The present disclosure relates generally to communication networks, and more particularly, to cloud computing.
The number of applications and amount of data in enterprise data centers continue to grow. Cloud computing is being proposed as one possibility to meet the increasing demands. Cloud computing enables network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort. Infrastructure as a Service (IaaS) is one area of cloud computing that has attracted a lot of interest. IaaS delivers computer infrastructure, typically a platform virtualization environment, as a service. Rather than purchasing servers, software, data center space, or network equipment, customers instead purchase these resources as an outsourced service. Most IaaS providers do not disclose how their infrastructures are handled internally since they often view this as their competitive advantage. As a result, the enterprise has no visibility into the infrastructure within the cloud and is left with no assurance of security, reliability, or visibility. Even if the provider discloses how their internal operations are implemented, there is still no way for the enterprise to monitor or verify the infrastructure.
Corresponding reference characters indicate corresponding parts throughout the several views of the drawings.
Overview
In one embodiment, a method generally comprises receiving data at a virtual switch located at a network device in a cloud network. The data is received from an external network and destined for one or more virtual machines located in the cloud network and associated with the external network. The method further includes transmitting the data from the virtual switch to the virtual machine. The virtual switch operates as an access layer switch for the external network and creates a virtual switching overlay for secure communication between the virtual machines and the external network.
In another embodiment, logic is encoded in one or more tangible media for execution and when executed operable to switch data between virtual machines located in a cloud network, forward data to an external network, perform access layer switch operations for the external network, and create a virtual switching overlay for secure communication between the virtual machines and the external network.
Example Embodiments
The following description is presented to enable one of ordinary skill in the art to make and use the embodiments. Descriptions of specific embodiments and applications are provided only as examples and various modifications will be readily apparent to those skilled in the art. The general principles described herein may be applied to other applications without departing from the scope of the embodiments. Thus, the embodiments are not to be limited to the embodiments shown, but are to be accorded the widest scope consistent with the principles and features described herein. For purpose of clarity, features relating to technical material that is known in the technical fields related to the embodiments have not been described in detail.
Cloud computing is a model that provides resources and services that are abstracted from an underlying infrastructure and provided on demand and at scale in a multi-tenant environment. The clouds are typically accessed through web browsers or APIs (Application Programming Interfaces) and offer nearly unlimited capacity on demand, but with limited customer control. One area of cloud computing is Infrastructure as a service (IaaS), in which computing, network, and storage services are delivered over the network on a pay-as-you-go basis. A popular offering within IaaS is the Virtual Private Cloud (VPC). The VPC is hosted on a public cloud; therefore, it is not truly a private cloud. The VPC includes a set of Virtual Machines (VMs) and networks that are connected to the enterprise and appear to be part of the enterprise (i.e., associated with the enterprise network). With conventional implementations of virtual private clouds, there are concerns about security, reliability, and visibility. The network administrator has to extend the enterprise network into an insecure environment and therefore loses visibility into what is happening within the cloud, and control over security and enterprise-class features. Also, there is no consistent interface between all of the various cloud providers. Enterprises desire security, service-level guarantees, and compliance control, but with virtual private clouds, the service providers are in control of these requisite capabilities. These drawbacks prevent many enterprises from adopting cloud computing.
The embodiments described herein address the above needs within the cloud computing environment. The embodiments provide a virtual switching overlay on top of the cloud infrastructure. This allows the network administrator to regain control of the network access layer within the virtual private cloud and provides full visibility into the cloud, secure communication within the cloud and from the cloud to the enterprise, and an interface to the cloud network that is independent of the service provider.
Referring now to the drawings, and first to
The network 10 shown in
The VPC 20 includes a plurality of servers 40 which utilize virtualization technology. Virtualization allows one computer to do the job of multiple computers by sharing the resources of a single computer across multiple systems. Software is used to virtualize hardware resources of a computer, including, for example, the CPU, RAM, hard disk, and network controller, to create a virtual machine that can run its own operating system and applications. Multiple virtual machines on each server share hardware resources without interfering with each other so that several operating systems and applications can be run at the same time. The virtual machines are deployed within the cloud on demand with the IP addresses of the VMs controlled by the enterprise.
As described in detail below, a virtual switch 34 is located in the VPC 20 to provide a virtual switching overlay 18 on top of the cloud. The virtual switch 34 operates as an access layer switch for the customer so that the customer has control of the cloud network access layer.
The virtual switch 34 transmits data received from the enterprise 12 to virtual machines 30 located within the VPC 20 via encrypted links (virtual secure wires) 48. The VPC data center 20 may also include more than one virtual switch 34 with an encrypted link between the virtual switches. L2TPv3 over IPsec may be used to encrypt packets transmitted between the virtual switch 34 and virtual machines 30. It is to be understood that L2TPv3 over IPsec is only one example and that other protocols may be used to transfer data between the virtual switch 34 and virtual machines 30.
In one embodiment, each virtual machine 30 includes an agent 32. The agent 32 may be a VPN client, for example, or other application loaded in the virtual machine 30 by an enterprise server/application administrator. The agent 32 contains the IP address assigned by the service provider and port profile names. A port profile is used to define a common set of configuration policies (attributes) for multiple interfaces. The port profiles are associated with port configuration policies defined by the network administrator and applied to a large number of ports as they come online in a virtual environment.
The VPN connection 22 may be used to signal VM MAC addresses back to the enterprise 12 to prevent flooding across the VPN connection 22. Since traffic leaving the virtual private cloud 20 is often billed by the provider, stopping floods can reduce costs. The virtual switch 36 at the enterprise may also proxy ARP (Address Resolution Protocol) requests on behalf of the VMs 30 within the VPC 20. As shown in
The servers 40 are in communication with the network via switches 52, 54, (e.g., hardware implemented network switches or other network devices configured to perform switching or routing functions). The switches 52, 54 may be in communication with a management station 56 (e.g., virtualization management platform such as VMware Virtual Center management station, available from VMware of Palo Alto, Calif.). The management station 56 or one or more management functions may also be integrated into the switches 52, 54.
In the embodiment shown in
The VSM 45 is configured to provide control/management plane functionality for the virtual machines 30 and control multiple VEMs 46. The VEM 46 provides switching capability at the server 40 and operates as a data plane associated with the control plane of the VSM 45. The VSM 45 and VEM 46 operate together to form a distributed virtual switch as viewed by the management station 56. The VSM 45 and VEM 46 may also be located together in a network device (e.g., switch 52, 54, server 40 or other network device in communication with the switches 52, 54 and servers 40).
It is to be understood that the network shown in
The virtual switch 34 allows the enterprise to gain control of the cloud network access layer. All traffic entering or leaving the cloud (e.g., VPC 20 or subnet 25 in VPC) associated with the enterprise passes through the virtual switch 34. An administrator at the enterprise can access the virtual switch 34 and view the virtual Ethernet ports (interfaces), configure ACLs (Access Control Lists), manage port profiles, and perform other management functions typically performed at the access layer.
The VPC 20 may include multiple virtual switches 34 connected to a central management plane. The central management plane is assigned an elastic IP address and spawns off virtual switches 34 as virtual Ethernet interfaces are created and limits at the virtual switch are reached. The port profiles may be configured in the central management plane with the virtual switches 34 pulling port profiles on demand when the associated virtual Ethernet interfaces connect to the virtual switch. The virtual switches 34 preferably create a full mesh of VPN tunnels to form a single logical switch to prevent loops and eliminate the need for spanning tree.
Network device 70 interfaces with physical media via a plurality of linecards (network interfaces) 76. Linecards 76 may incorporate Ethernet interfaces, DSL interfaces, Gigabit Ethernet interfaces, 10-Gigabit Ethernet interfaces, SONET interfaces, etc. As packets are received, processed, and forwarded by network device 70, they may be stored in a packet memory 78. To implement functionality according to the system, linecards 76 may incorporate processing and memory resources similar to those discussed above in connection with the network device as a whole. It is to be understood that the network device 70 shown in
Although the method and apparatus have been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations made without departing from the scope of the embodiments. Accordingly, it is intended that all matter contained in the above description and shown in the accompanying drawings shall be interpreted as illustrative and not in a limiting sense.
Number | Name | Date | Kind |
---|---|---|---|
6490273 | DeNap et al. | Dec 2002 | B1 |
7055171 | Martin et al. | May 2006 | B1 |
7516211 | Gourlay et al. | Apr 2009 | B1 |
7567510 | Gai et al. | Jul 2009 | B2 |
7660265 | Kreuk | Feb 2010 | B2 |
8055789 | Richardson | Nov 2011 | B2 |
8345692 | Smith | Jan 2013 | B2 |
8369333 | Hao | Feb 2013 | B2 |
8705513 | Van Der Merwe | Apr 2014 | B2 |
9338024 | Emmendorfer | May 2016 | B2 |
20030014524 | Tormasov | Jan 2003 | A1 |
20050063395 | Smith et al. | Mar 2005 | A1 |
20060230407 | Rosu et al. | Oct 2006 | A1 |
20070028244 | Landis et al. | Feb 2007 | A1 |
20070147279 | Smith et al. | Jun 2007 | A1 |
20080148386 | Kreuk | Jun 2008 | A1 |
20090063706 | Goldman et al. | Mar 2009 | A1 |
20090249438 | Litvin et al. | Oct 2009 | A1 |
20090296726 | Snively et al. | Dec 2009 | A1 |
20090327462 | Adams et al. | Dec 2009 | A1 |
20100027420 | Smith | Feb 2010 | A1 |
20100027442 | Chockler et al. | Feb 2010 | A1 |
20100131636 | Suri et al. | May 2010 | A1 |
20110090911 | Hao et al. | Apr 2011 | A1 |
20110134793 | Elsen et al. | Jun 2011 | A1 |
20110194404 | Kluger et al. | Aug 2011 | A1 |
20220321499 | DiFerdinando | Oct 2022 | A1 |
Entry |
---|
Cohen, Reuven “Virtual Private Cloud (VPC)”, Elastic Vapor Blog Post, http://elasticvapor.com/2008/05/virtual-private-cloud-vpc.html, May 8, 2008. (Year: 2008). |
Armbrust, Michael et al. “Above the Clouds: A Berkeley View of Cloud Computing”, Technical Report No. UCB/EECS-2009-28, http://www.eecs.berkeley.edu/Pubs/TechRpts/2009/EECS-2009-28.html, Feb. 10, 2009. (Year: 2009). |
Wood, Timothy, Prashant Shenoy, Alexandre Gerber, K.K. Ramakrishnan, and Jacobus Van der Merwe “The Case for Enterprise-Ready Virtual Private Clouds”, Proceedings of the 2009 Conference on Hot Topics in Cloud Computing HotCloud'09, Jun. 15, 2009. (Year: 2009). |
AWS, “Amazon Virtual Private Cloud (VPC) (beta),” http://aws.amazon.com/vpc/, Jul. 24, 2010, 7 pages. |
Wood, et al., “The Case for Enterprise-Ready Virtual Private Clouds,” https://www.usenix.org/legacy/event/hotcloud09/tech/full_papers/wood.pdf, Jun. 2009, 5 pages. |
International Search Report and Written Opinion in counterpart International Application No. PCT/US2011/000701, dated Sep. 9, 2011, 9 pages. |
International Preliminary Report on Patentability in counterpart International Application No. PCT/US2011/000701, dated Oct. 30, 2012, 7 pages. |
First Examination Report in counterpart Indian Patent Application No. 3020/KOLNP/2012, dated Dec. 6, 2018, 6 pages. |
CohesiveFT, “VPN-Cubed IPsec to EC2 (Free Edition) v20090827,” http://www.cohesiveft.com/dnld/VPN-Cubed_IPsec_toEC2_Free_Edition_v20090827.pdf, Aug. 27, 2009, 41 pages. |
CohesiveFT, “VPN-Cubed SSL to Cloud (Free Edition) v20091207,” http://www.cohesiveft.com/dnld/VPN-Cubed_051_SSL-to-Cloud_Free-Edition_20091207.pdf, Dec. 7, 2009, 47 pages. |
Cisco | VMware, “Virtual Networking Features of the VMware vNetwork Distributed Switch and Cisco Nexus 1000V Switches,” http://www.cisco.com/en/prod/collateral/swithces/ps9441/ps9902/solution_overview_c22-526262.pdf, Dec. 15, 2009, 6 pages. |
Cisco, “Cisco VN-Link: Virtualization-Aware Networking,” White Paper, http://www.cisco.com/en/US/solutions/collateral/ns340/ns224/ns892/ns894/white_paper_c11-525307.pdf, Mar. 1, 2009, 10 pages. |
English Translation of Office Action in counterpart Chinese Patent Application No. 201180020902.6, dated Jul. 11, 2014, 12 pages. |
English Translation of Office Action in counterpart Chinese Patent Application No. 201180020902.6, dated Feb. 16, 2015, 5 pages. |
CohesiveFT:“VPN-Cubed IPsec to EC2 Free Edition v20090827”,Aug. 28, 2009,XP000002657094, URL:http://www.cohesiveft.com/dnld/VPN-Cubed_IPsec_toEC2_Free_Edition_v20090827.pdf. |
http://aws.amazon/com/vpc. |
Number | Date | Country | |
---|---|---|---|
Parent | 12799557 | Apr 2010 | US |
Child | 17363273 | US |