Method and system for inspecting unicast network traffic between end points residing within a same zone
AssigneeArista Networks, Inc.
InventorsAnuraag Mittal, Aparna Sushrut Karanjkar, Nitin Ravindra Karkhanis, Thejesh Ajjikariappla Panchappa
Life of this patent
Estimating the term…
Abstract
A method and system for inspecting unicast network traffic between end points residing within a same zone. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.
Claims20
A method for processing network traffic, comprising:
- receiving, from a first remote virtual tunnel end point (VTEP), a first virtual layer-3 (VL3) frame comprising a forward-service virtual network identifier (VNI);
- decapsulating the first VL3 frame to obtain a first unicast media access control (MAC) frame originating from a first source, wherein the first unicast MAC frame comprises a forward-service virtual layer-2 (VL2) broadcast domain tag associated with a forward-service VL2 broadcast domain;
- making a first determination, using a first destination MAC address associated with a first destination, that the first destination MAC address is known on the forward-service VNI;
- translating, based on the first determination, the first unicast MAC frame into an original VL2 broadcast domain, to obtain a second unicast MAC frame;
- and
- bridging, through a near network interface (NNI), the second unicast MAC frame to a service device.
A non-transitory computer readable medium (CRM) comprising computer readable program code, which when executed by a computer processor, enables the computer processor to:
- receive, from a first remote virtual tunnel end point (VTEP), a first virtual layer-3 (VL3) frame comprising a forward-service virtual network identifier (VNI);
- decapsulate the first VL3 frame to obtain a first unicast media access control (MAC) frame originating from a first source, wherein the first unicast MAC frame comprises a forward-service virtual layer-2 (VL2) broadcast domain tag associated with a forward-service VL2 broadcast domain;
- make a first determination, using a first destination MAC address associated with a first destination, that the first destination MAC address is known on the forward-service VNI;
- translate, based on the first determination, the first unicast MAC frame into an original VL2 broadcast domain, to obtain a second unicast MAC frame;
- and
- bridge, through a near network interface (NNI), the second unicast MAC frame to a service device.
Dependencies are inferred from the claim text.