Scalable and segregated network virtualization

Abstract

One embodiment of the present invention provides a switch. The switch includes a virtual network module and a forwarding module. The virtual network module includes a global virtual local area network (VLAN) tag in a packet. The global VLAN tag is mapped to an edge VLAN tag in the packet and is associated with a datacenter domain. The datacenter domain indicates a set of ports associated with a datacenter. The forwarding module identifies an egress edge port for the packet based on the global VLAN tag.

Description

BACKGROUND

Field

The present disclosure relates to communication networks. More specifically, the present disclosure relates to scalable network virtualization.

Related Art

The exponential growth of the Internet has made it a popular delivery medium for a variety of applications running on physical and virtual devices. Such applications have brought with them an increasing demand for bandwidth. As a result, equipment vendors race to build larger and faster switches with versatile capabilities, such as support for multi-tenancy, to move more traffic efficiently. However, the size of a switch cannot grow infinitely. It is limited by physical space, power consumption, and design complexity, to name a few factors. Furthermore, switches with higher capability are usually more complex and expensive. More importantly, because an overly large and complex system often does not provide economy of scale, simply increasing the size and capability of a switch may prove economically unviable due to the increased per-port cost.

A flexible way to improve the scalability of a switch system is to build a fabric switch. A fabric switch is a collection of individual member switches. These member switches form a single, logical switch that can have an arbitrary number of ports and an arbitrary topology. As demands grow, customers can adopt a “pay as you grow” approach to scale up the capacity of the fabric switch.

Meanwhile, layer-2 (e.g., Ethernet) switching technologies continue to evolve. More routing-like functionalities, which have traditionally been the characteristics of layer-3 (e.g., Internet Protocol or IP) networks, are migrating into layer-2. Notably, the recent development of the Transparent Interconnection of Lots of Links (TRILL) protocol allows Ethernet switches to function more like routing devices. TRILL overcomes the inherent inefficiency of the conventional spanning tree protocol, which forces layer-2 switches to be coupled in a logical spanning-tree topology to avoid looping. TRILL allows routing bridges (RBridges) to be coupled in an arbitrary topology without the risk of looping by implementing routing functions in switches and including a hop count in the TRILL header.

While a fabric switch brings many desirable features to a network, some issues remain unsolved in facilitating scalable and segregated network virtualization for a large number of tenants.

SUMMARY

One embodiment of the present invention provides a switch. The switch includes a virtual network module and a forwarding module. The virtual network module includes a global virtual local area network (VLAN) tag in a packet. The global VLAN tag is mapped to an edge VLAN tag in the packet and is associated with a datacenter domain. The datacenter domain indicates a set of ports associated with a datacenter. The forwarding module identifies an egress edge port for the packet based on the global VLAN tag.

In a variation on this embodiment, the global VLAN tag is mapped to an internal virtual identifier, which is internal and local to the switch. The forwarding module further identifies the egress edge port based on a mapping between the egress port and the internal virtual identifier.

In a variation on this embodiment, the edge VLAN tag is associated with a virtual machine. The virtual machine is allowed to migrate to the set of ports indicated by the datacenter domain.

In a variation on this embodiment, the packet does not include the edge VLAN tag, and the global VLAN tag is mapped to a media access control (MAC) address in the packet.

In a variation on this embodiment, the global VLAN tag is further mapped to one or more of: (i) a tenant identifier, which is information that can distinguish between tenants, and (ii) an identifier of the datacenter domain.

In a variation on this embodiment, the switch also includes a tag management module which generates the global VLAN tag based on the datacenter domain and the edge VLAN tag.

In a variation on this embodiment, the switch also includes a fabric switch management module which maintains a membership in a fabric switch. The fabric switch accommodates a plurality of member switches and operates as a single switch.

In a further variation, the fabric switch management module includes the global VLAN tag in a notification message for the member switches. The global VLAN tag is generated based on the datacenter domain and the edge VLAN tag.

In a further variation, the switch also includes a port profile module which applies a port profile to the ingress port of the packet in response to identifying the source MAC address of the packet in a port profile.

In a further variation, the port profile is in a port profile set associated with the datacenter domain.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 illustrates an exemplary provider network with scalable and segregated network virtualization support, in accordance with an embodiment of the present invention.

FIG. 2A illustrates exemplary mappings of global virtual local area networks (VLANs), in accordance with an embodiment of the present invention.

FIG. 2B illustrates exemplary direct mapping of a global VLAN to a virtual machine's media access control (MAC) address, in accordance with an embodiment of the present invention.

FIG. 2C illustrates exemplary tables comprising mappings of global VLANs, in accordance with an embodiment of the present invention.

FIG. 3A presents a flowchart illustrating the process of a datacenter manager creating a datacenter domain for a datacenter, in accordance with an embodiment of the present invention.

FIG. 3B presents a flowchart illustrating the process of a switch mapping an edge VLAN tag to a global VLAN tag, in accordance with an embodiment of the present invention.

FIG. 3C presents a flowchart illustrating the process of a switch mapping a global VLAN to an internal virtual identifier (IVID), in accordance with an embodiment of the present invention.

FIG. 4A presents a flowchart illustrating the process of a switch forwarding a packet received from an edge port based on scalable and segregated network virtualization, in accordance with an embodiment of the present invention.

FIG. 4B presents a flowchart illustrating the process of a switch forwarding a packet received from an inter-switch port based on scalable and segregated network virtualization, in accordance with an embodiment of the present invention.

FIG. 5A illustrates an exemplary provider network with port profile sets for scalable and segregated network virtualization, in accordance with an embodiment of the present invention.

FIG. 5B illustrates exemplary port profile sets for scalable and segregated network virtualization, in accordance with an embodiment of the present invention.

FIG. 6A presents a flowchart illustrating the process of a switch obtaining port profile sets associated with datacenters associated with the switch, in accordance with an embodiment of the present invention.

FIG. 6B presents a flowchart illustrating the process of a switch applying a port profile from a port profile set based on a received packet, in accordance with an embodiment of the present invention.

FIG. 7 illustrates an exemplary architecture of a switch scalable and segregated network virtualization support, in accordance with an embodiment of the present invention.

In the figures, like reference numerals refer to the same figure elements.

DETAILED DESCRIPTION

The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the claims.

Overview

In embodiments of the present invention, the problem of facilitating scalable and segregated network virtualization is solved by mapping an edge virtual local area network (VLAN) to a large-scale global VLAN in a provider network. As a result, a respective tenant in a datacenter (DC) associated with the provider network can reuse the same edge VLAN used by another tenant, and therefore, can use a large number edge VLANs in a scalable way. Furthermore, global VLANs can be distinct for a respective datacenter coupled the provider network, thereby allowing segregated network virtualization for different datacenters coupled to the same provider network. A global VLAN can be computed based on a datacenter domain identifier and an edge VLAN tag.

With existing technologies, a provider network typically uses a separate VLAN tag, which is referred to as service tag or S-tag, in addition to the edge VLAN tag (can also be referred to as customer tag or C-tag). However, since the length of an S-tag is typically the same as the length of a C-tag, the number of VLANs supported in the provider network still remains limited. On the other hand, the S-tag and the C-tag can be used together as a single identifier to extend the number of VLANs supported in the provider network. However, such identifier may not distinguish between datacenters coupled to the provider network and segregate the same edge VLANs of different datacenters.

To solve this problem, a respective switch in the provider network maps a respective edge VLAN of a respective tenant of a respective datacenter to a unique and distinct global VLAN. The number of supported global VLANs can be significantly larger than the number of edge VLANs. In some embodiments, the number of bits used to represent edge VLAN tags and global VLAN tags are 12 and 24, respectively. This global VLAN is distinct among edge VLANs of different tenants and datacenters. For example, the same edge VLAN used by two tenants are mapped to two distinct global VLANs in the provider network. As a result, a tenant can use an edge VLAN tag used by another tenant, and therefore, can use a large number of edge VLANs (e.g., up to the available number of edge VLANs represented by 12 bits). This global VLAN can be included in the inter-switch packets forwarded in the provider network. In some embodiments, this global VLAN is removed when the packets leave the provider network.

Furthermore, the same edge VLAN used at two different datacenters is mapped to two unique and distinct global VLANs. As a result, if a tenant's network is distributed in two datacenters and the tenant reuses the same edge VLAN, the traffic from different datacenters are segregated in the same provider network. Moreover, a global VLAN can be persistent in the provider network and is included in the inter-switch packets forwarded in the provider network. For example, if a virtual machine (VM) moves within a datacenter, the edge VLAN of the migrated virtual machine maps to the same global VLAN. In some embodiments, a respective switch in the provider network includes one or more port profiles comprising port configurations (e.g., edge and global VLAN policies), and applies a port profile upon detecting traffic from an associated end device.

In some embodiments, the provider network is a fabric switch, and a respective switch in the provider network is a member switch of the fabric switch. In a fabric switch, any number of switches coupled in an arbitrary topology may logically operate as a single switch. The fabric switch can be an Ethernet fabric switch or a virtual cluster switch (VCS), which can operate as a single Ethernet switch. Any member switch may join or leave the fabric switch in “plug-and-play” mode without any manual configuration. In some embodiments, a respective switch in the fabric switch is a Transparent Interconnection of Lots of Links (TRILL) routing bridge (RBridge). In some embodiments, a respective switch in the fabric switch is an Internet Protocol (IP) routing-capable switch (e.g., an IP router).

It should be noted that a fabric switch is not the same as conventional switch stacking. In switch stacking, multiple switches are interconnected at a common location (often within the same rack), based on a particular topology, and manually configured in a particular way. These stacked switches typically share a common address, e.g., an IP address, so they can be addressed as a single switch externally. Furthermore, switch stacking requires a significant amount of manual configuration of the ports and inter-switch links. The need for manual configuration prohibits switch stacking from being a viable option in building a large-scale switching system. The topology restriction imposed by switch stacking also limits the number of switches that can be stacked. This is because it is very difficult, if not impossible, to design a stack topology that allows the overall switch bandwidth to scale adequately with the number of switch units.

In contrast, a fabric switch can include an arbitrary number of switches with individual addresses, can be based on an arbitrary topology, and does not require extensive manual configuration. The switches can reside in the same location, or be distributed over different locations. These features overcome the inherent limitations of switch stacking and make it possible to build a large “switch farm,” which can be treated as a single, logical switch. Due to the automatic configuration capabilities of the fabric switch, an individual physical switch can dynamically join or leave the fabric switch without disrupting services to the rest of the network.

Furthermore, the automatic and dynamic configurability of the fabric switch allows a network operator to build its switching system in a distributed and “pay-as-you-grow” fashion without sacrificing scalability. The fabric switch's ability to respond to changing network conditions makes it an ideal solution in a virtual computing environment, where network loads often change with time.

In this disclosure, the term “fabric switch” refers to a number of interconnected physical switches which form a single, scalable logical switch. These physical switches are referred to as member switches of the fabric switch. In a fabric switch, any number of switches can be connected in an arbitrary topology, and the entire group of switches functions together as one single, logical switch. This feature makes it possible to use many smaller, inexpensive switches to construct a large fabric switch, which can be viewed as a single logical switch externally. Although the present disclosure is presented using examples based on a fabric switch, embodiments of the present invention are not limited to a fabric switch. Embodiments of the present invention are relevant to any computing device that includes a plurality of devices operating as a single device.

The term “end device” can refer to any device external to the provider network, which can be a fabric switch. Examples of an end device include, but are not limited to, a host machine, a conventional layer-2 switch, a layer-3 router, or any other type of network device. Additionally, an end device can be coupled to other switches or hosts further away from a layer-2 or layer-3 network. An end device can also be an aggregation point for a number of network devices to enter the fabric switch.

The term “switch” is used in a generic sense, and it can refer to any standalone or fabric switch operating in any network layer. “Switch” should not be interpreted as limiting embodiments of the present invention to layer-2 networks. Any device that can forward traffic to an external device or another switch can be referred to as a “switch.” Any physical or virtual device (e.g., a virtual machine/switch operating on a computing device) that can forward traffic to an end device can be referred to as a “switch.” Examples of a “switch” include, but are not limited to, a layer-2 switch, a layer-3 router, a TRILL RBridge, or a fabric switch comprising a plurality of similar or heterogeneous smaller physical and/or virtual switches.

The term “edge port” refers to a port in a provider network which exchanges data frames with a network device outside of the provider network (i.e., an edge port is not used for exchanging data frames with another switch of the provider network). The provider network can be a fabric switch and the switches in the provider network can be member switches of the fabric switch. The term “inter-switch port” refers to a port which sends/receives data frames among the switches of the provider network. The terms “interface” and “port” are used interchangeably.

The term “VLAN” is used in a generic sense and refers to any virtualized network. The term “VLAN” refers to a virtualized network within a physical network. A VLAN isolates the virtualized network so that packets are only forwarded within the VLAN. A VLAN associated with a packet received from an edge port of a switch can be referred to as an edge VLAN and a corresponding identifier or tag can be referred to as an edge VLAN tag. The terms “identifier” and “tag” are used interchangeably.

The term “switch identifier” refers to a group of bits that can be used to identify a switch. Examples of a switch identifier include, but are not limited to, a media access control (MAC) address, an Internet Protocol (IP) address, and an RBridge identifier. Note that the TRILL standard uses “RBridge ID” (RBridge identifier) to denote a 48-bit intermediate-system-to-intermediate-system (IS-IS) System ID assigned to an RBridge, and “RBridge nickname” to denote a 16-bit value that serves as an abbreviation for the “RBridge ID.” In this disclosure, “switch identifier” is used as a generic term, is not limited to any bit format, and can refer to any format that can identify a switch. The term “RBridge identifier” is also used in a generic sense, is not limited to any bit format, and can refer to “RBridge ID,” “RBridge nickname,” or any other format that can identify an RBridge.

The term “packet” refers to a group of bits that can be transported together across a network. “Packet” should not be interpreted as limiting embodiments of the present invention to layer-3 networks. “Packet” can be replaced by other terminologies referring to a group of bits, such as “message,” “frame,” “cell,” or “datagram.”

Network Architecture

FIG. 1 illustrates an exemplary provider network with scalable and segregated network virtualization support, in accordance with an embodiment of the present invention. As illustrated in FIG. 1A, a network 100 includes switches 101, 102, 103, 104, and 105. Switches 102 and 105 are coupled to end devices 142 and 144, respectively. Network 100 can be a provider network, which provides connectivity to a datacenter. A datacenter 120 is coupled with network 100 via switches 101 and 103. Similarly, a datacenter 130 is coupled with network 100 via switches 103 and 105.

Datacenter 120 includes host machines 112 and 114, each of which hosts one or more virtual machines (i.e., one or more virtual machines run on host machines 112 and 114). For example, host machine 112 hosts virtual machine 122, and host machine 114 hosts virtual machines 124 and 126. Similarly, datacenter 130 includes host machines 116 and 118, each of which hosts one or more virtual machines. For example, host machine 116 hosts virtual machine 132, and host machine 118 hosts virtual machines 134 and 136. Virtual machines 122 and 124 of datacenter 120, and virtual machine 136 of datacenter 130 is in edge VLAN 152. Virtual machine 126 of datacenter 120, and virtual machines 132 and 134 of datacenter 130 is in edge VLAN 154.

In some embodiments, network 100 is a fabric switch and a respective switch in network 100 is a member switch of the fabric switch. A fabric switch is formed using a number of smaller physical switches. The automatic configuration capability provided by the control plane running on a respective member switch allows any number of switches to be connected in an arbitrary topology without requiring tedious manual configuration of the ports and links. This feature makes it possible to use many smaller, inexpensive switches to construct a large cluster switch, which can be viewed as a single switch externally.

In some embodiments, fabric switch 100 is a TRILL network and a respective member switch of fabric switch 100, such as switch 105, is a TRILL RBridge. In some further embodiments, fabric switch 100 is an IP network and a respective member switch of fabric switch 100, such as switch 105, is an IP-capable switch, which calculates and maintains a local IP routing table (e.g., a routing information base or RIB), and is capable of forwarding packets based on its IP addresses.

Switches in fabric switch 100 use edge ports to communicate with end devices (e.g., non-member switches) and inter-switch ports to communicate with other member switches. For example, switch 105 is coupled to end device 144 via an edge port and to switches 101, 102, and 104 via inter-switch ports and one or more links. Data communication via an edge port can be based on Ethernet and via an inter-switch port can be based on IP and/or TRILL protocol. It should be noted that control message exchange via inter-switch ports can be based on a different protocol (e.g., Internet Protocol (IP) or Fibre Channel (FC) protocol).

During operation, a datacenter is represented as a datacenter domain (DCD). A datacenter domain represents a set of associations between edge VLAN and global VLAN. Datacenter domains allow the proper mapping between edge VLAN and global VLAN. Datacenter domains also ensure that migrating virtual machines are associated with the correct global VLAN. The virtual machines that need connectivity are in the same datacenter domain. A global VLAN can be computed based on the datacenter domain identifier and an edge VLAN tag. To achieve segregation of virtualized networks between different datacenters, a switch of the provider network creates a datacenter domain, assigns ports to the datacenter domain, associates global VLANs with the corresponding virtual machines, and isolates data packets belonging to these global VLANs. These virtual machines and their network policies are often configured in portgroups in a virtual machine manager (e.g., a vCenter). In some embodiments, portgroups from a respective virtual machine manager associated with a corresponding datacenter domain.

In some embodiments, a datacenter manager creates a corresponding datacenter domain. For example, the datacenter managers of datacenters 120 and 130, respectively, create corresponding datacenter domains 172 and 174, respectively. A datacenter domain be assigned a unique identifier, and include one or more ports of network 100 among which a virtual machine can migrate. These ports can be from an individual switch or from a plurality of switches in network 100. For example, datacenter domain 174 includes port 162 of switch 103 and port 164 of switch 105. This allows a virtual machine, such as virtual machine 134, to migrate between ports 162 and 164 (i.e., between host machines 116 and 118). As a result, virtual machine 134 may not migrate to a port, such as port 166, of a different datacenter domain 172. Ports 162 and 164 can be manually included in datacenter domain 174 or by a datacenter manager of datacenter 130.

If a plurality of datacenters participates in the same virtualized network without segregation, the same global VLAN can span the plurality of datacenters. For example, if datacenters 120 and 130 participates in edge VLAN 154 without segregation, the same global VLAN can be mapped to edge VLAN 154 for both datacenters 120 and 130. This global VLAN spans both datacenters 120 and 130. This global VLAN can be mapped to both datacenters 120 and 130, or can be created and mapped to datacenters 120 and 130 independently. This also allows partial segregation. For example, if edge VLAN 152 requires segregation, separate global VLANs can still be mapped to edge VLAN 152 for datacenters 120 and 130. In this way, packets of edge VLAN 152 is segregated for datacenters 120 and 130, but packets of edge VLAN 154 are not segregated in network 100.

With existing technologies, network 100 typically uses a separate VLAN tag, which is referred to as service tag or S-tag, in addition to the edge VLAN tag (can also be referred to as customer tag or C-tag). However, since the length of an S-tag is typically the same as the length of a C-tag, the number of VLANs supported in the provider network still remains limited. On the other hand, the S-tag and the C-tag can be used together as a single identifier to extend the number of VLANs supported in network 100. However, such identifier may not distinguish between datacenters 120 and 130 coupled to network 100 and segregate the same edge VLANs of different datacenters. For example, tags of edge VLAN 152 of datacenters 120 and 130 can be mapped to the same identifier in network 100 and traffic of edge VLAN 152 may not be segregated for datacenters 120 and 130.

To solve this problem, a respective switch in network 100 maps edge VLANs 152 and 154 to global VLANs. The global VLANs are distinct among edge VLANs of different tenants and datacenters. The number of supported global VLANs can be significantly larger than the number of edge VLANs in network 100. In some embodiments, the number of bits used to represent edge VLAN tags and global VLAN tags are 12 and 24, respectively. For example, edge VLAN 152 used by two tenants are mapped to two distinct global VLANs in network 100. As a result, a respective tenant can use edge VLAN 152, and therefore, can use a large number of edge VLANs (e.g., up to the available number of edge VLANs represented by 12 bits). The global VLAN mapped to edge VLAN 152 can be included in the packets within the provider network. As a result, switches in network 100 segregates these packets of the global VLAN from other traffic. In some embodiments, this global VLAN is removed when the packets leave network 100.

Furthermore, the same edge VLAN 152 used at datacenters 120 and 130 (i.e., configured in datacenter domain 172 and 174, respectively) is mapped to two distinct global VLANs. As a result, for the same edge VLAN 152, the traffic from different datacenters is segregated in network 100. Moreover, a global VLAN can be persistent in network 100 and is included in the packets forwarded in network 100. For example, if virtual machine 134 moves to host machine 116 in datacenter domain 174 (denoted with dotted lines), virtual machine 134 remains associated with edge VLAN 154 and maps to the same global VLAN.

Global VLAN Mappings

In some embodiments, in the example in FIG. 1, switch 103 is coupled to datacenters 120 and 130, and is configured for edge VLANs 152 and 154. Hence, switch 103 can map tags of edge VLANs 152 and 154 to global VLAN tags such that a respective global VLAN tag is distinct for datacenters 120 and 130. FIG. 2A illustrates exemplary mappings of global virtual local area networks (VLANs), in accordance with an embodiment of the present invention. An edge packet (i.e., a packet received via an edge port of a switch in network 100) can include an edge VLAN tag 202 (e.g., a C-tag). A switch maps edge VLAN tag 202 to a global VLAN tag 204. If an edge packet includes edge VLAN tag 202, the switch includes global VLAN tag 204 in the corresponding inter-switch packet in network 100.

To segregate traffic among different tenants, mapping between edge VLAN tag 202 and global VLAN tag 204 can further include a tenant identifier 216 (denoted with dotted line), which can be any information that can distinguish between tenants. Examples of tenant identifier 216 include, but are not limited to, a generated identifier, a virtual or physical MAC address, an IP address, an IP sub-network (subnet), a logical or physical port identifier, a virtual switch identifier, a hypervisor identifier, and a combination thereof. Furthermore, to distinguish between different datacenter domains, this mapping can also include a datacenter domain identifier 218 (denoted with dotted line) which can be any information that can distinguish between datacenter domains. This combination of edge VLAN tag 202, tenant identifier 216, and datacenter domain identifier 218 can be mapped to global VLAN tag 204.

In some embodiments, the inter-switch packet is a fabric-encapsulated packet. Examples of fabric encapsulation include, but are not limited to, TRILL, IP, and a combination thereof. In some embodiments, the global VLAN tag is based on Fine Grained Labeling (FGL) comprising two tag segments 212 and 214. These tag segments together represent the bits of global VLAN tag 204. FGL is described in Internet Engineering Task Force (IETF) Request for Comments (RFC) 7172, titled “Transparent Interconnection of Lots of Links (TRILL): Fine-Grained Labeling,” available at http://tools.ietf.org/html/rfc7172, which is incorporated by reference herein.

In some embodiments, the switch maps global VLAN tag 204 to an internal virtual identifier (IVID) 206. Forwarding in virtualized network based on IVID is described in U.S. patent application Ser. No. 13/044,301 (Attorney Docket No. BRCD-3042.1.US.NP), titled “Flooding Packets on a Per-Virtual-Network Basis,” by inventors Shunjia Yu, Anoop Ghanwani, Phanidhar Koganti, and Dilip Chatwani, filed 9 Mar. 2011, the disclosure of which is incorporated by reference herein.

When an edge packet is received by the switch via an edge port, the packet header is processed by the switch to determine the egress port, which can be either an edge port or an inter-switch port, via which the packet is to be forwarded. Oftentimes, a forwarding module of the switch (e.g., an integrated circuit specifically designed for performing forwarding lookups) is the bottleneck in the data path. Consequently, increasing the processing speed and decreasing the size and complexity of the forwarding module is usually very important. It should be noted that IVID 206 is internal and local to the switch, and is not included in a packet. For the same global VLAN tag 204, a corresponding IVID 206 can be different for different switches in network 100. In some embodiments, an IVID can also be mapped to an edge VLAN tag. This allows an egress switch to forward packets via an edge port.

In some embodiments, in addition to global VLAN tag 204, IVID 206 can be mapped to additional information 210 (denoted with dotted line), such as the port via which the packet is received and/or one or more fields (which may include the VPN identifier) in the packet. This IVID is mapped to an egress port 208 of the switch. A plurality of global VLAN tags can be mapped to the same IVID. An edge VLAN tag can also be mapped to an IVID. Upon determining IVID 206 for the packet, the switch forwards the packet via egress port 208 based on its mapping with IVID 206. The length (in terms of bits) of the IVID can be less than the combined length of the one or more fields in the packet's header, such as global VLAN tag 204, which are used for determining the IVID. This reduction in length can increase the processing speed of the forwarding module, and decrease the overall size and complexity of the implementation.

There are at least two non-obvious insights that allow the mapping of global VLAN tag 204 (and additional information) to a shorter sized IVID 206 without significantly affecting network virtualization functionality. The first non-obvious insight is that, even though a respective tenant is given the capability to create a large number of virtual networks based on global VLANs, it is unlikely that each and every tenant provisions a large number of virtual networks. For example, even though each tenant may be given the capability to create 4K VLANs using 12 bits of an edge VLAN tags, it is unlikely for a respective tenant to provision 4K VLANs. Hence, the IVID does not have to be long enough to handle cases in which a respective tenant provisions 4K VLANs. Note that the entire 4K VLAN address space is still available to a respective tenant.

The second non-obvious insight is that multiple global VLAN tags can be mapped to a single IVID. Note that a switch assigns a unique IVID for a global VLAN or an edge VLAN if the switch receives/forwards packets from/to an end device (e.g., end device 142) via an edge port. For example, an ingress switch may assign a unique IVID for a respective global VLAN whose packets are receives via an edge port. Similarly, an egress switch may assign a unique IVID for a respective edge VLAN whose packets are forwarded via an edge port. However, if the switch is not an ingress or egress switch for a set of global VLANs, the switch can map a set of global VLANs to a common “pass-through” IVID.

FIG. 2B illustrates exemplary direct mapping of a global VLAN to a virtual machine's MAC address, in accordance with an embodiment of the present invention. In some embodiments, if a virtual machine is not associated with an edge VLAN, the virtual machine can be associated with a global VLAN. If the virtual machine is not coupled to a vSwitch of a hypervisor, the virtual machine may not be associated with an edge VLAN. The MAC address 220 of the virtual machine can directly be mapped to global VLAN 204. This allows segregation of traffic from that virtual machine in network 100.

In some embodiments, the mappings in FIG. 2A are stored in tables. FIG. 2C illustrates exemplary tables comprising mappings of global VLANs, in accordance with an embodiment of the present invention. Suppose that edge VLANs 152 and 154 have edge VLAN tags 222 and 224, respectively, and datacenter domains 172 and 174 have identifiers 272 and 274, respectively. A table 252 of a switch in network 100 (e.g., switch 103) includes mappings of edge VLAN tags 222 and 224 to corresponding global VLAN tags. In some embodiments, this mapping also includes tenant identifiers and/or datacenter domain identifiers. Inclusion of this mapping allows table 252 to store mapping of edge VLAN tags associated with different tenants and datacenter domains to distinct global VLAN tags.

For example, for a tenant with tenant identifier 282 in datacenter domain 172, edge VLAN tags 222 and 224, and corresponding tenant identifier 282 and datacenter domain identifier 272, are mapped to global VLAN tags 231 and 232, respectively. Suppose that the same tenant also uses edge VLAN tag 224 in datacenter domain 174 (i.e., has edge VLAN 254 in datacenter 130). That edge VLAN tag 224, and corresponding tenant identifier 282 and datacenter domain identifier 274, is mapped to a different global VLAN tag 233. In this way, traffic from a tenant's same edge VLAN 154 at different datacenters can be segregated in network 100. It should be noted that the tenant with identifier 282 may not have edge VLAN 152 in datacenter 130.

Similarly, for a tenant with tenant identifier 284 in datacenter domain 174, edge VLAN tags 222 and 224, and corresponding tenant identifier 284 and datacenter domain identifier 274, are mapped to global VLAN tags 234 and 235, respectively. Suppose that the same datacenter domain also includes another tenant with identifier 286, which uses edge VLAN tag 224 in datacenter domain 174 (i.e., has edge VLAN 254 in datacenter 130). That edge VLAN tag 224, and corresponding tenant identifier 286 and datacenter domain identifier 274, is mapped to a different global VLAN tag 236. In this way, packets with the same edge VLAN tag 224 from different tenants within the same datacenter can be segregated in network 100. It should be noted that the tenant with identifier 286 may not have edge VLAN 152 in datacenter 130.

In some embodiments, a switch in network 100, upon generating a global VLAN tag, shares the global VLAN tag with other switches in network 100. If network 100 is a fabric switch, the switch can use internal messaging (e.g., a name service) for the fabric switch to generate a notification message. The switch then includes the generated global VLAN tag in the notification message, determines an egress port for the notification message, and transmits the notification message via the egress port. In this way, a respective switch in network 100 is aware of all global VLAN tags generated for network 100. For example, switch 103 can generate global VLAN tag 232 and switch 105 can generate global VLAN tag 236. Upon exchanging notification messages, both switches 103 and 105 have global VLAN tags 232 and 236. In some embodiments, a respective global VLAN tag is unique in network 100.

A respective global VLAN tag can be mapped to an IVID. In this example, switch 103 can store the mappings between global VLAN tags and its local IVIDs in table 254. Table 254 includes mappings of global VLAN tags 231, 232, 233, 234, 235, and 236 to IVIDs 261, 262, 263, 264, 265, and 266, respectively. These IVIDs are local and internal to switch 103 and not included in a packet. In some embodiments, some of these mappings can include additional information as well, as described in conjunction with FIG. 2A. For example, mappings of global VLAN tags 231, 232, 233, 235, and 236 include additional information 241, 242, 243, 244, and 245, respectively. However, global VLAN tag 234 is mapped to IVID 264, which does not include additional information. It should be noted that additional information for different global VLAN tags, such as additional information 241 and 242, can be different. For example, additional information 241 can represent a MAC address and additional information 242 can represent an IP address.

Similarly, switch 105 can store the mappings between global VLAN tags and its local IVIDs in table 256. Table 256 includes mappings of global VLAN tags 231, 232, 233, 234, 235, and 236 to IVIDs 267, 262, 263, 268, 261, and 269, respectively. These IVIDs are local and internal to switch 105 and not included in a packet. Mappings of global VLAN tags 231, 232, 233, 234, and 236 include additional information 241, 247, 244, 248, and 246, respectively. However, global VLAN tag 235 is mapped to IVID 261, which does not include additional information. Since these IVIDs are local and internal to switch 105, the same global VLAN tag 231 and internal information 241 are mapped to different IVIDs 261 and 267 in switch 103 and 105, respectively. Furthermore, global VLAN tag 232 is associated with different additional information 242 and 247 for switch 103 and 105, respectively. On the other hand, additional information 244 is associated with global VLAN tag 235 in switch 103 and with global VLAN tag 233 in switch 105.

In some embodiments, switch 103 can store another table (not shown in FIG. 2B), which maps IVIDs 261, 262, 263, 264, 265, and 266 to corresponding egress ports, as described in conjunction with FIG. 2A. Similarly, switch 105 can store another table (not shown in FIG. 2B), which maps IVIDs 267, 262, 263, 268, 261, and 269 to corresponding egress ports, as described in conjunction with FIG. 2A. This allows switches 103 and 105 to identify a global VLAN tag in an inter-switch packet, determine a corresponding IVID from tables 254 and 256, respectively, and determine an egress port for the packet.

In the example in FIG. 1, suppose that virtual machine 124 sends a packet toward end device 142. Since virtual machine 124 is in edge VLAN 152, the packet includes edge VLAN tag 222. Upon receiving the packet, switch 103 obtains a corresponding global VLAN tag from table 252. If virtual machine 124 is associated with a tenant with identifier 282, the switch obtains the corresponding global VLAN tag 231. Switch 103 uses global VLAN tag 231 and additional information (e.g., a MAC address) to obtain IVID 261. If network 100 is a fabric switch, switch 103 encapsulates the packet in a fabric encapsulation to create an inter-switch packet and includes global VLAN tag 231 in the inter-switch packet. This global VLAN tag can be included in fabric encapsulation header (e.g., in a TRILL or IP header), a shim header, or in the header of the inner edge packet. Since end device 142 is coupled to switch 102, the egress switch identifier of the inter-switch packet corresponds to switch 102. Switch 103 then uses IVID 261 to determine an egress port for the inter-switch packet and transmits the packet to switch 102 via the determined egress port. Upon receiving the inter-switch packet, switch 102 determines the inter-switch packet to be destined to itself, removes the fabric encapsulation to obtain the inner edge packet, and forwards the edge packet to end device 142.

Initialization

FIG. 3A presents a flowchart illustrating the process of a datacenter manager creating a datacenter domain for a datacenter, in accordance with an embodiment of the present invention. During operation, the datacenter manager identifies one or more switches coupled to the datacenter (operation 302) and identifies ports of identified switches associated with the datacenter (operation 304). In the example in FIG. 1, the datacenter manager of datacenter 130 identifies switches 103 and 105 in operation 302, and identifies ports 162 and 164 in operation 304. The datacenter manager then creates a datacenter domain comprising the identified ports (operation 306) and allocates a unique identifier to the datacenter domain (operation 308). The operations in FIG. 3A can be repeated for a respective datacenter.

FIG. 3B presents a flowchart illustrating the process of a switch mapping an edge VLAN tag to a global VLAN tag, in accordance with an embodiment of the present invention. During operation, switch identifies an edge VLAN tag associated with the local switch (operation 332). The switch identifies a datacenter domain and, optionally, a tenant identifier for the edge VLAN tag (operation 334). The switch then maps the edge VLAN tag to a global VLAN tag such that the global VLAN tag is unique, and is distinct among the tenants and datacenter domains (operation 336), as described in conjunction with FIG. 2A. The switch then stores the mapping a local table (operation 338). The switch can repeat the operations of FIG. 3B for a respective edge VLAN associated with the switch. In some embodiments, the switch can map the MAC address of a physical or virtual end device to a global VLAN if the end device is not in an edge VLAN.

FIG. 3C presents a flowchart illustrating the process of a switch mapping a global VLAN to an IVID, in accordance with an embodiment of the present invention. During operation, the switch identifies a global VLAN tag associated with the local switch (operation 352). The switch, optionally, obtains additional information associated with the global VLAN tag (operation 354) (denoted with dashed lines), and maps the global VLAN tag (and additional information) to an IVID, which is internal and local to the switch (operation 356). It should be noted that the mapping may not include additional information, as described in conjunction with FIG. 2B. A plurality of global VLAN tags can be mapped to the same IVID. The switch can further map the IVID to an egress port (operation 358). The switch stores one or both mappings in local tables (operation 360).

Packet Forwarding

FIG. 4A presents a flowchart illustrating the process of a switch forwarding a packet received from an edge port based on scalable and segregated network virtualization, in accordance with an embodiment of the present invention. During operation, the switch receives a packet from an edge port (operation 402) and identifies an edge VLAN tag from the packet (operation 404). The switch checks whether the packet is destined to a local edge port (operation 406). If the packet is destined to a local edge port, the switch identifies an IVID mapped to an edge VLAN tag (and additional information associated with the packet) (operation 408). If not (i.e., if the packet is destined to an inter-switch port), the switch encapsulates the packet to an inter-switch packet (operation 410). If the switch is a member switch of a fabric switch, the switch can use fabric encapsulation (e.g., TRILL or IP encapsulation) to create the inter-switch packet.

The switch identifies a global VLAN tag mapped to edge VLAN tag from a local table (operation 412), as described in conjunction with FIG. 2B. The switch includes the global VLAN tag in the inter-switch packet (operation 414) and identifies an IVID mapped to the global VLAN tag (and additional information associated with the packet) (operation 416). Based on the identified IVID (operation 408 or 416), the switch identifies an egress port mapped to the identified IVID (operation 418) and transmits the packet via the identified egress port (operation 420).

FIG. 4B presents a flowchart illustrating the process of a switch forwarding a packet received from an inter-switch port based on scalable network virtualization, in accordance with an embodiment of the present invention. During operation, the switch receives a packet from the inter-switch port (operation 452). The switch checks whether the packet is destined to a local edge port (operation 454). If the packet is destined to a local edge port, the switch decapsulates the inter-switch packet to extract the inner edge packet (operation 456) and identifies an IVID mapped to an edge VLAN tag of the edge packet (and additional information associated with the edge packet) (operation 458).

If not (i.e., if the packet is destined to an inter-switch port), the switch identifies a global VLAN tag from the packet (operation 464) and identifies an IVID mapped to the global VLAN tag (and additional information associated with the packet) (operation 466). Based on the identified IVID (operation 458 or 466), the switch identifies an egress port mapped to the identified IVID (operation 460) and transmits the packet via the identified egress port (operation 462).

Port Profiles

A port profile which specifies a set of port configuration information and allows dynamically provisioning a port, specifically for a virtual machine. A port profile can be created for that virtual machine, which is moved to a corresponding switch port as the virtual machine moves in the network. A fabric switch can quickly detect when a virtual machine moves to a new location. The port profile corresponding to the virtual machine can then be automatically applied to the new location (i.e., the new physical switch port to which the virtual machine couples). This way, the network can respond quickly to the dynamic location changes of virtual machines. Port profiles are described in U.S. patent application Ser. No. 13/042,259, titled “Port Profile Management for Virtual Cluster Switching,” by inventors Dilip Chatwani, Suresh Vobbilisetty, and Phanidhar Koganti, filed 7 Mar. 2011, the disclosure of which is incorporated by reference herein.

A port profile can contain the entire configuration needed for a virtual machine to gain access to a LAN or WAN, which can include: Fibre Channel over Ethernet (FCoE) configuration, VLAN configuration, QoS related configuration, and security related configuration, such as access control lists (ACLs). The list above is by no means complete or exhaustive. Furthermore, it is not necessary that a port profile contains every type of configuration information.

In one embodiment, a port profile can be capable of operating as a self contained configuration container. In other words, if a port profile is applied to a new switch without any additional configuration, the port profile should be sufficient to set the switch's global and local (interface level) configuration and allow the switch to start carrying traffic.

A VLAN configuration profile within a port profile can define:

• • a. edge VLAN membership which includes tagged VLANs and an untagged VLAN;
  • b. global VLAN membership which includes mappings of global VLANs; and
  • c. ingress/egress VLAN filtering rules based on the VLAN membership.

A QoS configuration profile within a port profile can define:

• • d. mapping from an incoming frame's 802.1p priority to internal queue priority; (if the port is in QoS untrusted mode, all incoming frame's priorities would be mapped to the default best-effort priority)
  • e. mapping from an incoming frame's priority to outgoing priority;
  • f. scheduling profile, such as weighted Round-Robin or strict-priority based queuing;
  • g. mapping of an incoming frame's priority to strict-priority based or weighted Round-Robin traffic classes;
  • h. flow control mechanisms on a strict-priority based or weight Round-Robin traffic class; and
  • i. limitations on multicast datarate.

An FCoE configuration profile within a port profile defines the attributes needed for the port to support FCoE, which can include:

• • j. FCoE VLAN;
  • k. FCMAP;
  • l. FCoE Priority; and
  • m. virtual Fabric ID.

A security configuration profile within a port profile defines the security rules needed for the server port. However, the security rules can be different at different ports, so some of the locally configured ACLs can be allowed to override conflicting rules from a port profile. A typical security profile can contain the following attributes:

• • n. Enable 802.1x with EAP TLV extensions for VM mobility; and
  • o. MAC based standard and extended ACLs.

FIG. 5A illustrates an exemplary provider network with port profile sets for scalable and segregated network virtualization, in accordance with an embodiment of the present invention. In this example, a switch segregates port profiles for a respective datacenter domain. During operation, switch 103 obtains port profile sets 502 and 504 for datacenters 120 and 130, respectively. In this way, the port profiles for virtual machines 124 and 126 are in port profile set 502. Similarly, the port profiles for virtual machines 132 and 134 are in port profile set 504, which is segregated from port profile set 502. To ensure segregation, port profile set 502 is not shared in datacenter 130, and port profile set 504 is not shared in datacenter 120.

In one embodiment, each port profile can have one or more MAC addresses associated with it. FIG. 5B illustrates exemplary port profile sets for scalable and segregated network virtualization, in accordance with an embodiment of the present invention. In this example, port profile set 502 includes one or more port profiles. Port profile set 502 includes port profile 552, which is associated with one or more MAC addresses. These MAC address can be virtual MAC addresses assigned to different virtual machines, such as the MAC address of virtual machine 126. This port-profile-to-MAC address mapping information can be included in port profile 552, or can be maintained outside of port profile 552 (e.g., in a separate table). Port profile set 502 is distributed throughout network 100. A port profile can be activated for a port in three ways: (1) when a hypervisor binds a MAC address to a port profile identifier; (2) through regular MAC learning; and (3) through a manual configuration process via a management interface.

In this example, port profile set 504 includes one or more port profiles. Port profile set 504 includes port profile 554, which is associated with one or more MAC addresses. These MAC address can be virtual MAC addresses assigned to different virtual machines, such as the MAC addresses of virtual machines 132 and 134. This port-profile-to-MAC address mapping information can be included in port profile 554, or can be maintained outside of port profile 554 (e.g., in a separate table). A set of virtual machines can be grouped in network 100 by associating them with one port profile. This group can be used to dictate forwarding between the virtual machines.

FIG. 6A presents a flowchart illustrating the process of a switch obtaining port profile sets associated with datacenters associated with the switch, in accordance with an embodiment of the present invention. During operation, the switch identifies the datacenter domains associated with the local switch (operation 602). The switch then obtains port profile sets associated with a respective datacenter domain (operation 604). A switch can obtain the port profile sets from a user (e.g., via a message from an administrative station, a command line interface (CLI) command, or a web interface). A switch can also received the port profiles from a user and generate the corresponding port profile sets based on a datacenter domain. The switch then locally stores the port profile sets (operation 606)

FIG. 6B presents a flowchart illustrating the process of a switch applying a port profile from a port profile set based on a received packet, in accordance with an embodiment of the present invention. During operation, the switch receives a packet from a local port (operation 652). The switch then obtains the source MAC address of the packet (operation 654) and identifies the datacenter domain associated with the source MAC address (operation 656). In some embodiments, the switch identifies the datacenter domain based on the ingress port via which the packet has been received (i.e., identifies the datacenter domain associated with the ingress port of the packet). The switch retrieves the port profile associated with the MAC address from the port profile set associated with the identified datacenter domain (operation 658). The switch then applies the received port profile to the local port (i.e., the ingress port of the packet) (operation 660).

Exemplary Switch

FIG. 7 illustrates an exemplary architecture of a switch scalable and segregated network virtualization support, in accordance with an embodiment of the present invention. In this example, a switch 700 includes a number of communication ports 702, a packet processor 710, a virtual network module 730, a forwarding module 720, and a storage device 750. Packet processor 710 extracts and processes header information from the received frames.

In some embodiments, switch 700 may maintain a membership in a fabric switch, as described in conjunction with FIG. 1A, wherein switch 700 also includes a fabric switch management module 760. Fabric switch management module 760 maintains a configuration database in storage device 750 that maintains the configuration state of every switch within the fabric switch. Fabric switch management module 760 maintains the state of the fabric switch, which is used to join other switches. In some embodiments, switch 700 can be configured to operate in conjunction with a remote switch as an Ethernet switch.

Communication ports 702 can include inter-switch communication channels for communication within a fabric switch. This inter-switch communication channel can be implemented via a regular communication port and based on any open or proprietary format. Communication ports 702 can include one or more TRILL ports capable of receiving frames encapsulated in a TRILL header. Communication ports 702 can also include one or more IP ports capable of receiving IP packets. An IP port is capable of receiving an IP packet and can be configured with an IP address. Packet processor 710 can process TRILL-encapsulated frames and/or IP packets.

During operation, virtual network module 730 includes a global VLAN tag in a packet received via an ingress port among communication ports 702. Forwarding module 720 identifies an egress port among communication ports 702 for the packet based on the global VLAN tag. In some embodiments, switch 700 also includes a tag management module 732, which generates the global VLAN tag based on the datacenter domain and the edge VLAN tag. Fabric switch management module 760 can include the generated global VLAN tag in a notification message for the member switches of the fabric switch. In some embodiments, switch 700 also includes a port profile module 740, which applies a port profile to the ingress port of the packet in response to identifying the source MAC address of the packet in a port profile. This port profile can be in a port profile set associated with a corresponding data center domain.

Note that the above-mentioned modules can be implemented in hardware as well as in software. In one embodiment, these modules can be embodied in computer-executable instructions stored in a memory, which is coupled to one or more processors in switch 700. When executed, these instructions cause the processor(s) to perform the aforementioned functions.

In summary, embodiments of the present invention provide a switch and a method for facilitating scalable and segregated network virtualization. In one embodiment, the switch includes a virtual network module and a forwarding module. The virtual network module includes a global VLAN tag in a packet. The global VLAN tag is mapped to an edge VLAN tag in the packet and is associated with a datacenter domain. The datacenter domain indicates a set of ports associated with a datacenter. The forwarding module identifies an egress edge port for the packet based on the global VLAN tag.

The methods and processes described herein can be embodied as code and/or data, which can be stored in a computer-readable non-transitory storage medium. When a computer system reads and executes the code and/or data stored on the computer-readable non-transitory storage medium, the computer system performs the methods and processes embodied as data structures and code and stored within the medium.

The methods and processes described herein can be executed by and/or included in hardware modules or apparatus. These modules or apparatus may include, but are not limited to, an application-specific integrated circuit (ASIC) chip, a field-programmable gate array (FPGA), a dedicated or shared processor that executes a particular software module or a piece of code at a particular time, and/or other programmable-logic devices now known or later developed. When the hardware modules or apparatus are activated, they perform the methods and processes included within them.

The foregoing descriptions of embodiments of the present invention have been presented only for purposes of illustration and description. They are not intended to be exhaustive or to limit this disclosure. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. The scope of the present invention is defined by the appended claims.

Claims

1. A switch, comprising: a plurality of ports;a storage device configured to store a data structure, which comprises an entry mapping a global virtual local area network (VLAN) tag to an edge VLAN tag and a datacenter domain identifier, wherein the datacenter domain identifier indicates a set of ports configured for a datacenter, and wherein the edge VLAN tag identifies a virtual network of a tenant in the datacenter and the global VLAN tag identifies a global virtual network distinct among tenants and datacenter domains; andforwarding circuitry configured to encapsulate a packet comprising the edge VLAN tag with an encapsulation header based on the entry, wherein the encapsulation header includes the global VLAN tag; andforwarding circuitry configured to identify, from the plurality of ports, an egress port for the packet based on the global VLAN tag.

2. The switch of claim 1, wherein the storage device is further configured to store a second data structure, which maps the global VLAN tag to an internal virtual identifier, which is internal and local to the switch; and wherein the forwarding circuitry is further adapted to identify the egress edge port based on a third data structure mapping the egress port to the internal virtual identifier.

3. The switch of claim 1, wherein the edge VLAN tag is associated with a virtual machine; and wherein migration of the virtual machine is restricted to the set of ports indicated by the datacenter domain.

4. The switch of claim 1, wherein the storage device is further configured to store a fourth data structure, which maps the global VLAN tag to a media access control (MAC) address in a second packet, and wherein the second packet does not include an edge VLAN tag.

5. The switch of claim 1, wherein the data structure further maps the global VLAN tag to a tenant identifier, which is information that can distinguish between tenants.

6. The switch of claim 1, further comprising tag management circuitry configured to generate the global VLAN tag based on the datacenter domain and the edge VLAN tag.

7. The switch of claim 1, further comprising fabric switch management circuitry configured to maintain a membership in a network of interconnected switches, wherein the network of interconnected switches is identified by a fabric identifier.

8. The switch of claim 7, wherein the fabric switch management circuitry is further configured to include the global VLAN tag in a notification message for the member switches of network of interconnected switches.

9. The switch of claim 1, further comprising port profile circuitry configured to apply a port profile to an ingress port, in the plurality of ports, of the packet in response to identifying the source MAC address of the packet in a port profile, wherein the port profile specifies a set of port configuration information for a port of the switch.

10. The switch of claim 9, wherein the port profile is in a set of port profiles associated with the datacenter domain.

11. A computer-executable method, comprising: storing, in a storage device of a switch, a data structure, which comprises an entry mapping a global virtual local area network (VLAN) tag to an edge VLAN tag and a datacenter domain identifier, wherein the datacenter domain identifier indicates a set of ports configured for a datacenter, and wherein the edge VLAN tag identifies a virtual network of a tenant in the datacenter and the global VLAN tag identifies a global virtual network distinct among tenants and datacenter domains;encapsulating a packet comprising the edge VLAN tag with an encapsulation header based on the entry, wherein the encapsulation header includes the global VLAN; andidentifying an egress port for the packet based on the global VLAN tag.

12. The method of claim 11, further comprising: storing, in the storage device, a second data structure, which maps the global VLAN tag to an internal virtual identifier, which is internal and local to the switch; andidentifying the egress edge port based on a third data structure mapping the egress port to the internal virtual identifier.

13. The method of claim 11, wherein the edge VLAN tag is associated with a virtual machine; and wherein migration of the virtual machine is restricted to the set of ports indicated by the datacenter domain.

14. The method of claim 11, wherein the method further comprises storing, in the storage device, a fourth data structure, which maps the global VLAN tag to a media access control (MAC) address in a second packet, and wherein the second packet does not include an edge VLAN tag.

15. The method of claim 11, wherein the data structure further maps the global VLAN tag to a tenant identifier, which is information that can distinguish between tenants.

16. The method of claim 11, further comprising generating the global VLAN tag based on the datacenter domain and the edge VLAN tag.

17. The method of claim 11, further comprising maintaining a membership in a network of interconnected switches, wherein the network of interconnected switches is identified by a fabric identifier.

18. The method of claim 17, further comprising including the global VLAN tag in a notification message for the member switches of the network of interconnected switches.

19. The method of claim 11, further comprising applying a port profile to an ingress port, which belongs to the switch, of the packet in response to identifying the source MAC address of the packet in a port profile, wherein the port profile specifies a set of port configuration information for a port of the switch.

20. The method of claim 19, wherein the port profile is in a set of port profiles associated with the datacenter domain.

21. A computing system, comprising: a plurality of ports;a storage device;a processor; anda non-transitory computer-readable storage medium storing instructions which when executed by the processor causes the processor to perform a method, the method comprising: storing, in the a storage device, a data structure, which comprises an entry mapping a global virtual local area network (VLAN) tag to an edge VLAN tag and a datacenter domain identifier, wherein the datacenter domain identifier indicates a set of ports configured for a datacenter, and wherein the edge VLAN tag identifies a virtual network of a tenant in the datacenter and the global VLAN tag identifies a global virtual network distinct among tenants and datacenter domains; andencapsulating a packet comprising the edge VLAN tag with an encapsulation header based on the entry, wherein the encapsulation header includes the global VLAN tag; andidentifying an egress port, from the plurality of ports, for the packet based on the global VLAN tag.

22. The computing system of claim 21, wherein the method further comprises: storing, in the storage device, a second data structure, which maps the global VLAN tag is mapped to an internal virtual identifier, which is internal and local to the switch; andidentifying the egress edge port based on a third data structure mapping the egress port to the internal virtual identifier.

23. The computing system of claim 21, wherein the method further comprises storing, in the storage device, a fourth data structure, which maps the global VLAN tag to a media access control (MAC) address in a second packet, and wherein the second packet does not include an edge VLAN tag.

24. The computing system of claim 21, wherein the method further comprises maintaining a membership in a network of interconnected switches, wherein the network of interconnected switches is identified by a fabric identifier.

25. The computing system of claim 24, wherein the method further comprises applying a port profile to an ingress port, in the plurality of ports, of the packet in response to identifying the source MAC address of the packet in a port profile, wherein the port profile specifies a set of port configuration information for a port of the switch.