# US 2017/0255482 A9 · Using virtual local area networks in a virtual computer system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0255482 A9
- Document ID: US20170255482A9
- Status: Published application
- Kind: A9
- Application number: 14/231,661
- Filed: 2014-03-31
- Published: 2017-09-07
- Earliest claimed: 2004-11-17
- Assignees: VMware, Inc.
- Applicants: VMware, Inc.
- Inventors: Hao XU
- Web page: https://patentgrep.com/patent/US20170255482A9

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A virtual computer system includes virtualization software, and one or more physical network interfaces for connecting to one or more computer networks. The visualization software supports one or more virtual machines (VMs), and exports one or more virtual network interfaces to the VM(s) to enable the VM(s) to access the computer network(s) through the physical network interface(s). The virtualization software modifies and filters network data frames from the VM(s) and from the physical network interfaces) to restrict one or more VMs to one or more virtual local area networks (VLANs) that are implemented within a VLAN topology. Restricting a VM to a VLAN Omits the broadcast domain to which the VM belongs, which may reduce security risks facing the VM. implementing the VLAN functionality within the virtualization software provides the functionality to every VM in the computer system, without requiring every VM to provide the functionality.

## Claims

### Claim at position 1

1-22. (canceled)

### Claim 23

A method for isolating virtual machines (VMs) to particular virtual local area networks (VLANs) in a virtual infrastructure, the method comprising:
receiving, by a VLAN coordinator, a network frame sent from a VM;
determining, by the VLAN coordinator, that the network frame sent from the VM currently includes a first VLAN identifier, wherein the first VLAN identifier restricts a transmission of the network frame sent from the VM to a particular VLAN;
replacing, by the VLAN coordinator, the first VLAN identifier in the network frame with a second VLAN identifier, wherein the second VLAN identifier restricts a transmission of the network frame sent from the VM to the particular VLAN; and
transmitting the network frame with the second VLAN identifier over a physical network.

### Claim 24 (depends on 23)

The method of claim 23, further comprising:
removing, by the VLAN coordinator, the second VLAN identifier in an incoming network frame addressed to the VM; and
adding the first VLAN identifier to the incoming network frame prior to sending the incoming network frame to the VM.

### Claim 25 (depends on 24)

The method of claim 24, wherein the physical network comprises a single physical network over which outgoing network frames are transmitted and from which incoming network frames are received.

### Claim 26 (depends on 23)

The method of claim 23, wherein the VM coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system.

### Claim 27 (depends on 23)

The method of claim 23, wherein replacing the first VLAN identifier in the network frame with a second VLAN identifier is transparent to the VM.

### Claim 28 (depends on 23)

The method of claim 23, wherein the network frame is received by the VLAN coordinator from a virtual network interface card (VNIC) driver loaded into the VM.

### Claim 29 (depends on 28)

The method of claim 28, wherein the network frame with the second VLAN identifier is transmitted over a physical network by a physical network interface card (NIC).

### Claim 30 (depends on 23)

The method of claim 23, wherein the first VLAN identifier was selected by a user to restrict a transmission of the network frame sent from the VM to a particular VLAN.

### Claim 31

A non-transitory computer-readable storage medium including instructions, that when executed by a processor, cause a virtual local area network (VLAN) coordinator to perform the steps of:
receiving a network frame sent from a virtual machine (VM);
determining that the network frame sent from the VM currently includes a first VLAN identifier, wherein the first VLAN identifier restricts a transmission of the network frame sent from the VM to a particular VLAN;
replacing the first VLAN identifier in the network frame with a second VLAN identifier, wherein the second VLAN identifier restricts a transmission of the network frame sent from the VM to the particular VLAN; and
transmitting the network frame with the second VLAN identifier over a physical network.

### Claim 32 (depends on 31)

The non-transitory computer-readable storage medium of claim 31, wherein the process further causes the VLAN coordinator further performs the steps of:
removing the second VLAN identifier in an incoming network frame addressed to the VM; and
adding the first VLAN identifier to the incoming network frame prior to sending the incoming network frame to the VM.

### Claim 33 (depends on 32)

The non-transitory computer-readable storage medium of claim 32, wherein the physical network comprises a single physical network over which outgoing network frames are transmitted and from which incoming network frames are received.

### Claim 34 (depends on 31)

The non-transitory computer-readable storage medium of claim 31, wherein the VM coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system.

### Claim 35 (depends on 31)

The non-transitory computer-readable storage medium of claim 31, wherein replacing the first VLAN identifier in the network frame with a second VLAN identifier is transparent to the VM.

### Claim 36 (depends on 31)

The non-transitory computer-readable storage medium of claim 31, wherein the network frame is received from a virtual network interface card (VNIC) driver loaded into the VM.

### Claim 37 (depends on 36)

The non-transitory computer-readable storage medium of claim 36, wherein the network frame with the second VLAN identifier is transmitted over a physical network by a physical network interface card (NIC).

### Claim 38

A system comprising:
a virtual local area network (VLAN)
a virtual machine (VM);
a VLAN coordinator communicatively coupled to the VM, the VLAN coordinator configured to:
receive a network frame sent from the VM;
determine that the network frame sent from the VM currently includes a first VLAN identifier, wherein the first VLAN identifier restricts a transmission of the network frame sent from the VM to a particular VLAN;
replace the first VLAN identifier in the network frame with a second VLAN identifier, wherein the second VLAN identifier restricts a transmission of the network frame sent from the VM to the particular VLAN; and
transmit the network frame with the second VLAN identifier over a physical network.

### Claim 39 (depends on 38)

The system of claim 38, wherein the VLAN coordinator is further configured to:
remove the second VLAN identifier in an incoming network frame addressed to the VM; and
add the first VLAN identifier to the incoming network frame prior to sending the incoming network frame to the VM.

### Claim 40 (depends on 38)

The system of claim 38, wherein the VM coordinator is a component of virtualization software running outside the VM and supporting operation of the VM on a host system.

### Claim 41 (depends on 38)

The system of claim 38, wherein replacing the first VLAN identifier in the network frame with a second VLAN identifier is transparent to the VM.

### Claim 42 (depends on 31)

The system of claim 31, wherein the first VLAN identifier was selected by a user to restrict a transmission of the network frame sent from the VM to a particular VLAN.