# US 10,310,886 B2 · Network control system for configuring middleboxes > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,310,886 B2 - Document ID: US10310886B2 - Status: Granted - Kind: B2 - Application number: 15/398,709 - Filed: 2017-01-04 - Published: 2017-05-04 - Granted: 2019-06-04 - Earliest claimed: 2011-11-15 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Ronghua Zhang; Teemu Koponen, IV; Pankaj Thakkar; Amar Padmanabhan; Martin Casado - Web page: https://patentgrep.com/patent/US10310886B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 15/177: Initialisation or configuration control {(processor initialisation G06F9/4405)} - H04L 41/0803: Configuration setting - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 41/0823: characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability (for optimising operational conditions of wireless networks H04W24/02) - H04L 41/0889: {Techniques to speed-up the configuration process} - H04L 41/0894: Policy-based network configuration management - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 45/64: using an overlay routing layer - H04L 45/74: Address processing for routing - H04L 49/70: {Virtual switches} - H04L 61/2503: Translation of Internet protocol [IP] addresses - H04L 61/2517: using port numbers - H04L 61/2521: Translation architectures other than single NAT servers - H04L 61/256: NAT traversal - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 67/1008: based on parameters of servers, e.g. available memory or workload (monitoring of computer activity G06F11/30) - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 45/02: Topology update or discovery - H04L 49/15: Interconnection of switching modules - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments provide a method for configuring a logical middlebox in a hosting system that includes a set of nodes. The logical middlebox is part of a logical network that includes a set of logical forwarding elements that connect a set of end machines. The method receives a set of configuration data for the logical middlebox. The method uses a stored set of tables describing physical locations of the end machines to identify a set of nodes at which to implement the logical middlebox. The method provides the logical middlebox configuration for distribution to the identified nodes. ## Claims ### Claim 1 A method for performing middlebox operations on a host computer executing a middlebox element having a plurality of middlebox instances and a plurality of end machines, the method comprising: receiving a data packet from a managed forwarding element via a software port between the managed forwarding element and the middlebox element having the plurality of middlebox instances, wherein the managed forwarding element executes on the host computer to implement a plurality of logical networks; based on a tag that the managed forwarding element associated with the data packet, selecting from the plurality of middlebox instances a particular middlebox instance associated with the tag; using the selected middlebox instance to perform a middlebox operation on the received packet; and sending the processed data packet to the managed forwarding element. ### Claim 2 (depends on 1) The method of claim 1, wherein the tag identifies the particular middlebox instance, wherein the particular middlebox instance is associated with a particular logical network. ### Claim 3 (depends on 2) The method of claim 2, wherein the managed forwarding element received the data packet from a particular end machine associated with the particular logical network, wherein the managed forwarding element selected the tag based on the particular logical network associated with the data packet. ### Claim 4 (depends on 1) The method of claim 1, wherein the tag is prepended to the data packet by the managed forwarding element. ### Claim 5 (depends on 1) The method of claim 1, wherein selecting the particular middlebox instance comprises mapping the tag to the particular middlebox instance using a binding table. ### Claim 6 (depends on 1) The method of claim 1, wherein sending the processed data packet to the managed forwarding element comprises sending the processed packet with the tag. ### Claim 7 (depends on 1) The method of claim 1, wherein the managed forwarding element sent the data packet to the middlebox element according to a routing policy that routes the data packet based on a data field other than a destination network address of the data packet. ### Claim 8 (depends on 7) The method of claim 7, wherein the data field is an ingress port through which the data packet was received. ### Claim 9 (depends on 7) The method of claim 7, wherein the managed forwarding element receives the processed data packet and subsequently routes the processed data packet based on the destination network address of the processed data packet. ### Claim 10 A non-transitory machine readable medium storing a program for performing middlebox operations on a host computer executing a middlebox element having a plurality of middlebox instances and a plurality of end machines, the program comprising sets of instructions for: receiving a data packet from a managed forwarding element via a software port between the managed forwarding element and the middlebox element having the plurality of middlebox instances, wherein the managed forwarding element executes on the host computer to implement a plurality of logical networks; based on a tag that the managed forwarding element associated with the data packet, selecting from the plurality of middlebox instances a particular middlebox instance associated with the tag; using the selected middlebox instance to perform a middlebox operation on the received packet; and sending the processed data packet to the managed forwarding element. ### Claim 11 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the tag identifies the particular middlebox instance, wherein the particular middlebox instance is associated with a particular logical network. ### Claim 12 (depends on 11) The non-transitory machine readable medium of claim 11, wherein the managed forwarding element received the data packet from a particular end machine associated with the particular logical network, wherein the managed forwarding element selected the tag based on the particular logical network associated with the data packet. ### Claim 13 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the tag is prepended to the data packet by the managed forwarding element. ### Claim 14 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of instructions for selecting the particular middlebox instance comprises a set of instructions for mapping the tag to the particular middlebox instance using a binding table. ### Claim 15 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of instructions for sending the processed data packet to the managed forwarding element comprises a set of instructions for sending the processed packet with the tag. ### Claim 16 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the managed forwarding element sent the data packet to the middlebox element according to a routing policy that routes the data packet based on a data field other than a destination network address of the data packet. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the data field is an ingress port through which the data packet was received, wherein the managed forwarding element receives the processed data packet from the middlebox element and subsequently routes the processed data packet based on the destination network address of the processed data packet. ### Claim 18 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the plurality of logical middleboxes are one of firewalls, network address translators, and load balancers.