# US 10,320,671 B2 · Extension of logical networks across layer 3 virtual private networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,671 B2 - Document ID: US10320671B2 - Status: Granted - Kind: B2 - Application number: 15/082,975 - Filed: 2016-03-28 - Published: 2016-07-21 - Granted: 2019-06-11 - Earliest claimed: 2012-04-13 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Bruce Davie - Web page: https://patentgrep.com/patent/US10320671B2 ## CPC - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 41/0803: Configuration setting - H04L 41/122: of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 45/74: Address processing for routing - H04L 45/745: Address table lookup; Address filtering - H04L 49/70: {Virtual switches} - H04L 63/0272: {Virtual private networks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of manages a set of managed forwarding elements that forward data between machines. The method configures (1) a first managed forwarding element to operate in a first network that uses first and second address spaces that at least partially overlap with each other, (2) a second managed forwarding element to operate in a second network that uses the first address space, and (3) a third managed forwarding element to operate in a third network that uses the second address space. A machine in the second network and a machine in the third network have an identical address that belongs to both the first and second address spaces. The method directs the first managed forwarding element to connect to the second and third managed forwarding elements in a manner that enables the first managed forwarding element to forward data from a machine in the first network to the machine in the second network via the second managed forwarding element. ## Claims ### Claim 1 A method for managing a plurality of tenant networks spanning a plurality of physical sites, the method comprising: configuring a particular managed forwarding element (MFE) executing on a particular host computer at a multi-tenant site (i) to implement a first logical forwarding element (LFE) with a first set of MFEs executing on a first set of host computers and (ii) to implement a second LFE with a second set of MFEs executing on a second set of host computers, the first LFE for forwarding packets for a first tenant network and the second LFE for forwarding packets for a second tenant network, the first and second LFEs comprising first and second logical ports, said configuring comprising configuring the particular MFE to map the first logical port to a first extender MFE at a first tenant site associated with the first tenant network and map the second logical port to a second extender MFE at a second tenant site associated with the second tenant network; forwarding a first packet associated with the first tenant network to the first tenant site by using the first LFE and the first logical port to forward the first packet to the first extender; and forwarding a second packet associated with the second tenant network to the second tenant site by using the second LFE and the second logical port to forward the second packet to the second extender. ### Claim 2 (depends on 1) The method of claim 1, wherein forwarding the first and second packets to the first and second tenant sites comprises tunneling packets across a wide area network (WAN). ### Claim 3 (depends on 1) The method of claim 1, wherein said configuring the particular MFE to map the first logical port to the first extender MFE comprises configuring the particular MFE to map the first logical port to a first virtual interface (VIF) for tunneling packets of the first tenant network to the first extender MFE at the first tenant site, and said configuring the particular MFE to map the second logical port to the second extender MFE comprises configuring the particular MFE to map the second logical port to a second VIF for tunneling packets of the second tenant network to the second extender MFE at the second tenant site. ### Claim 4 (depends on 3) The method of claim 3, wherein the first tenant network is associated with a first tenant identifier and the second tenant network is associated with a second tenant identifier, the method further comprising using the first tenant identifier to establish a first tunnel with the first extender MFE and using the second tenant identifier to establish a second tunnel with the second extender MFE. ### Claim 5 (depends on 4) The method of claim 4, wherein a provider edge router associates a first VPN routing and forwarding (VRF) table for the first tenant network with the first identifier and a second VRF table for the second tenant network with the second identifier. ### Claim 6 (depends on 1) The method of claim 1, wherein the first tenant network uses a first address space and the second tenant network uses a second address space, wherein the first and second address spaces partially overlap. ### Claim 7 (depends on 1) The method of claim 1, wherein at least one common host computer belongs to both the first set of host computers and the second set of host computers, and the first and second LFEs span over an MFE executing on the common host computer. ### Claim 8 (depends on 1) The method of claim 1 wherein said configuring the particular MFE is performed by at least one network controller. ### Claim 9 (depends on 8) The method of claim 8 wherein the network controller configures a particular set of MFEs to implement a particular LFE with a plurality of logical ports, by mapping the plurality of logical ports of the particular LFE to a plurality of managed ports of the particular set of MFEs. ### Claim 10 A method for managing a multi-tenant site comprising a plurality of host computers executing managed forwarding elements (MFEs) that forward data in the multi-tenant site, the method comprising: configuring a first plurality of MFEs to implement a first logical forwarding element (LFE) that (i) spans the first plurality of MFEs and (ii) forwards data for a first set of machines having addresses in a first address space; configuring a second plurality of MFEs to implement a second LFE that (i) spans the second plurality of MFEs and (ii) forwards data for a second set of machines having addresses in a second address space; and configuring a particular MFE that belongs to both the first and second pluralities of MFEs to forward data to a first tenant site at a first geographic location using the first address space and a second tenant site at a second different geographic location using the second address space. ### Claim 11 (depends on 10) The method of claim 10, wherein forwarding data to the first and second tenant sites comprises tunneling data across a wide area network (WAN). ### Claim 12 (depends on 10) The method of claim 10, wherein the first address space and the second address space at least partially overlap. ### Claim 13 (depends on 12) The method of claim 12, wherein the first tenant network is associated with a first tenant identifier and the second tenant network is associated with a second tenant identifier. ### Claim 14 (depends on 13) The method of claim 13, wherein the first tenant site comprises a first extender MFE and the second tenant site comprises a second extender MFE, wherein the particular MFE uses the first tenant identifier to establish a first tunnel with the first extender MFE and the second tenant identifier to establish a second tunnel with the second extender MFE. ### Claim 15 (depends on 10) The method of claim 10 wherein configuring the first and second pluralities of MFEs comprises configuring at least one MFE to perform mapping operations between physical network attributes and logical network attributes. ### Claim 16 (depends on 10) The method of claim 10 wherein configuring the first and second pluralities of MFEs comprises configuring at least one MFE to perform logical forwarding operations based on logical attributes of an LFE. ### Claim 17 A non-transitory machine readable medium storing a program for managing a plurality of tenant networks spanning a plurality of physical sites, the program comprising sets of instructions for: configuring a first plurality of managed forwarding elements (MFEs) executing on a first set of host computers at a first multi-tenant datacenter to implement a first logical forwarding element (LFE) and a second LFE; and configuring a second plurality of MFEs executing on a second set of host computers at a second multi-tenant datacenter to implement the first LFE and the second LFE; wherein the first LFE spans both the first and the second pluralities of MFEs, and the second LFE spans both the first and the second pluralities of MFEs; wherein the first LFE is for forwarding packets for a first tenant network and the second LFE is for forwarding packets for a second tenant network. ### Claim 18 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the first multi-tenant datacenter and the second multi-tenant datacenter are physically separated by a wide area network (WAN). ### Claim 19 (depends on 18) The non-transitory machine readable medium of claim 18, wherein a particular MFE in the first multi-tenant datacenter forwards packets to the second multi-tenant datacenter by tunneling data across the WAN. ### Claim 20 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the first LFE comprises a first logical port that is mapped to a first virtual interface (VIF) at an MFE of the first multi-tenant datacenter for tunneling data of the first multi-tenant datacenter to the second multi-tenant datacenter. ### Claim 21 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the first tenant network is associated with a first tenant identifier and the second tenant network is associated with a second tenant identifier. ### Claim 22 (depends on 21) The non-transitory machine readable medium of claim 21, wherein a provider edge router of the first multi-tenant datacenter associates a first VPN routing and forwarding (VRF) table for the first tenant network with the first identifier and a second VRF table for the second tenant network with the second identifier. ### Claim 23 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the first tenant network uses a first address space and the second tenant network uses a second address space, wherein the first and second address spaces partially overlap. ### Claim 24 (depends on 17) The non-transitory machine readable medium of claim 17 wherein when an MFE implements an LFE for a tenant, the MFE performs logical forwarding operations based on a tenant-specific logical identifier associated with the implemented LFE for the tenant.