# US 10,484,302 B2 · Managed forwarding element executing in public cloud data compute node with different internal and external network addresses

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,302 B2
- Document ID: US10484302B2
- Status: Granted
- Kind: B2
- Application number: 15/253,833
- Filed: 2016-08-31
- Published: 2018-03-01
- Granted: 2019-11-19
- Earliest claimed: 2016-08-27
- Assignees: Nicira, Inc.
- Applicants: Nicira, Inc.
- Inventors: Mukesh Hira; Saurabh Shah; Su Wang; Jia Yu
- Web page: https://patentgrep.com/patent/US10484302B2

## CPC

- H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 9/5072: {Grid computing}
- G06F 11/008: {Reliability or availability analysis}
- G06F 11/07: Responding to the occurrence of a fault, e.g. fault tolerance
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/1438: {Restarting or rejuvenating}
- G06F 11/1482: using middleware or operating system [OS] functionalities
- G06F 11/2035: {without idle spare hardware}
- G06F 11/3433: {for load management (allocation of a server based on load conditions G06F9/505; load rebalancing G06F9/5083; redistributing the load in a network by a load balancer H04L67/1029)}
- G06F 15/177: Initialisation or configuration control {(processor initialisation G06F9/4405)}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
- H04L 41/044: comprising hierarchical management structures
- H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play
- H04L 41/20: {Network management software packages}
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L 45/38: {Flow based routing}
- H04L 45/72: {Routing based on the source address}
- H04L 45/74: Address processing for routing
- H04L 47/32: by discarding or delaying data units, e.g. packets or frames
- H04L 49/15: Interconnection of switching modules
- H04L 49/25: Routing or path finding in a switch fabric
- H04L 49/70: {Virtual switches}
- H04L 61/2514: between local and global IP addresses
- H04L 61/2521: Translation architectures other than single NAT servers
- H04L 61/2539: Hiding addresses; Keeping addresses anonymous
- H04L 61/256: NAT traversal
- H04L 61/2592: using tunnelling or encapsulation
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0263: {Rule management}
- H04L 63/0272: {Virtual private networks}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L 47/125: by balancing the load, e.g. traffic engineering
- H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
- H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption
- H04L 2212/00: Encapsulation of packets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Some embodiments provide a method for a network controller that manages a logical network implemented in a datacenter comprising forwarding elements to which the network controller does not have access. The method identifies a data compute node (DCN), that operates on a host machine in the datacenter, to attach to the logical network. The DCN has a network interface with a first network address provided by a management system of the datacenter, and executes (i) a workload application and (ii) a managed forwarding element (MFE). The method distributes configuration data for configuring the MFE to receive data packets sent from the workload application on the DCN and perform network security and forwarding processing on the data packets. The data packets sent by the workload application have a second network address as a source address when received by the MFE and are encapsulated by the MFE using the first network address.

## Claims

### Claim 1

A method for a network controller that manages a logical network implemented in a datacenter comprising forwarding elements to which the network controller does not have access, the method comprising:
identifying a data compute node, that operates on a host machine in the datacenter, to attach to the logical network, the data compute node having a network interface with a first network address provided by a management system of the datacenter, wherein the data compute node executes (i) a workload application and (ii) a managed forwarding element, wherein the host machine executes a forwarding element, to which the network controller does not have access, outside of the data compute node; and
distributing configuration data for configuring the managed forwarding element to receive data packets sent from the workload application on the data compute node and perform network security and forwarding processing on the data packets, wherein the data packets sent by the workload application have a second network address as a source address when received by the managed forwarding element and are encapsulated by the managed forwarding element using the first network address provided by the management system of the datacenter before being transmitted from the data compute node to the forwarding element executing on the host machine to which the network controller does not have access.

### Claim 2 (depends on 1)

The method of claim 1, wherein the second network address is mapped to a logical port of a logical switch to which the data compute node is logically attached, wherein the logical switch is one of a plurality of logical forwarding elements of the logical network.

### Claim 3 (depends on 1)

The method of claim 1, wherein the managed forwarding element is a flow-based software forwarding element.

### Claim 4 (depends on 1)

The method of claim 1, wherein the managed forwarding element comprises a first bridge that connects via an internal port to the workload application and a second bridge that connects to the network interface of the data compute node, wherein the first bridge is configured to perform network security processing and logical forwarding on data packets sent to and from the workload application.

### Claim 5 (depends on 4)

The method of claim 4, wherein the logical forwarding comprises:
applying forwarding rules for at least one logical switch to identify a logical egress port for each data packet; and
applying forwarding rules for a logical router.

### Claim 6 (depends on 1)

The method of claim 1, wherein the managed forwarding element comprises a first bridge that connects via an internal port to the workload application and a second bridge that connects to the network interface of the data compute node, wherein the first bridge is configured to receive a data packet from the workload application, identify a logical egress port for the data packet, encapsulate the data packet and send the encapsulated data packet to a virtual tunnel endpoint (VTEP) of the second bridge.

### Claim 7 (depends on 6)

The method of claim 6, wherein the data packet is received from the workload application via a first network stack associated with the second network address, wherein the first network address is used as the source network address for an encapsulation header applied by the first bridge, wherein the encapsulated data packet is sent to the VTEP of the second bridge via a second network stack associated with the first network address.

### Claim 8 (depends on 6)

The method of claim 6, wherein the second bridge is configured to send incoming packets encapsulated with the first network address as a destination address to an overlay port of the first bridge via the VTEP, wherein the first bridge is configured to decapsulate the incoming packets received via the overlay port.

### Claim 9 (depends on 8)

The method of claim 8, wherein the incoming packets encapsulated with the first network address as a destination address are received by the data compute node from the forwarding element executing on the host machine to which the network controller does not have access.

### Claim 10 (depends on 1)

The method of claim 1, wherein the workload application is a first workload application and the data compute node is a first data compute node, wherein data packets sent by the workload application to a second workload application executing on a second data compute node in the datacenter are encapsulated and transmitted out of the data compute node network interface to the forwarding element executing on the host machine to which the network controller does not have access, wherein the forwarding element executing on the host machine to which the network controller does not have access is controlled by the datacenter management system, wherein the forwarding element controlled by the datacenter management system encapsulates the outgoing data packets a second time using a third network address associated with a physical network interface of a host machine on which the data compute node operates.

### Claim 11 (depends on 1)

The method of claim 1, wherein the network controller is a first network controller and the data compute node is a first data compute node, wherein identifying the first data compute node comprises receiving an attachment request from a second network controller operating on a second data compute node in the datacenter.

### Claim 12 (depends on 11)

The method of claim 11, wherein the attachment request is forwarded by the second network controller after receiving an attachment request from the first data compute node.

### Claim 13 (depends on 11)

The method of claim 11, wherein distributing the configuration data comprises distributing the configuration data to the second network controller, wherein the second network controller distributes the configuration data to the second data compute node.

### Claim 14

A non-transitory machine readable medium storing a program which when executed by at least one processing unit implements a network controller that manages a logical network implemented in a datacenter comprising forwarding elements to which the network controller does not have access, the program comprising sets of instructions for:
identifying a data compute node, that operates on a host machine in the datacenter, to attach to the logical network, the data compute node having a network interface with a first network address provided by a management system of the datacenter, wherein the data compute node executes (i) a workload application and (ii) a managed forwarding element, wherein the host machine executes a forwarding element, to which the network controller does not have access, outside of the data compute node; and
distributing configuration data for configuring the managed forwarding element to receive data packets sent from the workload application on the data compute node and perform network security and forwarding processing on the data packets, wherein the data packets sent by the workload application have a second network address as a source address when received by the managed forwarding element and are encapsulated by the managed forwarding element using the first network address provided by the management system of the datacenter before being transmitted from the data compute node to the forwarding element executing on the host machine to which the network controller does not have access.

### Claim 15 (depends on 14)

The non-transitory machine readable medium of claim 14, wherein the managed forwarding element comprises a first bridge that connects via an internal port to the workload application and a second bridge that connects to the network interface of the data compute node.

### Claim 16 (depends on 15)

The non-transitory machine readable medium of claim 15, wherein the first bridge is configured to perform network security processing and logical forwarding on data packets sent to and from the workload application, wherein the network security processing comprises application of distributed firewall rules and the logical forwarding comprises applying forwarding rules for at least one logical switch to identify a logical egress port for each data packet.

### Claim 17 (depends on 15)

The non-transitory machine readable medium of claim 15, wherein the first bridge is configured to receive a data packet from the workload application, identify a logical egress port for the data packet, encapsulate the data packet and send the encapsulated data packet to a virtual tunnel endpoint (VTEP) of the second bridge.

### Claim 18 (depends on 17)

The non-transitory machine readable medium of claim 17, wherein the data packet is received from the workload application via a first network stack associated with the second network address, wherein the encapsulated data packet is sent to the VTEP of the second bridge via a second network stack associated with the first network address, wherein the first network address is used as the source network address for an encapsulation header applied by the first bridge.

### Claim 19 (depends on 17)

The non-transitory machine readable medium of claim 17, wherein the second bridge is configured to send incoming packets encapsulated with the first network address as a destination address to an overlay port of the first bridge via the VTEP, wherein the first bridge is configured to decapsulate the incoming packets received via the overlay port.

### Claim 20 (depends on 14)

The non-transitory machine readable medium of claim 14, wherein the workload application is a first workload application and the data compute node is a first data compute node, wherein data packets sent by the workload application to a second workload application executing on a second data compute node in the datacenter are encapsulated and transmitted out of the data compute node network interface to the forwarding element executing on the host machine to which the network controller does not have access, wherein the forwarding element executing on the host machine to which the network controller does not have access is controlled by the datacenter management system, wherein the forwarding element controlled by the datacenter management system encapsulates the outgoing data packets a second time using a third network address associated with a physical network interface of a host machine on which the data compute node operates.

### Claim 21 (depends on 14)

The non-transitory machine readable medium of claim 14, wherein the network controller is a first network controller and the data compute node is a first data compute node, wherein the set of instructions for identifying the first data compute node comprises a set of instructions for receiving an attachment request from a second network controller operating on a second data compute node in the datacenter, wherein the attachment request is forwarded by the second network controller after receiving an attachment request from the first data compute node.