US 10,951,744 B2 · Private ethernet overlay networks over a shared ethernet in a virtual environment

Abstract

A system for private networking within a virtual infrastructure is presented. The system includes a virtual machine (VM) in a first host, the VM being associated with a first virtual network interface card (VNIC), a second VM in a second host, the second VM being associated with a second VNIC, the first and second VNICs being members of a fenced group of computers that have exclusive direct access to a private virtual network, wherein VNICs outside the fenced group do not have direct access to packets on the private virtual network, a filter in the first host that encapsulates a packet sent on the private virtual network from the first VNIC, the encapsulation adding to the packet a new header and a fence identifier for the fenced group, and a second filter in the second host that de-encapsulates the packet to extract the new header and the fence identifier.

Claims20

Dependent claims

A method of defining overlay-network encapsulation headers to establish a particular private virtual network (PVN) over a shared physical network, the method comprising:

at a filter executing on a first host computer:
receiving a packet sent by a first machine executing on the first host computer, the packet addressed to a second machine executing on a second host computer, the first and second machines being members of the particular PVN which also includes a plurality of other machines;
generating, for the packet, an overlay-network encapsulation header that allows the packet to be forwarded on the particular PVN to the second machine;
storing, in the generated encapsulation header, an identifier that identifies the particular PVN, said particular PVN identifier stored in the encapsulation header to ensure that only machines that are members of the particular PVN have access to the messages sent along the shared physical network, the particular PVN identifier allowing multiple PVNs to be defined on the shared physical network for multiple different sets of machines;
and
encapsulating the packet with the encapsulating header and forwarding the encapsulated packet to the second machine over the physical network.

3 more elements

A non-transitory machine readable medium storing a filter for defining overlay-network encapsulation headers to establish a particular private virtual network (PVN) over a shared physical network, the filter for execution by at least one hardware processing unit of a first host computer, the filter comprising sets of instructions for:

receiving a packet sent by a first machine executing on the first host computer, the packet addressed to a second machine executing on a second host computer, the first and second machines being members of the particular PVN which also includes a plurality of other machines;
generating, for the packet, an overlay-network encapsulation header that allows the packet to be forwarded on the particular PVN to the second machine;
storing, in the generated encapsulation header, an identifier that identifies the particular PVN, said particular PVN identifier stored in the encapsulation header to ensure that only machines that are members of the particular PVN have access to the messages sent along the shared physical network, the particular PVN identifier allowing multiple PVNs to be defined on the shared physical network for multiple different sets of machines;
and
encapsulating the packet with the encapsulation header and forwarding the encapsulated packet to the second machine over the physical network.

2 more elements

Dependencies are inferred from the claim text.

Private ethernet overlay networks over a shared ethernet in a virtual environment

Life of this patent

Private ethernet overlay networks over a shared ethernet in a virtual environment

Life of this patent

Abstract

Claims20