System and method for centralized policy enforcement for network segmentation
AssigneeArista Networks, Inc.
InventorsNaveen Kumar Devaraj, Chandrashekhar Appanna
Life of this patent
Estimating the term…
Abstract
In general, embodiments of the invention relate to providing a scalable network configuration to enable hosts for different tenants to communicate with each other. More specifically, embodiments of the invention relate to using a combination of per-tenant virtual routing and forwarding (VRF) tables, encapsulation, and stateless access control lists (ACLs) to enable intra-tenant and inter-tenant communication and segmentation.
Claims20
A method for processing frames in a hierarchically-structured network that includes a plurality of hosts, wherein at least one host of the plurality of hosts is associated with a first tenant and at least one host of the plurality of hosts is associated with a second tenant, and wherein the method is performed by a network device in the network, the method comprising:
- receiving an encapsulated frame on a first encapsulation path, wherein the first encapsulation path is associated with the first tenant;
- decapsulating the encapsulated frame to obtain a frame;
- routing the frame using a virtual routing and forwarding (VRF) table associated with the first tenant to obtain a rewritten frame;
- determining, based on applying an access control list (ACL) to the rewritten frame, to transmit the rewritten frame to a target host associated with the second tenant, wherein the target host is one of the plurality of hosts;
- based on the determining, encapsulating the rewritten frame to generate a second encapsulated frame;
- and
- transmitting the second encapsulated frame towards the target host on a second encapsulation path, wherein the second encapsulation path is associated with the second tenant.
A network device, comprising:
- a processor,
- memory comprising instructions, which when executed by the processor, perform a method for processing frames, the method comprising:
- receiving an encapsulated frame on a first encapsulation path, wherein the first encapsulation path is associated with the first tenant;
- decapsulating the encapsulated frame to obtain a frame;
- routing the frame using a virtual routing and forwarding (VRF) table associated with a first tenant to obtain a rewritten frame;
- determining, based on applying an access control list (ACL) to the rewritten frame, to transmit the rewritten frame to a target host associated with the second tenant;
- based on the determining, encapsulating the rewritten frame to generate a second encapsulated frame;
- and
- transmitting the second encapsulated frame towards the target host on a second encapsulation path, wherein the second encapsulation path is associated with the second tenant.
A method for processing frames, the method comprising:
- receiving an encapsulated frame, wherein the encapsulated frame is associated with a first tenant;
- decapsulating the encapsulated frame to obtain a frame;
- routing the frame using a virtual routing and forwarding (VRF) table associated with a first tenant to obtain a rewritten frame;
- determining, based on applying an access control list (ACL) to the rewritten frame, to transmit the rewritten frame to a first host associated with the second tenant;
- based on the determining, encapsulating the rewritten frame to generate a second encapsulated frame, wherein the second encapsulated frame is associated with the second tenant;
- and
- transmitting the second encapsulated frame towards the first host.
Dependencies are inferred from the claim text.