Shared service access for multi-tenancy in a data center fabric

A network element comprising—an application specific integrated circuit (ASIC) comprising a forwarding information base (FIB), wherein the FIB includes:

• a tenant-specific region storing tenant-specific destination address information populated based on tenant-specific virtual routing and forwarding (VRF) instances;
• and a shared service region storing global shared service destination address information populated based on one or more shared service VRF instances, the one or more shared service VRF instances each being derived from one of the tenant-specific VRF instances, and wherein the shared service region comprises a next hop destination for a shared service network destination, wherein the network element is configured to:
• receive a packet that includes a first endpoint group tag representative of authorized shared services;
• based on information in the packet, instantiate a tenant-specific virtual VRF instance;
• perform, using the tenant-specific VRF instance, a tenant-specific lookup in the tenant-specific region of the FIB to identify a presence of a shared service destination for the packet;
• based on the tenant-specific VRF instance, instantiate a shared service VRF instance for the packet;
• using the shared service VRF instance, perform a shared service lookup in the shared services region of the FIB to identify a shared service destination address for the packet;
• replace the first endpoint group tag with a second endpoint group tag recognizable by the shared service destination address;
• and forward the packet to the shared service destination address, wherein performing the shared service lookup comprises:
• performing a lookup to identify a shared service IP address, wherein the shared service IP address is only stored once in the FIB and is associated with multiple tenant-specific VRF instances.

A data center fabric comprising:

• a network element configured to receive a packet from a tenant server, the network element comprising:
• an application specific integrated circuit (ASIC) comprising a forwarding information base (FIB);
• the FIB comprising:
• a tenant-specific region storing tenant-specific destination address information populated based on tenant-specific virtual routing and forwarding (VRF) instances;
• and a shared service region storing global shared service destination address information populated based on one or more shared service VRF instances, the one or more shared service VRF instances each being derived from one of the tenant-specific VRF instances, and wherein the shared service region comprises a next hop destination for a shared service network destination;
• and a shared services network element comprising a shared services server configured to:
• receive a packet, the packet including a first endpoint group tag representative of authorized shared services;
• based on information in the packet, instantiate a tenant-specific virtual VRF instance;
• perform, using the tenant-specific VRF instance, a tenant-specific lookup in the tenant-specific region of the FIB to identify a presence of a shared service destination address in a header of for the packet;
• based on the tenant-specific VRF instance, instantiate a shared service VRF instance for the packet;
• using the shared service VRF instance, perform a shared service lookup in the shared services region of the FIB to identify a shared service destination address for the packet;
• replace the first endpoint group tag with a second endpoint group tag recognizable by the shared service destination address;
• determine whether to apply shared services to the packet based, at least in part, on the second endpoint group tag located in the packet metadata;
• and forward the packet to the shared service destination address, wherein performing the shared service lookup comprises:
• performing a lookup to identify a shared service IP address, wherein the shared service IP address is only stored once in the FIB and is associated with multiple tenant-specific VRF instances.