Providing services to virtual overlay network traffic

A system, comprising:

• an overlay network connecting a first physical switch to a second physical switch;
• a switch controller in communication with the first physical switch and the second physical switch, the switch controller being configured to program packet routing between overlay network nodes, including the first physical switch and the second physical switch, by programming one or more communication paths in each of the overlay network nodes of the overlay network, the one or more communication paths being based on traffic flow;
• a security appliance configured to apply a security policy to packets sent thereto via the overlay network;
• at least a first server connected to the first physical switch, the first server hosting at least a source virtual machine (VM);
• at least a second server connected to the second physical switch, the second server hosting at least a destination VM;
• and
• a virtual network controller in communication with at least the first physical switch, the second physical switch, and the overlay network,
• wherein the virtual network controller comprises:
• logic configured to receive a request for a communication path through the overlay network, the request being sent from the first physical switch and comprising at least:
• a packet;
• first information about the source VM which originated the packet;
• and
• second information about a destination of the packet, wherein the second information comprises at least an address of the second physical switch;
• logic configured to determine the destination of the packet which is connected to the second physical switch;
• logic configured to inform the second server about the source VM being present on the first server in response to receiving the request for the communication path through the overlay network;
• logic configured to determine whether a security policy is to be applied to the packet based on at least one of:
• contents of the packet, the first information, and the second information;
• logic configured to select a communication path between the first physical switch and the second physical switch, wherein the selected communication path directly connects the first physical switch to the second physical switch when it is determined to not apply the security policy to the packet, and wherein the selected communication path connects the first physical switch to the second physical switch via the security appliance when it is determined to apply the security policy to the packet;
• logic configured to send the selected communication path to the first physical switch;
• and
• logic configured to instruct the switch controller to program packet routing between the overlay network nodes, including the first physical switch and the second physical switch, such that any packets transferred between the source VM and the destination of the packet proceed along the selected communication path.

A computer program product for applying security policy in an overlay network, the computer program product comprising a non-transitory computer readable storage medium having computer readable program code embodied therewith, the embodied computer readable program code comprising:

• computer readable program code configured for receiving, using a virtual network controller, a request for a communication path through an overlay network, the request being sent from a first physical switch in the overlay network, wherein the request comprises at least:
• a packet;
• first information;
• and second information, wherein the first physical switch is connected to at least a first server hosting at least a source virtual machine (VM) that originated the packet and is a source of the packet;
• computer readable program code configured for determining, using the virtual network controller, a second physical switch which is connected to a destination of the packet, wherein the second physical switch is connected to at least a second server hosting at least a destination VM which is the destination of the packet, and wherein the second information comprises at least an address of the second physical switch;
• computer readable program code configured for determining whether a security policy is to be applied to the packet based on all of:
• contents of the packet, the first information, and the second information;
• computer readable program code configured for selecting, using the virtual network controller, a communication path between the first physical switch and the second physical switch, wherein the selected communication path directly connects the first physical switch to the second physical switch when it is determined to not apply the security policy to the packet, and wherein the selected communication path connects the first physical switch to the second physical switch via a security appliance when it is determined to apply the security policy to the packet;
• computer readable program code configured to inform the second server about the source VM being present on the first server in response to receiving the request for the communication path through the overlay network;
• and
• computer readable program code configured for sending, using the virtual network controller, the selected communication path to the first physical switch to cause the first physical switch to send traffic, that matches a particular traffic flow, along the selected communication path.

A virtual network controller, comprising:

• a hardware processor configured to execute logic, the logic being configured to:
• receive a request for a communication path through an overlay network connecting a first physical switch and a second physical switch, the request being sent from the first physical switch and comprising at least:
• a packet;
• first information about a source of the packet, wherein the first physical switch is connected to at least a first server hosting at least a source virtual machine (VM) that originated the packet and is the source of the packet;
• and
• second information about a most closely connected physical switch to a destination of the packet;
• determine that the destination of the packet is connected to the second physical switch;
• determine whether a security policy is to be applied to the packet based on all of:
• contents of the packet, the first information, and the second information;
• select a communication path between the first physical switch and the second physical switch based on traffic flow, wherein the selected communication path directly connects the first physical switch to the second physical switch when it is determined to not apply the security policy to the packet, and wherein the selected communication path connects the first physical switch to the second physical switch via a security appliance when it is determined to apply the security policy to the packet;
• send at least a portion of the selected communication path to the first physical switch to cause the first physical switch to send the packet along the selected communication path via an overlay tunnel originated by the first physical switch;
• instruct a switch controller to program packet routing between overlay network nodes in the overlay network, including the first physical switch and the second physical switch, such that each overlay network node forwards any packet originating from the source of the packet and destined for the destination of the packet along the selected communication path;
• and
• instruct the switch controller to inform a second server about the source VM being present on the first server in response to receiving the request for the communication path through the overlay network, the second server hosting the destination of the packet.