality of devices operating as a single device.

Although the present disclosure is presented using examples based on an encapsulation protocol, embodiments of the present invention are not limited to networks defined using one particular encapsulation protocol associated with a particular Open System Interconnection Reference Model (OSI reference model) layer. For example, embodiments of the present invention can also be applied to a multi-protocol label switching (MPLS) network. In this disclosure, the term “encapsulation” is used in a generic sense, and can refer to encapsulation in any networking layer, sub-layer, or a combination of networking layers.

The term “end device” can refer to any device external to a network (e.g., does not perform forwarding in that network). Examples of an end device include, but are not limited to, a physical or virtual machine, a conventional layer-2 switch, a layer-3 router, or any other type of network device. Additionally, an end device can be coupled to other switches or hosts further away from a layer-2 or layer-3 network. An end device can also be an aggregation point for a number of network devices to enter the network. An end device hosting one or more virtual machines can be referred to as a host machine. In this disclosure, the terms “end device” and “host machine” are used interchangeably.

The term “hypervisor” is used in a generic sense, and can refer to any virtual machine manager. Any software, firmware, or hardware that creates and runs virtual machines can be a “hypervisor.” The term “virtual machine” also used in a generic sense and can refer to software implementation of a machine or device. Any virtual device which can execute a software program similar to a physical device can be a “virtual machine.” A host external device on which a hypervisor runs one or more virtual machines can be referred to as a “host machine.”

The term “VLAN” is used in a generic sense, and can refer to any virtualized network. Any virtualized network comprising a segment of physical networking devices, software network resources, and network functionality can be can be referred to as a “VLAN.” “VLAN” should not be interpreted as limiting embodiments of the present invention to layer-2 networks. “VLAN” can be replaced by other terminologies referring to a virtualized network or network segment, such as “Virtual Private Network (VPN),” “Virtual Private LAN Service (VPLS),” or “Easy Virtual Network (EVN).”

The term “packet” refers to a group of bits that can be transported together across a network. “Packet” should not be interpreted as limiting embodiments of the present invention to layer-3 networks. “Packet” can be replaced by other terminologies referring to a group of bits, such as “frame,” “cell,” or “datagram.”

The term “switch” is used in a generic sense, and can refer to any standalone or fabric switch operating in any network layer. “Switch” can be a physical device or software running on a computing device. “Switch” should not be interpreted as limiting embodiments of the present invention to layer-2 networks. Any device that can forward traffic to an external device or another switch can be referred to as a “switch.” Examples of a “switch” include, but are not limited to, a layer-2 switch, a layer-3 router, a TRILL RBridge, or a fabric switch comprising a plurality of similar or heterogeneous smaller physical switches.

The term “RBridge” refers to routing bridges, which are bridges implementing the TRILL protocol as described in Internet Engineering Task Force (IETF) Request for Comments (RFC) “Routing Bridges (RBridges): Base Protocol Specification,” available at http://tools.ietf.org/html/rfc6325, which is incorporated by reference herein. Embodiments of the present invention are not limited to application among RBridges. Other types of switches, routers, and forwarders can also be used.

The term “edge port” refers to a port on a network which exchanges data frames with a device outside of the network (i.e., an edge port is not used for exchanging data frames with another member switch of a network). The term “inter-switch port” refers to a port which sends/receives data frames among member switches of the network. The terms “interface” and “port” are used interchangeably.

The term “switch identifier” refers to a group of bits that can be used to identify a switch. Examples of a switch identifier include, but are not limited to, a media access control (MAC) address, an Internet Protocol (IP) address, and an RBridge identifier. Note that the TRILL standard uses “RBridge ID” (RBridge identifier) to denote a 48-bit intermediate-system-to-intermediate-system (IS-IS) System ID assigned to an RBridge, and “RBridge nickname” to denote a 16-bit value that serves as an abbreviation for the “RBridge ID.” In this disclosure, “switch identifier” is used as a generic term, is not limited to any bit format, and can refer to any format that can identify a switch. The term “RBridge identifier” is also used in a generic sense, is not limited to any bit format, and can refer to “RBridge ID,” “RBridge nickname,” or any other format that can identify an RBridge.

The term “tunnel” refers to a data communication where one or more networking protocols are encapsulated using another networking protocol. Although the present disclosure is presented using examples based on a layer-3 encapsulation of a layer-2 protocol, “tunnel” should not be interpreted as limiting embodiments of the present invention to layer-2 and layer-3 protocols. A “tunnel” can be established for and using any networking layer, sub-layer, or a combination of networking layers.

Network Architecture

FIG. 1A illustrates an exemplary network with support for network extension groups, in accordance with an embodiment of the present invention. As illustrated in FIG. 1A, a network 100 includes member switches 101, 102, 103, 104, and 105. Network 100 can be a TRILL network and a respective member switch, such as switch 105, can be a TRILL RBridge. Network 100 can also be an IP network and a respective member switch, such as switch 105, can be an IP-capable switch, which calculates and maintains a local IP routing table (e.g., a routing information base or RIB), and is capable of forwarding packets based on its IP addresses. In some embodiments, network 100 is a fabric switch, and one or more switches in fabric switch 100 can be virtual switches (e.g., a software switch running on a computing device).

Switches 103 and 105 are coupled to host machines 120 and 130, respectively. Member switches in network 100 use edge ports to communicate with end devices and inter-switch ports to communicate with other member switches. For example, switch 103 is coupled to end devices, such as host machine 120, via edge ports and to switches 101, 102, and 104 via inter-switch ports. Host machines 120 and 130 include hypervisors 121 and 131, respectively. Virtual machines (VMs) 122, 123, 124, 125, and 126 run on hypervisor 121, and virtual machines 132, 133, 134, 135, and 136 run on hypervisor 131.

In this example, virtual machines 124, 125, 134, 135, and 136 belong to a tenant 1 and virtual machines 122, 123, 126, 132, and 133 belong to a tenant 2. Tenant 1 deploys VLANs 112 and 114, and tenant 2 deploys VLANs 112 and 116. Hence, the same VLAN identifier can be used by multiple tenants. Virtual machines 125, 134, and 135 are in VLAN 112 of tenant 1, virtual machines 124 and 136 are in VLAN 114 of tenant 1, virtual machines 122 and 133 are in VLAN 112 of tenant 2, and virtual machines 123, 126, and 132 are in VLAN 116 of tenant 2. Since network 100 is serving a plurality of tenants, each deploying a plurality of VLANs, a respective member switch of network 100 can serve both tenants 1 and 2, and a plurality of member switches can serve the same tenant 1 or 2.

With existing technologies, the total number of VLANs network 100 can support for tenant 1 or 2 is limited by the number of bits dedicated for a VLAN identifier (e.g., 12 bits in an IEEE 802.1Q tag). On the other hand, if tenant 1 or 2 does not need a large number of VLANs, the same number of bits, though unused, remains dedicated for that tenant. If an additional VLAN identifier (e.g., an IEEE 802.1ad tag or TRILL Fine Grain Labels (FGL)) is incorporated in a packet to identify tenant 1 or 2 in network 100, the number of tenants is limited by the number of bits dedicated for the additional VLAN identifier (e.g., an additional 12 bits in the 802.1ad tag).

To solve this problem, a respective member switch in network 100 supports a network extension group for a respective tenant. For example, a respective member switch in network 100 supports network extension groups 150 and 155 for tenants 1 and 2, respectively. A respective of network extension groups 150 and 155 includes a range of global VLAN identifiers and are consistent within network 100. As a result, a global VLAN of a network extension group in a respective member switch of network 100 remains within the range. A member switch can select one global VLAN as an aggregate global VLAN and the rest as edge global VLANs. For example, network extension group 150 includes aggregate global VLAN 152 and edge global VLANs 142 and 144. Similarly, network extension group 155 includes aggregate global VLAN 154 and edge global VLANs 146 and 148.

In network 100, switches 103, 104, and 105 are edge switches since these switches receive packets via edge ports from tenant devices. An edge switch in network 100 maps a VLAN of a tenant (i.e., a tenant VLAN) to a corresponding edge global VLAN specified in the network extension group for that tenant. For example, switches 103 and 105 maintain a mapping between VLANs 112 and 114 of tenant 1, and edge global VLANs 142 and 144, respectively, of network extension group 150. Here, the mapping is maintained using VLAN identifiers and their corresponding global VLAN identifiers. Switches 103 and 105 also maintain a mapping between VLANs 112 and 116 of tenant 2, and edge global VLANs 146 and 148, respectively, of network extension group 155. In this example, switch 103 determines that, since they belong to different tenants, virtual machines 122 and 125 are in different layer-2 domains even though they are configured with the same tenant VLAN identifier. As a result, switch 103 associates virtual machines 122 and 125 to global VLANs 148 and 142, respectively.

In some embodiments, the mapping between a tenant VLAN and a global VLAN can be local to a switch. For example, switch 103 can maintain a mapping between VLANs 112 and 116 of tenant 2, and edge global VLANs 146 and 148, respectively, of network extension group 155. On the other hand, another edge switch 105 can maintain a mapping between VLANs 112 and 116 of tenant 2, and edge global VLANs 148 and 146, respectively. However, a respective global VLAN identifier in switches 103 and 105 remains within the range of global VLAN identifiers associated with network extension group 155.

In network 100, switches 101 and 102 are aggregate switches for tenants 1 and 2 since switch 101 and 102 do not couple a device of tenants 1 and 2 via a local edge port. However, because switch 101 couples end device 110 of another tenant, switch 101 can be an edge switch for that tenant. An aggregate switch in network 100 maps an aggregate global VLAN specified in a network extension group for all VLANs of the corresponding tenant. For example, switch 101 maintains a mapping between tenant information of tenant 1, and aggregate global VLAN 152 of network extension group 150. Here, the mapping may be maintained without using a tenant VLAN identifier.

Since switch 101 does not forward packets to individual devices of tenant 1, switch 101 does not need to enforce VLAN separation to the traffic from tenant 1. As a result, packets belonging to a respective VLAN of tenant 1 can be mapped to the same aggregate global VLAN in switch 101. In some embodiments, another aggregate switch 102 can map tenant information of tenant 1 to another aggregate global VLAN if it is within the range of network extension group 150 (i.e., the VLAN identifier of the aggregate global VLAN is within the range of network extension group 150).

In some embodiments, switches in network 100 receive the mappings from a network manager. End device 110 can operate as a network manager. Examples of a network manager include, but are not limited to, VMWare vCenter, Citrix XenCenter, and Microsoft Virtual Machine Manager. A network administrator can configure the mapping from end device 110, which in turn, provides the mapping to switch 101. Switch 101 distributes the mapping to the corresponding member switch based on an internal information distribution service of network 100. Suppose that the network manager configures a mapping between tenant information of tenant 1 and aggregate global VLAN 152 for switch 102 from end device 110. Switch 101 receives the mapping and provides the mapping to switch 102.

In some embodiments, a packet forwarded via an inter-switch link in network 100 is encapsulated in an encapsulation header. The encapsulation header can be a fabric encapsulation header (e.g., an encapsulation header used to forward the packet in a fabric switch) or a tunnel header (e.g., an encapsulation header used to forward the packet via a tunnel). Examples of a fabric encapsulation header include, but are not limited to, a TRILL header, an IP header, an Ethernet header, and a combination thereof. Examples of a tunnel include, but are not limited to, Virtual Extensible Local Area Network (VXLAN), Generic Routing Encapsulation (GRE), and its variations, such as Network Virtualization using GRE (NVGRE) and openvSwitch GRE. The VLAN identifier of a global VLAN can be included in the encapsulation header.

During operation, virtual machine 125 sends a packet 190. Hypervisor 121 obtains packet 190 and sends it to switch 103. Upon receiving packet 190 via an edge port, switch 103 identifies that packet 190 belongs to VLAN 112 of tenant 1. Based on the local mapping, switch 103 determines that VLAN 112 of tenant 1 is mapped to edge global VLAN 142. Switch 103 encapsulates packet 190 in an encapsulate header to generate a transport packet 192. A packet used to transport traffic between an edge switch and an aggregate switch in a network can be referred to as a transport packet. Switch 103 includes the VLAN identifier of edge global VLAN 142 in the encapsulation header of packet 192 and forwards packet 192 to aggregate switch 102. Upon receiving packet 192, switch 102 processes packet 192 based on its header information.

In some embodiments, a respective member switch of network 100 (e.g., switch 103) runs a control plane with automatic configuration capabilities based on Fibre Channel (FC) protocol and forms a logical Ethernet switch based on the automatic configuration capabilities of the control plane. To an external end device, such as host machine 120, network 100 can appear as one, single Ethernet switch. Upon joining network 100 via the control plane, a respective member switch receives an automatically assigned identifier corresponding to the logical Ethernet switch. However, unlike an FC fabric, the data packets in network 100 can be encapsulated and forwarded based on another forwarding protocol. Examples of this forwarding protocol include, but are not limited to, Ethernet, TRILL, and IP. Furthermore, a respective member switch of network 100 can be associated with a group identifier, which identifies network 100 as a group of interconnected switches. If network 100 is a fabric switch, this group identifier can be a fabric identifier identifying the fabric switch.

In some embodiments, network 100 maintains a port profile for a respective virtual machine. A port profile represents Fibre Channel over Ethernet (FCoE) configuration, VLAN configuration, data center bridging (DCB) configuration, quality of service (QoS) configuration, and/or security configuration of one or more virtual machines. The MAC address of a virtual machine associates with the corresponding port profile to the virtual machine. The VLAN configuration in a port profile can indicate the global VLAN configuration for the virtual machine. Port profile management in a switch is specified in U.S. Patent Publication No. 2011/0299413, titled “Port profile management for virtual cluster switching,” the disclosure of which is incorporated herein in its entirety.

A respective member switch, such as switch 103, locally maintains network extension group to facilitate its fabric-wide deployment. FIG. 1B illustrates an exemplary network extension group, in accordance with an embodiment of the present invention. In some embodiments, a respective global VLAN in a network extension group is represented using the combined bits dedicated for both tenant and additional VLAN identifiers in a flat (e.g., a continuous and non-hierarchical) representation. Suppose that a tenant VLAN identifier is represented by A bits 162 and an additional VLAN identifier is represented by B bits 164. In some embodiments, a respective global VLAN in network extension group 150 is identified by a global VLAN identifier represented by the combined bits 162 and 164 of A.B (e.g., a concatenation) in a flat representation.

Starting from the most significant bit (MSB), any number of bits in A.B can be used to represent tenant 1. These bits can be referred to as tenant bits 166. The length of tenant bits 166 can be variable (denoted with a dotted arrow). For example, tenant bits 166 can include a subset of continuous bits in A from the MSB, or all bits of A and a subset of adjacent bits in B. Rest of the bits of A.B can be used to distinctly represent a respective global VLAN for tenant 1. These bits can be referred to as VLAN bits 168. If the length of tenant bits 166 is C, the global VLAN identifiers of network extension group 150 can be represented as A.B/C. Hence, aggregate global VLAN 152, and edge global VLANs 142 and 144 correspond to A.B/C. In this way, a respective switch in network 150 is aware of the bits dedicated as tenant bits 166 and can independently assign global VLAN identifiers corresponding to A.B/C.

For example, if the length of A and B is 12 bits each (e.g., IEEE 802.1ad tag or TRILL FGL), and A.B/C is 4.8./21, the most significant 21 bits of 000000000100.000000001000 is assigned as tenant bits 166 and the rest 3 bits (underlined bits) are assigned as VLAN bits 168. As a result, network extension group 150 facilitates 8 VLANs for tenant 1 in network 100 (e.g., global VLAN identifiers between 4.8 and 4.15) using VLAN bits 168. It should be noted that any number of bits, starting from the least significant bit (LSB), in A.B can also be used to represent a tenant or a VLAN, and rest of the bits can be used to represent a VLAN or tenant, respectively.

FIG. 1C illustrates exemplary mappings for supporting network extension groups, in accordance with an embodiment of the present invention. In this example, edge switch 103 maintains an internal identifier 172 (e.g., in a table, which can be a database table in a local persistent storage). An entry in mapping 172 maps one or more fields of a packet header to an internal identifier. This internal identifier is internal and local to switch 103, and not included in a packet in network 100. Mapping 172 maps VLANs 112 and 114 of tenant 1, and corresponding tenant information, to internal identifiers 182 and 184, respectively, and VLANs 112 and 116 of tenant 2, and corresponding tenant information, to internal identifiers 186 and 188, respectively. Examples of the tenant information include, but are not limited to, a tenant identifier, an IP subnet, a source MAC address, an ingress port, and a combination thereof.

Switch 103 also includes a global VLAN mapping 174. An entry in mapping 174 maps an internal identifier to a corresponding global VLAN. Mapping 174 maps internal identifiers 182 and 184 to edge global VLANs 142 and 144, respectively, and internal identifiers 186 and 188 to edge global VLANs 146 and 148, respectively. In some embodiments, internal identifiers 182, 184, 186, and 188 in switch 103 are mapped to one or more corresponding egress ports. If the header information of an ingress packet matches an internal identifier, switch 103 forwards that packet via the corresponding egress port.

On the other hand, aggregate switch 101 maintains an internal identifier mapping 176. An entry in mapping 176 maps one or more fields of a packet header to an internal identifier. Mapping 176 maps tenant information of tenant 1, regardless of any VLAN association, to an internal identifier 182. Similarly, mapping 176 maps tenant information of tenant 2, regardless of any VLAN association, to an internal identifier 184. In this way, the same internal identifier 182 can be mapped to different packet fields in different switches 103 and 101. Switch 101 also includes a global VLAN mapping 178. An entry in mapping 178 maps an internal identifier to a corresponding global VLAN. Mapping 178 maps internal identifiers 182 and 184 to aggregate global VLANs 152 and 154, respectively.

Since switch 101 does not forward packets for tenants 1 and 2 via a local edge port to a tenant device, mapping 178 does not distinguish between individual tenant VLANs of a tenant. Since mappings 176 and 178 are smaller than mappings 172 and 174, respectively, mappings 176 and 178 need less hardware resources. Hence, and network extension group 150 provides scalability in network 100 and allows aggregate switch 101 to support multiple edge switches 103, 104, and 105. In some embodiments, internal identifiers 182 and 184 in switch 101 are mapped to a corresponding egress port. If the header information of an ingress packet matches an internal identifier, switch 101 forwards that packet via the corresponding egress port.

Network Extension

In some embodiments, network extension group 150 can be persistent in multiple networks. FIG. 2A illustrates an exemplary network extension based on network extension groups, in accordance with an embodiment of the present invention. In this example, network 100 is coupled to network 200, which includes member switches 201, 202, 203, 204, and 205. Network 200 can be a TRILL network and a respective member switch, such as switch 205, can be a TRILL RBridge. Network 200 can also be an IP network and a respective member switch, such as switch 205, can be an IP-capable switch, which calculates and maintains a local IP routing table (e.g., a routing information base or RIB), and is capable of forwarding packets based on its IP addresses. In some embodiments, network 200 is a fabric switch, and one or more switches in fabric switch 200 can be virtual switches (e.g., a software switch running on a computing device).

In network 200, switches 203, 204, and 205 can operate as edge switches, and switches 201 and 202 can operate as aggregate switches. Switch 205 is coupled to host machine 220. Member switches in network 200 use edge ports to communicate with end devices and inter-switch ports to communicate with other member switches. For example, switch 205 is coupled to end devices, such as host machine 220, via edge ports and to switches 201, 202, and 204 via inter-switch ports. Host machine 220 includes hypervisors 221. Virtual machines 222, 223, and 224 run on hypervisor 221 and belong to tenant 1. Virtual machine 224 is in VLAN 112 of tenant 1, and virtual machines 222 and 223 are in VLAN 114 of tenant 1.

Suppose that packet 190 is destined to virtual machine 224 in host machine 220 coupled to network 200. With existing technologies, when transport packet 192, which includes packet 190 in its payload, reaches aggregate switch 102, switch 102 removes the encapsulation header, extracts packet 190, and forwards packet 190 to network 200 (e.g., either to switch 201 or 203). As a result, packet 190 can only carry the VLAN identifier (e.g., 12 bits in an IEEE 802.1Q tag) of tenant VLAN 112. Hence, the total number of VLANs a port of switch 102 coupling network 200 can support for tenant 1 is limited by the number of bits dedicated for the VLAN identifier. Furthermore, additional VLAN identifiers (e.g., an IEEE 802.1ad tags or TRILL FGLs) for representing tenant 1 can be different in networks 100 and 200. This leads to additional VLAN configuration in the member switches of network 200.

To solve this problem, interconnections between networks 100 and 200 are established via network extension interfaces (NEIs). A packet sent via a network extension interface includes an aggregate global VLAN identifier. Examples of a network extension interface include, but are not limited to, a physical or virtual port, a set of trunked port (e.g., a port channel interface), and a tunnel interface (e.g., a VXLAN or NVGRE tunnel interface). Furthermore, network extension group 150 can be persistent across network 100 and 200. As a result, the same range of global VLAN identifiers represented by A.B/C is used in network 200.

In some embodiments, a MAC address learned in network 200 is shared with network 100. Suppose that switch 205 learns the MAC address of virtual machine 224 (e.g., via MAC address learning or pre-configuration). Switch 205 generates a notification message, includes the learned MAC address in the payload of the notification message, and sends the notification message to a respective other member switch of network 200. Upon receiving the notification message, switch 201 learns the MAC address of virtual machine 224. Switch 201 also determines that it has network extension interfaces coupling network 100.

Switch 201 then sends an extension notification message comprising the learned MAC address via its local network extension interfaces. Upon receiving the extension notification message, switch 102 (or 105) learns the MAC address to be reachable via its local network extension interface. Switch 102 can map the learned MAC address to the network extension interface. Switch 102 then includes the learned MAC address in the payload of a notification message and sends the notification message to a respective other switch of network 100. A respective switch of network 100 thus learns the MAC address to be reachable via switch 102.

In this example, switch 102 can include the VLAN identifier of aggregate global VLAN 152 in the header of packet 190 to generate an extension packet 212. A packet sent via a network extension interface can be referred to as an extension packet. Switch 102 then forwards packet 212 to network 200. Suppose that switch 201 receives packet 212. Upon detecting the VLAN identifier of aggregate global VLAN 152 in its header, switch 201 determines that packet 212 belongs to network extension group 152. Switch 201 then extracts the VLAN identifier to obtain packet 190. Switch 201 encapsulates packet 190 in an encapsulation header to generate transport packet 214, includes the VLAN identifier of aggregate global VLAN 152 in the encapsulation header, and forwards packet 214 to switch 205. In this way, persistent network extension group 150 allows interconnectivity between networks 100 and 200 using network extension interfaces at the interconnection. This increases the number of VLANs tenant 1 may have in networks 100 and 200.

In some embodiments, a network extension interface can be a tunnel interface. FIG. 2B illustrates an exemplary tunnel-based network extension based on network extension groups, in accordance with an embodiment of the present invention. In this example, networks 100 and 200 are coupled via a layer-3 network 280. Hence, the network extension interfaces of networks 100 and 200 are tunnel interfaces (e.g., a VXLAN or NVGRE tunnel interface). One or more aggregate switches of network 100 establish corresponding tunnels 270 with one or more aggregate switches of network 200 via network 280. Network extension group 150 can be persistent across network 100 and 200. As a result, the same range of global VLAN identifiers represented by A.B/C is used in network 200.

Upon generating extension packet 212, which includes VLAN identifier of aggregate global VLAN 152, switch 102 encapsulates packet 212 in a tunnel encapsulation header (e.g., a VXLAN or NVGRE header) to generate tunnel-encapsulated extension packet 216. Suppose that switch 201 of network 200 is the remote tunnel endpoint of the tunnel. Switch 102 sets the switch identifier (e.g., an IP address) of switch 201 as the destination switch identifier of the tunnel encapsulation header, identifies the local port associated with the tunnel interface, and forwards packet 216 via the port. Switch 201 receives packet 216, identifies the local switch as the destination switch, and decapsulates the tunnel encapsulation header to obtain packet 212. Switch 201 then extracts the VLAN identifier of aggregate global VLAN 152 from packet 212 to obtain packet 190 and forwards packet 190 based on its header, as described in conjunction with FIG. 2A.

In some embodiments, aggregate global VLAN 152 of network extension group 150 can support Internet Protocol (IP) routing and can be associated with an IP subnet. Aggregate global VLAN 152 operates as a logical layer-3 interface assigned with an IP address, which can be a virtual IP address, from the subnet in aggregate switches 101 and 102. Switches 101 and 102 can maintain a mapping between aggregate global VLAN 152 and the corresponding subnet. In some embodiments, the layer-3 interface operates as a default gateway for a respective global VLAN of network extension group 150. Because the layer-3 interface is associated with the same virtual IP address in switches 101 and 102, the layer-3 interface operates as a distributed layer-3 gateway, and can operate as the tunnel endpoint address for the tunnels between networks 100 and 200.

Hierarchical Network Extension

Since a persistent network extension group allows interconnectivity between networks based on network extension interfaces, a provider can deploy multiple smaller networks to form a large hierarchical network. FIG. 2C illustrates an exemplary hierarchical network extension based on network extension groups, in accordance with an embodiment of the present invention. In this example, network 210 includes member switches 211, 212, 213, 214, and 215; and network 230 can include member switches 231, 232, and 233.

Network 210 and/or 230 can be a TRILL network and a respective member switch can be a TRILL RBridge. Network 210 and/or 230 can also be an IP network and a respective member switch can be an IP-capable switch, which calculates and maintains a local IP routing table (e.g., a routing information base or RIB), and is capable of forwarding packets based on its IP addresses. In some embodiments, network 210 and/or 230 are fabric switches, and one or more member switches can be virtual switches (e.g., a software switch running on a computing device). Member switches in network 210 and/or 230 use edge ports to communicate with end devices and inter-switch ports to communicate with other member switches.

Networks 100 and 210 are coupled to network 230. Suppose that two tenant networks 262 and 264, which can belong to the same or different tenants, are coupled to networks 100 and 210, respectively. A tenant network can include one or more host machines, each of which can host one or more virtual machines. For example, tenant network 262 can belong to tenant 1. Network extension groups 150 and 250 are configured for tenant networks 262 and 264, respectively, in networks 100 and 210, respectively. Network extension groups 150 and 250 include aggregate global VLANs 152 and 252, respectively.

In network 210, switches 213, 214, and 215 can operate as edge switches, and switches 211 and 212 can operate as aggregate switches. Hence, switches 211 and 212 include the VLAN identifier of aggregate VLAN 252 in extension packets which carries packets from tenant network 264. Since network 230 couple networks 100 and 210, member switches 231, 232, and 233 can operate as aggregate switches for the aggregate switches of networks 100 and 210. For example, aggregate global VLANs 152 and 252 can be further aggregated in network 230. A hierarchical network extension group 260 can be configured in network 230. Hierarchical network extension group 260 include aggregate global VLANs 152 and 252, and a hierarchical aggregate global VLAN 262.

Aggregate switches in network 100 or 210 forward packets from tenant network 262 or 264, respectively, to network 230 via hierarchical network extensions. In some embodiments, network extension interfaces of networks 100, 210, and 230 form the hierarchical network extensions. Upon identifying aggregate global VLAN 152 or 252 in an extension packet, a member switch in network 230 associates the packet with hierarchical network extension group 260, and use the VLAN identifier of hierarchical aggregate global VLAN 262 for any further communication. This allows a provider to deploy multiple smaller networks 100, 210, and 230 to form a large hierarchical network, thereby facilitating isolation of network management and fault detection within networks 100, 200, and 230.

Initialization and Operations

In the example in FIG. 1A, a respective member switch in network 100 initializes network extension groups 150 and 155. FIG. 3 presents a flowchart illustrating the process of a switch initializing a network extension group, in accordance with an embodiment of the present invention. During operation, the switch identifies a tenant (operation 302) and obtains an identifier range for a network extension group associated with the tenant (operation 304). The switch then obtains tenant VLAN identifiers and tenant information associated with the tenant (operation 306). Tenant information includes one or more of: MAC addresses of tenant devices, port identifiers of ports coupling tenant devices, and IP subnets of the tenant. The switch then checks whether the local switch is an aggregate switch for the tenant (operation 308).

If the local switch is an aggregate switch, the switch determines an aggregate global VLAN identifier in the range (operation 310) and associates the tenant information with the corresponding aggregate global VLAN identifier (operation 312). In some embodiments, the association is based on internal identifiers of the switch, as described in conjunction with FIG. 1C. This association can be configured by a network administrator as well. If the local switch is not an aggregate switch, the switch determines a set of edge global VLAN identifiers in the range corresponding to the tenant VLAN identifiers (operation 314). The switch then associates a respective tenant VLAN identifier and corresponding tenant information with the corresponding edge global VLAN identifier (operation 316).

FIG. 4A presents a flowchart illustrating the process of an edge switch forwarding a packet based on a network extension group, in accordance with an embodiment of the present invention. During operation, the switch receives a packet via a local edge port (operation 402) and determines an internal identifier for the packet based on the local port (e.g., a port identifier) and/or one or more fields in the packet's header (operation 404). The switch obtains an edge global VLAN identifier mapped to the determined internal identifier from the local mapping (operation 406). The switch encapsulates the packet in an encapsulation header to generate a transport packet (operation 408) and includes the obtained edge global VLAN identifier in the encapsulation header (operation 410), as described in conjunction with FIG. 1A. The switch then determines an egress port for the packet based on the determined internal identifier and transmits the packet via the port (operation 412). If the packet is a multi-destination packet, a plurality of egress ports can be mapped to the internal identifier.

FIG. 4B presents a flowchart illustrating the process of an aggregate switch forwarding a packet based on a network extension group, in accordance with an embodiment of the present invention. During operation, the switch receives a packet via a local inter-switch port (operation 452) and checks whether the packet is destined for the local switch (operation 454). If the packet is not destined for the local switch, the switch forwards the packet based on the egress switch identifier and edge global VLAN identifier in the encapsulation header of the packet (operation 456). If the packet is destined for the local switch, the switch decapsulates the encapsulation header to obtain the inner packet (e.g., an Ethernet frame) (operation 454). This inner packet can be a tenant packet.

The switch then checks whether the destination address of the inner packet (e.g., a destination MAC address) is reachable via a local network extension interface (operation 460). If the destination of the inner packet is not reachable via a local network extension interface, the packet is for a device coupled via a local edge port. The switch then forwards the inner packet based on the destination switch identifier (e.g., the destination MAC address) and a tenant VLAN identifier in the header of the inner packet (operation 462). If the destination of the inner packet is reachable via a local network extension interface, the switch determines an internal identifier for the packet based on the local port (e.g., a port identifier) and one or more fields in the packet's header (operation 464).

The switch identifies a network extension interface associated with the internal identifier (operation 466) and obtains an aggregate global VLAN identifier mapped to the internal identifier (operation 468). The switch includes the obtained aggregate global VLAN identifier in the packet header of the inner packet to generate an extension packet (operation 470), as described in conjunction with FIG. 2A. If the network extension interface is a tunnel interface, the switch identifies the tunnel interface of the network extension interface and encapsulates the extension packet in a corresponding tunnel header (operation 472). The switch determines an egress port associated with the network extension interface for the (encapsulated) extension packet and transmits the packet via the port (operation 474).

Exemplary Switch

FIG. 5 illustrates an exemplary switch with network extension group support, in accordance with an embodiment of the present invention. In this example, a switch 500 includes a number of communication ports 502, a packet processor 510, a network extension module 530, and a storage device 550. In some embodiments, packet processor 510 adds an encapsulation header to a packet. In some embodiments, switch 500 includes a switch group management module 524, which maintains a membership in a network of interconnected switches. A respective switch of the network is associated with a group identifier identifying the switch group

In some embodiments, the network group is a fabric switch. Switch 500 maintains a configuration database in storage 550 that maintains the configuration state of a respective switch within the fabric switch. Switch 500 maintains the state of the fabric switch, which is used to join other switches. Under such a scenario, communication ports 502 can include inter-switch communication channels for communication within a fabric switch. This inter-switch communication channel can be implemented via a regular communication port and based on any open or proprietary format (e.g., a TRILL or IP protocol).

Network extension module 530 maintains a mapping between a first VLAN identifier and a first global VLAN identifier of a network extension group. In some embodiments, the mapping maps the first VLAN identifier to an internal identifier, and maps the internal identifier to the first global VLAN identifier. Switch 500 can include an internal identifier module 522, which generates an internal identifier for a packet based on an ingress port and/or one or more fields of the packet. During operation, network extension module 530 includes the global VLAN identifier in a packet belonging to the first VLAN, as described in conjunction with FIGS. 1A and 2A. If switch 500 is an edge switch, the first global VLAN identifier is an edge global VLAN identifier of the network extension group.

On the other hand, if switch 500 is an aggregate switch, the first global VLAN identifier is an aggregate global VLAN identifier of the network extension group. Switch 500 can be an aggregate switch for one or more aggregate switches in remote networks, as described in conjunction with FIG. 2C. Switch 500 can also include an interface module 532, which maintains a network extension interface forwarding the packet comprising the first global VLAN identifier. In some embodiments, switch 500 includes a tunnel management module 540, which encapsulates the packet in a tunnel encapsulation header. The network extension interface is then a tunnel interface.

Note that the above-mentioned modules can be implemented in hardware as well as in software. In one embodiment, these modules can be embodied in computer-executable instructions stored in a memory which is coupled to one or more processors in switch 500. When executed, these instructions cause the processor(s) to perform the aforementioned functions.

In summary, embodiments of the present invention provide a switch and a method for providing a global VLAN across a plurality of networks. In one embodiment, the switch is in a network of interconnected switches. The switch includes a network extension module, which maintains a mapping between a first VLAN identifier and a first global VLAN identifier of a network extension group. The network extension group is represented by a range of global VLAN identifiers for a tenant. A global VLAN identifier is persistent in a respective switch of the network and represents a virtual forwarding domain in the network. During operation, the network extension module includes the global VLAN identifier in a packet belonging to the first VLAN.

The methods and processes described herein can be embodied as code and/or data, which can be stored in a computer-readable non-transitory storage medium. When a computer system reads and executes the code and/or data stored on the computer-readable non-transitory storage medium, the computer system performs the methods and processes embodied as data structures and code and stored within the medium.

The methods and processes described herein can be executed by and/or included in hardware modules or apparatus. These modules or apparatus may include, but are not limited to, an application-specific integrated circuit (ASIC) chip, a field-programmable gate array (FPGA), a dedicated or shared processor that executes a particular software module or a piece of code at a particular time, and/or other programmable-logic devices now known or later developed. When the hardware modules or apparatus are activated, they perform the methods and processes included within them.

The foregoing descriptions of embodiments of the present invention have been presented only for purposes of illustration and description. They are not intended to be exhaustive or to limit this disclosure. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. The scope of the present invention is defined by the appended claims.

Claims

1. A switch, comprising: network extension circuitry configured to: maintain a mapping between a first virtual local area network (VLAN) identifier of a tenant and a first edge global VLAN identifier of a network extension group associated with the tenant, wherein the network extension group is associated with a range of global VLAN identifiers, which comprises a set of edge global VLAN identifiers, which includes the first edge global VLAN identifier, for individual VLAN identifiers of the tenant and one aggregate global VLAN identifier corresponding to the tenant; andinclude the first edge global VLAN identifier in a packet belonging to the first VLAN based on the mapping; andforwarding circuitry configured to determine an egress port for the packet based on a destination switch identifier of the packet and the first edge global VLAN identifier;wherein a respective global VLAN identifier is persistent in a respective switch of a first network of interconnected switches, wherein the first network of interconnected switches is identified by a first fabric identifier.

2. The switch of claim 1, wherein the mapping maps the first VLAN identifier to an internal identifier, and maps the internal identifier to the first global VLAN identifier; and wherein the internal identifier is internal and local to the switch, and is distinct from a VLAN identifier.

3. The switch of claim 1, wherein a respective global VLAN identifier in the range is represented by: a first and a second sets of bits in a continuous representation; anda tenant bit length indicating a number of bits dedicated to represent the tenant in the continuous representation.

4. The switch of claim 1, wherein the switch is an edge switch, wherein first global VLAN identifier is an edge global VLAN identifier of the network extension group.

5. The switch of claim 1, wherein the switch is an aggregate switch for one or more edge switches in the first network of interconnected switches, wherein first global VLAN identifier is the aggregate global VLAN identifier of the network extension group.

6. The switch of claim 5, further comprising interface circuitry configured to determine a network extension interface as an egress interface for forwarding the packet comprising the first global VLAN identifier, wherein a second network of interconnected switches is reachable via the network extension interface and identified by a second fabric identifier.

7. The switch of claim 6, further comprising tunnel management circuitry configured to encapsulate the packet in a tunnel encapsulation header, wherein the network extension interface is a tunnel interface for a tunnel between the first and second networks of interconnected switches.

8. The switch of claim 6, wherein the network extension group is persistent in the second network of interconnected switches and represents a virtual forwarding domain in the second network of interconnected switches.

9. The switch of claim 1, wherein the switch is an aggregate switch for one or more aggregate switches in a remote network of interconnected switches, wherein first global VLAN identifier is the aggregate global VLAN identifier, and wherein the aggregate global VLAN identifier corresponds to a plurality of global VLANs of the remote network of interconnected switches.

10. The switch of claim 1, further comprising a packet processor configured to encapsulate the packet in an encapsulation header, wherein the encapsulation header includes the first global VLAN identifier, and wherein the encapsulated packet is forwardable in the first network of interconnected switches based on the encapsulation header.

11. The switch of claim 1, wherein a respective switch of the first network of interconnected switches is associated with the first fabric identifier.

12. A computer-executable method, comprising: maintaining, by a switch, a mapping between a first virtual local area network (VLAN) identifier of a tenant and a first edge global VLAN identifier of a network extension group associated with the tenant, wherein the network extension group is associated with a range of global VLAN identifiers, which comprises a set of edge global VLAN identifiers, which includes the first edge global VLAN identifier, for individual VLAN identifiers of the tenant and one aggregate global VLAN identifier corresponding to the tenant; andincluding the first edge global VLAN identifier in a packet belonging to the first VLAN based on the mapping; anddetermining an egress port for the packet based on a destination switch identifier of the packet and the first edge global VLAN identifier;wherein a respective global VLAN identifier is persistent in a respective switch of a first network of interconnected switches, wherein the first network of interconnected switches is identified by a first fabric identifier.

13. The method of claim 12, wherein the mapping maps the first VLAN identifier to an internal identifier, and maps the internal identifier to the first global VLAN identifier; and wherein the internal identifier is internal and local to the switch, and is distinct from a VLAN identifier.

14. The method of claim 12, wherein a respective global VLAN identifier in the range is represented by: a first and a second sets of bits in a continuous representation; anda tenant bit length indicating a number of bits dedicated to represent the tenant in the continuous representation.

15. The method of claim 12, wherein the switch is an edge switch, wherein first global VLAN identifier is an edge global VLAN identifier of the network extension group.

16. The method of claim 12, wherein the switch is an aggregate switch for one or more edge switches in the first network of interconnected switches, wherein first global VLAN identifier is the aggregate global VLAN identifier of the network extension group.

17. The method of claim 16, further comprising determining a network extension interface as an egress interface for forwarding the packet comprising the first global VLAN identifier, wherein a second network of interconnected switches is reachable via the network extension interface and identified by a second fabric identifier.

18. The method of claim 17, further comprising encapsulating the packet in a tunnel encapsulation header, wherein the network extension interface is a tunnel interface for a tunnel between the first and second networks of interconnected switches.

19. The method of claim 17, wherein the network extension group is persistent in the second network of interconnected switches and represents a virtual forwarding domain in the second network of interconnected switches.

20. The method of claim 12, wherein the switch is an aggregate switch for one or more aggregate switches in a remote network of interconnected switches, wherein first global VLAN identifier is the aggregate global VLAN identifier, and wherein the aggregate global VLAN identifier corresponds to a plurality of global VLANs of the remote network of interconnected switches.

21. The method of claim 12, further comprising encapsulating the packet in an encapsulation header, wherein the encapsulation header includes the first global VLAN identifier, and wherein the encapsulated packet is forwardable in the first network of interconnected switches based on the encapsulation header.

22. The method of claim 12, wherein a respective switch of the first network of interconnected switches is associated with the first fabric identifier.

23. A computing system, comprising: a processor; anda memory storing instructions that when executed by the processor cause the system to perform a method, the method comprising: maintaining a mapping between a first virtual local area network (VLAN) identifier of a tenant and a first edge global VLAN identifier of a network extension group associated with the tenant, wherein the network extension group is associated with a range of global VLAN identifiers, which comprises a set of edge global VLAN identifiers, which includes the first edge global VLAN identifier, for individual VLAN identifiers of the tenant and one aggregate global VLAN identifier corresponding to the tenant; andincluding the first edge global VLAN identifier in a packet belonging to the first VLAN based on the mapping; anddetermining an egress port for the packet based on a destination switch identifier of the packet and the first edge global VLAN identifier;wherein a respective global VLAN identifier is persistent in a respective switch of a first network of interconnected switches, wherein the first network of interconnected switches is identified by a first fabric identifier.