# US 11,909,636 B2 · Layer-2 networking using access control lists in a virtualized cloud environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,636 B2 - Document ID: US11909636B2 - Status: Granted - Kind: B2 - Application number: 17/494,720 - Filed: 2021-10-05 - Published: 2022-06-30 - Granted: 2024-02-20 - Earliest claimed: 2020-12-30 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Jagwinder Singh Brar; Lucas Michael Kreger-Stickles; Bryce Eugene Bockman; Peter Croft Jones; Shane Baker - Web page: https://patentgrep.com/patent/US11909636B2 ## CPC - H04L 45/586: of virtual routers - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - H04L 12/1886: {with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains} - H04L 12/46: Interconnection of networks - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/4675: {Dynamic sharing of VLAN information amongst network nodes (configuration of the network or of network elements H04L41/08)} - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 45/16: Multipoint routing - H04L 45/64: using an overlay routing layer - H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's} - H04L 47/12: Avoiding congestion; Recovering from congestion - H04L 47/2483: involving identification of individual flows - H04L 49/70: {Virtual switches} - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 61/2517: using port numbers - H04L 63/101: {Access control lists [ACL]} - H04L 69/22: Parsing or analysis of headers - H04L 69/324: in the data link layer [OSI layer 2], e.g. HDLC - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 45/52: Multiprotocol routers - H04L 45/56: {Routing software} - H04L 61/58: Caching of addresses or names - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Access control list (ACL) information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface. ## Claims ### Claim 1 A method comprising: generating, based on input of a customer, access control list (ACL) information for traffic flow in a Layer 2 virtual network of the customer, wherein the Layer 2 virtual network is hosted on a physical network and comprises a plurality of Layer 2 compute instances, a plurality of Layer 2 virtual network interfaces, and a plurality of Layer 2 virtual switches; determining that the ACL information is applicable to a subset of the plurality of Layer 2 virtual network interfaces, the subset comprising a Layer 2 virtual network interface; determining that the ACL information is to be sent to a network virtualization device (NVD) of the physical network, wherein: the NVD hosts the Layer 2 virtual network interface and a Layer 2 virtual switch of the plurality of Layer 2 virtual switches, the Layer 2 virtual network interface and the Layer 2 virtual switch are associated with a Layer 2 compute instance of the plurality of Layer 2 compute instances, and the Layer 2 compute instance is hosted on a host machine of the physical network, the host machine and the NVD being communicatively coupled; and sending the ACL information to the NVD. ### Claim 2 (depends on 1) The method of claim 1, wherein the ACL information, the NVD, the Layer 2 virtual network interface, and the Layer 2 virtual switch are first ACL information, a first NVD, a first Layer 2 virtual network interface, and a first Layer 2 virtual switch, respectively, and wherein the method further comprises: generating, based on the input of the customer, second ACL information applicable to a second Layer 2 virtual network interface; determining that the second ACL information is to be sent to a second NVD of the physical network, wherein the second NVD hosts the second Layer 2 virtual network interface and a second Layer 2 virtual switch of a plurality of Layer 2 virtual switches; and sending the second ACL information to the second NVD. ### Claim 3 (depends on 1) The method of claim 1, wherein a flow of a frame from and/or to the Layer 2 compute instance via the Layer 2 virtual network interface is controlled by the NVD according to the ACL information based on a stored associated between the ACL information and the Layer 2 virtual network interface. ### Claim 4 (depends on 1) The method of claim 1, further comprising: storing configuration information of the Layer 2 virtual network, wherein the configuration information indicates a customer-specified name of a Layer 2 port; determining that the Layer 2 port is emulated by the Layer 2 virtual network interface; and storing an association between the customer-specified name and the Layer 2 virtual network interface. ### Claim 5 (depends on 4) The method of claim 4, wherein the input of the customer indicates the ACL information and the customer-specified name of the Layer 2 port, and wherein the method further comprises: identifying the Layer 2 virtual network interface based on the association between the customer-specified name and the Layer 2 virtual network interface; and determining that the ACL information is applicable to the Layer 2 virtual network interface based on the Layer 2 virtual network interface being identified. ### Claim 6 (depends on 4) The method of claim 4, wherein the input of the customer indicates the ACL information and the customer-specified name of the Layer 2 port, and wherein the method further comprises: identifying the Layer 2 virtual network interface based on the association between the customer-specified name and the Layer 2 virtual network interface; determining a media access control (MAC) address associated with the Layer 2 virtual network interface; and indicating, to the NVD, that the ACL information is applicable to the MAC address. ### Claim 7 (depends on 6) The method of claim 6, wherein the input of the customer indicates the ACL information and the customer-specified name of the Layer 2 port, and wherein the method further comprises: determining an internet protocol (IP) address associated with the NVD; and associating the ACL information with the MAC address and the IP address. ### Claim 8 (depends on 1) The method of claim 1, wherein the input of the customer indicates that the ACL information is applicable to at least one of: a destination port, a source port, a destination media access control (MAC) address, a source MAC address, a destination internet protocol (IP) address, a source IP address, a communications protocol type, traffic broadcast, or traffic unicast. ### Claim 9 A network virtualization device comprising: one or more processors; and one or more computer-readable storage media storing instructions that, upon execution by the one or more processors, configure the network virtualization device to: host a Layer 2 virtual network interface and a Layer 2 virtual switch that belong to a Layer 2 virtual network of a customer, wherein: the Layer 2 virtual network interface and the Layer 2 virtual switch are associated with a Layer 2 compute instance that belongs to the Layer 2 virtual network, the Layer 2 compute instance is hosted on a host machine of a physical network that comprises the network virtualization device, the host machine and the network virtualization device being communicatively coupled, and the Layer 2 virtual network is hosted on the physical network and comprises a plurality of Layer 2 compute instances, a plurality of Layer 2 virtual network interfaces, and a plurality of Layer 2 virtual switches; store access control list (ACL) information associated with the Layer 2 virtual network interface; receive a frame having header information; determine that the frame is associated with the Layer 2 virtual network interface based on the header information; and control a flow of the frame based on the ACL information. ### Claim 10 (depends on 9) The network virtualization device of claim 9, wherein the ACL information controls ingress traffic to the Layer 2 compute instance, wherein the header information comprises a destination media access (MAC) address associated with the Layer 2 virtual network interface, and wherein the flow of the frame to the Layer 2 compute instance via the Layer 2 virtual network interface is controlled based on a stored association between the destination MAC address and the ACL information. ### Claim 11 (depends on 9) The network virtualization device of claim 9, wherein the ACL information controls ingress traffic to the Layer 2 compute instance, wherein the header information comprises a source media access (MAC) address associated with another Layer 2 virtual network interface of the plurality of Layer 2 virtual network interfaces, and wherein the flow of the frame to the Layer 2 compute instance via the Layer 2 virtual network interface is controlled based on a stored association between the source MAC address and the ACL information. ### Claim 12 (depends on 9) The network virtualization device of claim 9, wherein the ACL information controls egress traffic from the Layer 2 compute instance, wherein the header information comprises a source media access (MAC) address associated with the Layer 2 virtual network interface, and wherein the flow of the frame from the Layer 2 compute instance via the Layer 2 virtual network interface is controlled based on a stored association between the source MAC address and the ACL information. ### Claim 13 (depends on 9) The network virtualization device of claim 9, wherein the ACL information controls egress traffic from the Layer 2 compute instance, wherein the header information comprises a destination media access (MAC) address associated with another Layer 2 virtual network interface of the plurality of Layer 2 virtual network interfaces, and wherein the flow of the frame from the Layer 2 compute instance via the Layer 2 virtual network interface is controlled based on a stored association between the destination MAC address and the ACL information. ### Claim 14 (depends on 9) The network virtualization device of claim 9, wherein input of the customer indicates that the ACL information is applicable to at least one of: a destination port, a source port, a destination media access control (MAC) address, a source MAC address, a destination internet protocol (IP) address, a source IP address, a communications protocol type, traffic broadcast, or traffic unicast. ### Claim 15 (depends on 9) The network virtualization device of claim 9, wherein the Layer 2 compute instance, the Layer 2 virtual network interface, the Layer 2 virtual switch, and the ACL information are a first Layer 2 compute instance, a first Layer 2 virtual network interface, a first Layer 2 virtual switch, and first ACL information, respectively, and wherein the one or more computer-readable storage media store additional instructions that, upon execution by the one or more processors, configure the network virtualization device to: host a second Layer 2 virtual network interface and a second Layer 2 virtual switch that belong to the Layer 2 virtual network, wherein the second Layer 2 virtual network interface and the second Layer 2 virtual switch are associated with a second Layer 2 compute instance that belongs to the Layer 2 virtual network; and store second ACL information associated with the second Layer 2 virtual network interface. ### Claim 16 (depends on 15) The network virtualization device of claim 15, wherein the frame and the header information are a first frame and first header information, respectively, and wherein the one or more computer-readable storage media store further instructions that, upon execution by the one or more processors, configure the network virtualization device to: receive a second frame having second header information; determine that the second frame is associated with the second Layer 2 virtual network interface based on the second header information; and control a flow of the second frame based on A. ### Claim 17 (depends on 16) The network virtualization device of claim 16, wherein the first ACL information controls ingress traffic to the first Layer 2 compute instance, wherein the second ACL information controls egress traffic from the second Layer compute instance, wherein the flow of the first frame to the first Layer 2 compute instance via the first Layer 2 virtual network interface is controlled based on a first stored association between the first header information and the first ACL information, and wherein the flow of the second frame from the Layer 2 compute instance via the second Layer 2 virtual network interface is controlled based on a second stored association between the second header information and the second ACL information. ### Claim 18 A system comprising: one or more processors; and one or more computer-readable storage media storing instructions that, upon execution by the one or more processors, configure the system to: generate, based on input of a customer, access control list (ACL) information for traffic flow in a Layer 2 virtual network of the customer, wherein the Layer 2 virtual network is hosted on a physical network and comprises a plurality of Layer 2 compute instances, a plurality of Layer 2 virtual network interfaces, and a plurality of Layer 2 virtual switches; determine that the ACL information is applicable to a subset of the plurality of Layer 2 virtual network interfaces, the subset comprising a Layer 2 virtual network interface; determine that the ACL information is to be sent to a network virtualization device (NVD) of the physical network, wherein: the NVD hosts the Layer 2 virtual network interface and a Layer 2 virtual switch of the plurality of Layer 2 virtual switches, the Layer 2 virtual network interface and the Layer 2 virtual switch are associated with a Layer 2 compute instance of the plurality of Layer 2 compute instances, and the Layer 2 compute instance is hosted on a host machine of the physical network, the host machine and the NVD being communicatively coupled; and send the ACL information to the NVD. ### Claim 19 (depends on 18) The system of claim 18, wherein the one or more computer-readable storage media store additional instructions that, upon execution by the one or more processors, configure the system to: store the ACL information in association with the information with the Layer 2 virtual network interface; receive a frame having header information; determine that the frame is associated with the Layer 2 virtual network interface based on the header information; and control a flow of the frame based on the ACL information. ### Claim 20 (depends on 18) The system of claim 18, wherein a flow of a frame from and/or to the Layer 2 compute instance via the Layer 2 virtual network interface is controlled by the NVD according to the ACL information based on a stored associated between the ACL information and the Layer 2 virtual network interface.