# US 10,768,958 B2 · Using virtual local area networks in a virtual computer system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,768,958 B2 - Document ID: US10768958B2 - Status: Granted - Kind: B2 - Application number: 14/231,661 - Filed: 2014-03-31 - Published: 2015-10-01 - Granted: 2020-09-08 - Earliest claimed: 2004-11-17 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Hao Xu - Web page: https://patentgrep.com/patent/US10768958B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A virtual computer system includes virtualization software, and one or more physical network interfaces for connecting to one or more computer networks. The visualization software supports one or more virtual machines (VMs), and exports one or more virtual network interfaces to the VM(s) to enable the VM(s) to access the computer network(s) through the physical network interface(s). The virtualization software modifies and filters network data frames from the VM(s) and from the physical network interfaces) to restrict one or more VMs to one or more virtual local area networks (VLANs) that are implemented within a VLAN topology. Restricting a VM to a VLAN Omits the broadcast domain to which the VM belongs, which may reduce security risks facing the VM. implementing the VLAN functionality within the virtualization software provides the functionality to every VM in the computer system, without requiring every VM to provide the functionality. ## Claims ### Claim 1 A method for isolating virtual machines (VMs) to particular virtual local area networks (VLANs) in a virtual infrastructure, the method comprising: receiving, by a VLAN coordinator, a network frame sent from a VM, wherein the VLAN coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system; determining, by the VLAN coordinator, that the network frame sent from the VM currently includes a first VLAN identifier selected by the VM, wherein the first VLAN identifier is provided to restrict a transmission of the network frame sent from the VM to a particular VLAN over a physical network; replacing, by the VLAN coordinator, the first VLAN identifier in the network frame with a second VLAN identifier selected by the VLAN coordinator, wherein the second VLAN identifier restricts a transmission of the network frame sent from the VM to the particular VLAN over the physical network, wherein replacing the first VLAN identifier in the network frame with the second VLAN identifier is transparent to the VM; and transmitting the network frame with the second VLAN identifier over the physical network to the particular VLAN. ### Claim 2 (depends on 1) The method of claim 1, further comprising: removing, by the VLAN coordinator, the second VLAN identifier in an incoming network frame addressed to the VM; and adding the first VLAN identifier to the incoming network frame prior to sending the incoming network frame to the VM, wherein removing the second VLAN identifier and adding the first VLAN identifier is transparent to the VM. ### Claim 3 (depends on 2) The method of claim 2, wherein the physical network comprises a single physical network over which outgoing network frames are transmitted and from which incoming network frames are received. ### Claim 4 (depends on 1) The method of claim 1, wherein the particular VLAN is a private VLAN, and wherein the first VLAN identifier is a public VLAN identifier and wherein the second VLAN identifier is a private VLAN identifier. ### Claim 5 (depends on 1) The method of claim 1, wherein replacing the first VLAN identifier in the network frame with the second VLAN identifier is transparent to a user of the VM. ### Claim 6 (depends on 1) The method of claim 1, wherein the particular VLAN is a public VLAN, and wherein the first VLAN identifier is a private VLAN identifier and wherein the second VLAN identifier is a private VLAN identifier. ### Claim 7 (depends on 1) The method of claim 1, wherein the network frame with the second VLAN identifier is transmitted over a physical network by a physical network interface card (NIC). ### Claim 8 (depends on 1) The method of claim 1, wherein the first VLAN identifier was selected by a user to restrict a transmission of the network frame sent from the VM to a particular VLAN. ### Claim 9 A non-transitory computer-readable storage medium including instructions, that when executed by a processor, cause a virtual local area network (VLAN) coordinator to perform the steps of: receiving a network frame sent from a virtual machine (VM), wherein the VLAN coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system; determining that the network frame sent from the VM currently includes a first VLAN identifier selected by the VM, wherein the first VLAN identifier is provided to restrict a transmission of the network frame sent from the VM to a particular VLAN over a physical network; replacing the first VLAN identifier in the network frame with a second VLAN identifier selected by the VLAN coordinator, wherein the second VLAN identifier restricts a transmission of the network frame sent from the VM to the particular VLAN over the physical network, wherein replacing the first VLAN identifier in the network frame with the second VLAN identifier is transparent to the VM; and transmitting the network frame with the second VLAN identifier over the physical network to the particular VLAN. ### Claim 10 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the processor further causes the VLAN coordinator further performs the steps of: removing the second VLAN identifier in an incoming network frame addressed to the VM; and adding the first VLAN identifier to the incoming network frame prior to sending the incoming network frame to the VM. ### Claim 11 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein the physical network comprises a single physical network over which outgoing network frames are transmitted and from which incoming network frames are received. ### Claim 12 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the VM coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system. ### Claim 13 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein replacing the first VLAN identifier in the network frame with the second VLAN identifier is transparent to a user of the VM. ### Claim 14 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the network frame is received from a virtual network interface card (VNIC) driver loaded into the VM. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the network frame with the second VLAN identifier is transmitted over a physical network by a physical network interface card (NIC). ### Claim 16 A system comprising: a virtual local area network (VLAN); and a host comprising: a processor; a virtual machine (VM); and a VLAN coordinator communicatively coupled to the VM, wherein the VLAN coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system, the VLAN coordinator configured to cause the processor to: receive a network frame sent from the VM; determine that the network frame sent from the VM currently includes a first VLAN identifier selected by the VM, wherein the first VLAN identifier is provided to restrict a transmission of the network frame sent from the VM to a particular VLAN over a physical network; replace the first VLAN identifier in the network frame with a second VLAN identifier selected by the VLAN coordinator, wherein the second VLAN identifier restricts a transmission of the network frame sent from the VM to the particular VLAN over the physical network, wherein replacing the first VLAN identifier in the network frame with the second VLAN identifier is transparent to the VM; and transmit the network frame with the second VLAN identifier over the physical network. ### Claim 17 (depends on 16) The system of claim 16, wherein the VLAN coordinator is further configured to: remove the second VLAN identifier in an incoming network frame addressed to the VM; and add the first VLAN identifier to the incoming network frame prior to sending the incoming network frame to the VM. ### Claim 18 (depends on 16) The system of claim 16, wherein the VM coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system. ### Claim 19 (depends on 16) The system of claim 16, wherein replacing the first VLAN identifier in the network frame with the second VLAN identifier is transparent to a user of the VM. ### Claim 20 (depends on 19) The system of claim 19, wherein the first VLAN identifier was selected by a user to restrict a transmission of the network frame sent from the VM to a particular VLAN.