Patent Application
20160191324
Embodiments of the present invention relate to networking.
In the Internet and other provider or enterprise network deployments, the commonly taken approach is to use an Interior Gateway Protocol (IGP), (e.g. OSPF, IETF RFC2328, or ISIS, IETF RFC 1195) to carry routing information that pertains to the network topology of a routing domain and an Exterior Gateway Protocol (EGP) (BGP, IETF RFC4271) for carrying routing information that is external to the specific network domain or routing information that pertains to services. With very few, if any, exceptions, BGPv4 is the only EGP that is deployed in networks today for the purpose of sharing information between routing domains (a.k.a. Autonomous Systems) or carrying routing information that is not specifically local to the routing domain. In this capacity, BGPv4 carries the following types of routing information:
a) Reachability to customer networks of the local routing domain
b) Inter-domain routes learned from other service providers
c) Prefixes representing services located in internal data centers
d) Prefixes representing services residing in other service provider networks
e) VPN-instance routing information
f) Routing information describing the Internet
g) and more
In other words, the BGPv4 protocol is what makes up the core of what is usually referred to as the routing system in many pieces of networking literature.
Due to its widespread use and the time over which the protocol has evolved, it has been extended with many features where the most prominent element from an application specific aspect involves a very strong set of policy creation functions and some prefix identification functionality. The prefix identification functions are mostly related to identifying the source of a prefix, although the community feature (IETF RFC1997) allows for an administrator to assign arbitrary tags to prefixes. The challenge with the community is that it is at best considered in a very simple fashion in the BGPv4 best path selection algorithm (ref. IETF draft-retana-bgp-custom-decision-02) and cannot be used to represent specific attributes of a route other than identification or simple preference.
Another challenging aspect of BGPv4 is that each prefix must be advertised with a directly associated next-hop attribute, where the next-hop itself does not carry any attributes that can influence the selection of a certain path for a given prefix. It is also difficult to associate a prefix or a set of prefixes with a network service or a set of chained services due to the nature of the direct association between the BGPv4 prefix and the next-hop that must be provided indiscriminately by the underlying IGP unless a given BGP-speaker uses a directly connected interface for establishing the required BGP-sessions with its neighbor.
With BGPv4 being the prevailing protocol in use for the purpose of advertising services, some overall basic restrictions that make it challenging to use in a situation where intelligent linkage between routing information and services is required, must be addressed for this obstacle to be removed.
A requirement that is emerging very strongly is the ability to identify, advertise and chain network services together to transparently force network traffic to be subject to various services as it traverses the network.
According to a first aspect of the invention, there is provided a method for routing network traffic between network elements within a computer network. The method comprises configuring the computer network to include a control plane and a forwarding plane; configuring each network element of the forwarding plane to periodically compose and transmit a control plane protocol message to every other network element of the forwarding plane, said control plane message comprising network, next-hop; and service information; via the control plane, provisioning at least some of the network elements with at least one policy to control routing of the network traffic based on at least one service; and processing the network traffic by the network elements of the forwarding plane based on the at least one policy.
Other aspects of the invention will be apparent from the detailed description below.
In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention can be practiced without these specific details. In other instances, structures and devices are shown in block or flow diagram form only in order to avoid obscuring the invention.
Reference in this specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearance of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Moreover, various features are described which may be exhibited by some embodiments and not by others. Similarly, various requirements are described which may be requirements for some embodiments but not other embodiments.
Moreover, although the following description contains many specifics for the purposes of illustration, anyone skilled in the art will appreciate that many variations and/or alterations to the details are within the scope of the present invention. Similarly, although many of the features of the present invention are described in terms of each other, or in conjunction with each other, one skilled in the art will appreciate that many of these features can be provided independently of other features. Accordingly, this description of the invention is set forth without any loss of generality to, and without imposing limitations upon, the invention.
In one embodiment, in order for the overlay control plane protocol to provide a functional architecture, it distributes overlay routes that are learned from each location where an overlay network element is present, together with external addresses used as next-hop addresses for the overlay routes. The external addresses may be assigned to the physical interfaces of the overlay network elements that attach to the underlying network 108.
The overlay routes may only be accessed through the overlay network 102 and the next-hop addresses can only be reached through the underlying network 108. Together, the overlay routes and next-hop addresses provide for a complete and functional overlay architecture. As far as the underlying network 108 is concerned, the only element used to forward traffic between the sites is the next-hop address. The underlying network 108 does not know about any other routes, addresses or labels that may be used for providing a functional network infrastructure within the overlay network 102 itself.
Secure tunnels are established between the next-hop addresses, which define the elements (hubs or edges) that actually instantiate the overlay network 102. The secure tunnels define a control plane, as shown in
In one embodiment, within the overlay network 102, the overlay controller 104 processes control plane traffic, but does not get involved in the processing of data traffic. All data traffic is processed by the network elements present at site locations, such as a branch office, or central locations, such as a data center or a headquarters location. The network elements may represent edge routers, e.g. in the case of a branch location, or service routers, e.g. in the case of a location where a service is located. As can been seen from
Referring now to
Embodiments of the invention disclose techniques for identification and advertisement of services within the networks 100 and 200. Said techniques use Service Subsequent Address Family Identifier (Service SAFI) in control plane protocol updates to provide the ability for every network element to properly identify, learn the current status of, and use services in central or local policy constructs. The use of a specified SAFI for services circumvents any dependency on given services being available or even being present. Prefixes in a routing table are free to use any available path and having traffic being subject to services is a decision that can be made dynamically and based on priority.
Identification of services may be managed by establishing a common notation for different types of services that is defined within the Service SAFI specification shared and implemented in every participating node. A sample list of services may include the following, but any type of service could be advertised using this mechanism:
Once a service advertisement and the connectivity to the given service has been configured on a local network element, the network element will advertise the service using the Service SAFI to identify the service as discussed above and also provide reachability information for the service to be used by the receiving network elements. A given service advertisement may be composed as below:
The length indicates the length of the SAFI entry as it could vary due to how many services are advertised in a given update. Service-type is as discussed above and the service could be represented by either a prefix or a label. In case the access to a service is to be restricted to a given Virtual Private Network (VPN) then a VPN identifier is also provided. The status of a service may reflect mere presence but also other conditions such as load and health. Additionally, the originator field serves to provide information about the control plane protocol identity of the node advertising the service. Not all fields may be required for certain implementations and fields may be added as required, potentially for certain services. The size of certain fields may also vary, e.g. it could be required to substitute the 32-bit originator field with a 128-bit field in case the originator is identified by an IPv6 address (IETF RFC4291).
A network element in a location where a service is hosted may be configured to advertise the service and may be instructed to do so either permanently or dependent or the current state of the local service. For example, if a locally configured firewall is operational the service is advertised but otherwise withdrawn.
Since actual prefix information is carried separately from the service SAFI, it is up to either the originator or receiver of the control protocol update to determine if the use of a certain service is required for a given prefix or set of prefixes. Advantageously, there is no direct dependency on a service being present or being provided from a certain location. Policy in an ingress network element can determine whether or not any service of a given type (e.g. a firewall service) is sufficient or the service has to be provided from a given location. This provides flexibility from a redundancy point of view, as one firewall service can substitute another and it's yet another benefit of the architectural choice of separating prefixes and services in the protocol updates.
Advantageously, as the network elements are equipped with service information it also allows for additional service aware functions to be implemented, such as proximity routing for services, preferential treatment, availability checking, abstraction of location and other service attributes as well as other service specific functions
The use of a Service SAFI in a deployed network environment may involve the following components:
(a) a network element originating the advertisement of a service—e.g. the network elements SR1 and SR2;
(b) an operational service (e.g., a firewall service);
(c) a set of network elements originating prefix information and also providing inbound connectivity to the network domain—e.g. the edge router NE1 to NE3; and
(d) policy constructs enforced on the inbound network elements that may be configured and enforced locally or configured on a central controller and then distributed for local enforcement on the inbound network elements.
As will be seen that routing table 300 shows that NE1 network is a local network, the network NE2 is reachable via NE2, the network NE3 is reachable via NE3, firewall Service 1 is reachable via SR1, and firewall Service 2 is reachable via SR2.
Likewise, the routing table 302 shows that the NE1 network reachable via NE1, the network NE2 is reachable via NE2, the network NE3 a local network, firewall Service 1 is reachable via SR1, and firewall Service 2 is reachable via SR2.
In terms of bring up, the firewall Service 1 is brought up and attached to its local network element (service router SR1) and firewall Service 2 is brought up and attached to service router SR2. Both SR1 and SR2 are configured to advertise their respective local firewall service to all other network elements (NE1 to NE3) using a label for reachability. Techniques for bringing up network elements are described in co-pending U.S. patent application Ser. No. 14/028,518 entitled “SECURE BRING-UP OF NETWORK DEVICES”, which is incorporated herein by reference in its entirety.
The network elements NE1 to NE3 advertise their local prefixes and all other routers in the network, inclusive of SR1 and SR2, and learn routes by means of the control plane protocol. The regular or non-service-providing network elements (NE1 to NE3) install all routes and enforce policy. For illustration purposes, the rest of this description will refer to Policy (P1) that requires all traffic for a certain network element (NE1) to pass through a firewall service. In one embodiment, the policy may be provisioned in the regular network elements by an administrator using the control plane protocol. To implement the policy (P1), the remaining network elements alter the routing table entries for the prefixes learnt from NE1 to point to SR1, since that is the firewall that is available with the lowest distance in protocol terms.
As will be seen that routing table 300A shows that NE1 network is a local network, the network NE2 is reachable via NE2, the network NE3 is reachable via Service 1, firewall Service 1 is reachable via SR1, and firewall Service 2 is reachable via SR2.
Further, the routing table 302A shows that the NE1 network reachable via Service 1, the network NE2 is reachable via NE2, the network NE3 a local network, firewall Service 1 is reachable via SR1, and firewall Service 2 is reachable via SR2.
Thus, all the routers will send their traffic bound for NE1 via SR1. At the service router SR1 traffic bound for NE1 will be subjected to the firewall Service 1 that is available at SR1 and then forwarded to NE1. Packet forwarding by the service router SR1 is shown in
(a) Destination: NE1;
(b) Source: NE3; and
(c) Label: Service 1.
If the firewall Service 1 at SR1 approves the packet 500 for forwarding to NE1, then SR1 will create an outbound packet 502 for SR1 based on the inbound packet 500 as follows:
(a) Destination: NE1;
(b) Source: NE3; and
(c) Label: NE1.
Later, the firewall goes down at SR1. This will cause SR1 to subsequently withdraw the firewall service advertisement through the control plane protocol. Since the policy (P1) implemented at all the network elements stipulated any firewall and not a specific firewall, the network elements can now install the firewall service advertised by SR2 for use with prefixes originating from NE1. Thus, all the routers now send their traffic bound for NE1 via SR2.
Referring now
Turning now to
The hardware also typically receives a number of inputs and outputs for communicating information externally. For interface with a user or operator, the hardware may include one or more user input output devices 1006 (e.g., a keyboard, mouse, etc.) and a display 1008. For additional storage, the hardware 1000 may also include one or more mass storage devices 1010, e.g., a Universal Serial Bus (USB) or other removable disk drive, a hard disk drive, a Direct Access Storage Device (DASD), an optical drive (e.g. a Compact Disk (CD) drive, a Digital Versatile Disk (DVD) drive, etc.) and/or a USB drive, among others. Furthermore, the hardware may include an interface with one or more networks 1012 (e.g., a local area network (LAN), a wide area network (WAN), a wireless network, and/or the Internet among others) to permit the communication of information with other computers coupled to the networks. It should be appreciated that the hardware typically includes suitable analog and/or digital interfaces between the processor 1012 and each of the components, as is well known in the art.
The hardware 1000 operates under the control of an operating system 1014, and executes application software 1016 which includes various computer software applications, components, programs, objects, modules, etc. to perform the techniques described above.
In general, the routines executed to implement the embodiments of the invention, may be implemented as part of an operating system or a specific application, component, program, object, module or sequence of instructions referred to as “computer programs.” The computer programs typically comprise one or more instructions set at various times in various memory and storage devices in a computer, and that, when read and executed by one or more processors in a computer, cause the computer to perform operations necessary to execute elements involving the various aspects of the invention. Moreover, while the invention has been described in the context of fully functioning computers and computer systems, those skilled in the art will appreciate that the various embodiments of the invention are capable of being distributed as a program product in a variety of forms, and that the invention applies equally regardless of the particular type of machine or computer-readable media used to actually effect the distribution. Examples of computer-readable media include but are not limited to recordable type media such as volatile and non-volatile memory devices, USB and other removable media, hard disk drives, optical disks (e.g., Compact Disk Read-Only Memory (CD ROMS), Digital Versatile Disks, (DVDs), etc.), flash drives among others.
Although the present invention has been described with reference to specific exemplary embodiments, it will be evident that the various modification and changes can be made to these embodiments without departing from the broader spirit of the invention. Accordingly, the specification and drawings are to be regarded in an illustrative sense rather than in a restrictive sense.
