Method and system for implementing logical port classifications

A non-transitory machine readable medium storing a program for implementing a particular managed forwarding element (MFE) to forward packets in a network, the particular MFE implementing a logical forwarding element (LFE) along with a plurality of other MFEs, the program for execution by at least one processor, the program comprising sets of instructions for:

• receiving a packet at a physical port of the particular MFE;
• using a first identifier of the physical port to perform a first matching operation that identifies a first match-action rule specifying a second identifier identifying a logical port group (LPG) that includes a plurality of logical ports of the LFE, wherein each logical port of the LFE maps to at least one physical port of one MFE, wherein at least two different LPG identifiers are associated with at least two different sets of logical ports of the LFE;
• using the LPG second identifier to perform a second matching operation that identifies a second match-action rule specifying a forwarding action to perform on the packet;
• and
• performing the specified forwarding action on the packet.

A non-transitory machine readable medium storing a program for implementing a particular managed forwarding element (MFE) to forward packets in a network, the particular MFE implementing a logical forwarding element (LFE) along with a plurality of other MFEs, the program for execution by at least one processor, the program comprising sets of instructions for:

• receiving a packet at a physical port of the particular MFE;
• using a first identifier of the physical port to perform a first matching operation that identifies a first match-action rule specifying a second identifier identifying a logical group (LG);
• using the LG second identifier to perform a second matching operation that identifies a second match-action rule specifying a port-isolation action to perform on the packet that determines that the packet should be dropped when the packet is associated with a logical port that is isolated from the logical port to which the packet is destined;
• and
• performing the specified port-isolation action on the packet.

A non-transitory machine readable medium storing a program for implementing a particular managed forwarding element (MFE) to forward packets in a network, the particular MFE implementing a logical forwarding element (LFE) along with a plurality of other MFEs, the program for execution by at least one processor, the program comprising sets of instructions for:

• receiving a packet at a physical port of the particular MFE;
• using a first identifier of the physical port to perform a first matching operation that identifies a first match-action rule specifying a second identifier identifying a logical group (LG);
• using the LG second identifier to perform a second matching operation that identifies a second match-action rule specifying a port-security decision to perform on the packet that determines whether the packet should be forwarded or dropped when a set of attributes of the packet matches a rule qualifier of the second match-action rule;
• and
• performing the specified port-security decision on the packet.

A non-transitory machine readable medium storing a program for implementing a first managed forwarding element (MFE) to forward packets in a network, the first MFE implementing a logical forwarding element (LFE) along with a plurality of other MFEs, the program for execution by at least one processor, the program comprising sets of instructions for:

• receiving a packet at a physical port of the first MFE;
• using a first identifier of the physical port to perform a first matching operation that identifies a first match-action rule specifying a second identifier identifying a logical group (LG);
• embedding the LG second identifier in a tunnel header that encapsulates the packet, wherein a second MFE uses the LG second identifier to perform a second matching operation that identifies a second match-action rule specifying a port-isolation action to perform on the packet that determines that the packet should be dropped when the packet is associated with a logical port that is isolated from the logical port to which the packet is destined;
• and
• forwarding the encapsulated packet to the second MFE.

A non-transitory machine readable medium storing a program for implementing a particular managed forwarding element (MFE) to forward packets in a network, the particular MFE implementing a logical forwarding element (LFE) along with a plurality of other MFEs, the program for execution by at least one processor, the program comprising sets of instructions for:

• receiving a packet at a physical port of the particular MFE;
• using a first identifier of the physical port to perform a first matching operation that identifies a first match-action rule specifying a second identifier identifying a logical port group (LPG) that includes a plurality of logical ports of the LFE, wherein each logical port of the LFE maps to at least one physical port of one MFE, wherein at least two different LPG identifiers are associated with at least two different sets of logical ports of the LFE;
• embedding the LPG second identifier in a tunnel header that encapsulates the packet, wherein a second MFE uses the LPG second identifier to perform a second matching operation that identifies a second match-action rule specifying a forwarding action to perform on the packet;
• and
• forwarding the encapsulated packet to the second MFE.

A non-transitory machine readable medium storing a program for implementing a particular managed forwarding element (MFE) to forward packets in a network, the particular MFE implementing a logical forwarding element (LFE) along with a plurality of other MFEs, the program for execution by at least one processor, the program comprising sets of instructions for:

• receiving a packet at a physical port of the particular MFE;
• using a first identifier of the physical port to perform a first matching operation that identifies a first match-action rule specifying a second identifier identifying a logical group (LG);
• embedding the LG second identifier in a tunnel header that encapsulates the packet, wherein a second MFE uses the LG second identifier to perform a second matching operation that identifies a second match-action rule specifying a port-security decision that determines whether the packet should be forwarded or dropped when a set of attributes of the packet matches a rule qualifier of the second match-action rule;
• and
• forwarding the encapsulated packet to the second MFE.