System resource management in self-healing networks

Abstract

The present disclosure provides system resource management in self-healing networks. A method for system resource management includes grouping a first plurality of endpoint groups (EPGs) into a first plurality of policy groups based on a shared security policy, wherein the first plurality of EPGs are connected to a plurality of switches in a network; identifying a first policy group of the first plurality of policy groups having a highest resource requirement; assigning a first security policy corresponding to the first policy group to a first switch of the plurality of switches; identifying a second plurality of EPGs from remaining EPGs of the first plurality of EPGs that are not included in the first policy group; grouping the second plurality of EPGs into a second plurality of policy groups based on the shared security policy; identifying a second policy group of the second plurality of policy groups having the highest resource requirement; and assigning a second security policy corresponding to the second policy group to a second switch of the plurality of switches.

Description

[0001] This application is a divisional application of Chinese Invention Patent Application No. 202080053957.6, filed on July 28, 2020, with the title of “System Resource Management in Self-Healing Networks”. TECHNICAL FIELD

[0002] Embodiments presented in the present disclosure generally relate to network structures that serve several groups of endpoints with various different security policies. More specifically, embodiments disclosed herein relate to offloading the application of security policies to balance computing resources within a network structure. BACKGROUND

[0003] In a software defined network (SDN), a network can develop heterogeneously to include various different devices with different computing capabilities and resource levels as switches are added to the network or removed from the network over time. Different performance characteristics of switches in the network can result in uneven distribution of computing resources and inefficient handling of networking communications, especially when host devices connected to the switches are not reconnected to account for the new switch layout. However, despite the different performance characteristics of the heterogeneous hardware available in the network, users of the SDN still desire that security policies and networking functions be applied uniformly across the network. SUMMARY

[0004] According to an aspect of the present application, a method for system resource management is provided, comprising: grouping a first plurality of endpoint groups (EPGs) into a first plurality of policy groups based on a shared security policy, wherein the first plurality of EPGs are connected to a plurality of switches in a network; identifying a first policy group of the first plurality of policy groups that has a highest resource requirement; assigning a first security policy corresponding to the first policy group to a first switch of the plurality of switches; identifying a second plurality of EPGs from remaining EPGs of the first plurality of EPGs that are not included in the first policy group; grouping the second plurality of EPGs into a second plurality of policy groups based on the shared security policy; identifying a second policy group of the second plurality of policy groups that has a highest resource requirement; and assigning a second security policy corresponding to the second policy group to a second switch of the plurality of switches.

[0005] According to another aspect of the present application, there is provided an apparatus for system resource management, comprising: means for grouping a first plurality of endpoint groups (EPGs) into a first plurality of policy groups based on a shared security policy, wherein the first plurality of EPGs are connected to a plurality of switches in a network; means for identifying a first policy group of the first plurality of policy groups having a highest resource requirement; means for assigning a first security policy corresponding to the first policy group to a first switch of the plurality of switches; means for identifying a second plurality of EPGs from remaining EPGs of the first plurality of EPGs that are not included in the first policy group; means for grouping the second plurality of EPGs into a second plurality of policy groups based on the shared security policy; means for identifying a second policy group of the second plurality of policy groups having a highest resource requirement; and means for assigning a second security policy corresponding to the second policy group to a second switch of the plurality of switches.

[0006] According to yet another aspect of the present application, there is provided a computer readable medium comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0007] In order that the above described features of the present disclosure can be understood in detail, a more particular description of the disclosure, briefly summarized above, can be had by reference to embodiments, some of which are illustrated in the appended drawings. It is to be noted, however, that the appended drawings illustrate only typical embodiments and are therefore not to be considered limiting of its scope, as other equally effective embodiments can be utilized.

[0008] Figure 1 A network structure according to embodiments of the present disclosure is shown.

[0009] Figure 2 A policy grouping that can be used in policy flattening according to embodiments of the present disclosure is shown.

[0010] Figure 3 An offload operation according to embodiments of the present disclosure is shown.

[0011] Figure 4 is a flowchart for optimizing a network structure according to embodiments of the present disclosure.

[0012] Figure 5A is a flowchart for processing an outbound communication from an endpoint group in an optimized network structure according to embodiments of the present disclosure.

[0013] Figure 5B is a flowchart for processing an inbound message to an endpoint group in an optimized network structure according to embodiments of the present disclosure.

[0014] Figure 6 Hardware of a network switch according to embodiments of the present disclosure is shown.

[0015] For ease of understanding, the same designations have been used, where possible, to designate identical elements that are common to the various figures. It is contemplated that elements disclosed in one embodiment can be beneficially utilized on other embodiments without specific recitation. DETAILED DESCRIPTION

[0016] SUMMARY

[0017] Aspects of the application are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect can be applied to each aspect, alone or in combination with features of other aspects.

[0018] One embodiment presented in the disclosure provides a method for system resource management in a self-healing network, comprising: establishing a network tunnel between a first switch and a second switch in a network fabric, wherein the second switch enforces a security policy for a policy group comprising a first endpoint group (EPG), the first EPG being physically connected to the first switch; in response to receiving at the first switch a communication from the first EPG intended for a destination, the communication comprising a source IP address of the first switch and a virtual private network (VPN) routing and forwarding identifier (VRFID) of the first EPG: modifying the source IP address using a port offset associated with a port of the first switch to which the first EPG is connected, modifying the VRFID using a group offset associated with an identity of the policy group, and transmitting the communication from the first switch to the second switch via the network tunnel; and in response to receiving at the second switch the communication from the first switch over the network tunnel: identifying the security policy for the policy group based on the group offset, and in response to determining that the security policy allows the communication, transmitting the communication to the destination.

[0019] One embodiment presented in the disclosure provides a non-transitory computer-readable storage device comprising instructions that, when executed by a processor, enable the processor to perform operations for system resource management in a self-healing network, the operations comprising: establishing a network tunnel between a first switch and a second switch in a network fabric, wherein security policies for a policy group comprising a first endpoint group (EPG) physically connected to the first switch are offloaded to the second switch for enforcement; setting a port offset based on a port of the first switch connected to the first EPG; setting a group offset based on an identity of the policy group; in response to receiving at the first switch a communication from the first EPG intended for a destination, the communication comprising a source IP address of the first switch and a virtual private network (VPN) routing and forwarding identifier (VRFID) to which the first EPG belongs: modifying the source IP address using the port offset; modifying the VRFID using the group offset; and transmitting the communication from the first switch to the second switch via the network tunnel; and in response to receiving at the second switch the communication from the first switch over the network tunnel: identifying the security policies for the policy group based on the group offset; and in response to determining that the security policies allow the communication, transmitting the communication to the destination.

[0020] One embodiment presented in the disclosure provides a method for system resource management in a self-healing network, the method comprising: grouping a first plurality of endpoint groups (EPGs) into a first plurality of policy groups based on a shared security policy, wherein the first plurality of EPGs are connected to a plurality of switches in a network; identifying a first policy group of the first plurality of policy groups having a highest resource requirement; assigning a first security policy corresponding to the first policy group to a first switch of the plurality of switches; identifying a second plurality of EPGs from remaining EPGs in the first plurality of EPGs that are not included in the first policy group; grouping the second plurality of EPGs into a second plurality of policy groups based on the shared security policy; identifying a second policy group of the second plurality of policy groups having a highest resource requirement; assigning a second security policy corresponding to the second policy group to a second switch of the plurality of switches.

[0021] Example embodiments

[0022] To ensure that users are provided with a homogeneous networking experience as hardware evolves to heterogeneous deployments in SDNs (Software Defined Networks), the disclosure provides guidance on placement of system resources in a network with new or rebalanced network configurations without requiring manual user configuration of the network.

[0023] A network controller offloads the implementation or enforcement of various communication policies from network devices connected to various hosts to another network device with more available computing resources. The network controller determines the most efficient pairing of groups of hosts and network devices with similar security policies or operating characteristics in an iterative process based on a z-score weighted composite metric of free resources on a given network device and the demand for those resources by a group of hosts.

[0024] Figure 1 A network fabric 100 according to embodiments of the disclosure is shown. The illustrated network fabric 100 is an SDN that includes a first site 110a, a second site 110b, and a third site 110c (generally referred to as sites 110), where each of the sites 110 is located in a different geographic location from each other (i.e., located at a remote location). Although three sites 110a-c are discussed in the example here, the network fabric 100 can include more or less than three sites 110 in other examples. Each of the sites 110 is connected to the other sites 110 in the network fabric 100 via a network 160 (e.g., the Internet or another public network) to operate as a single network regardless of the distance between the remotely located elements.

[0025] In Figure 1 each site 110 includes various spine switches 120 and leaf switches 130, which can be divided into various clusters based on communication paths, tenants of the site 110, etc. The spine switches 120 and leaf switches 130 are specialized computer networking devices used to route data within the network. Example hardware that can be used in the spine switches 120 or leaf switches 130 will be discussed in connection with Figure 6 .

[0026] In the illustrated Clos architecture, the leaf switches 130 route communication flows through the spine switches 120, and the spine switches 120 route communication flows through the leaf switches 130. In other words, within a site 110, the spine switches 120 do not communicate directly with other spine switches 120 and the leaf switches 130 do not communicate directly with other leaf switches 130, but rather route communications through each other. In the illustrated network fabric 100, the spine switches 120 in the remote sites 110 communicate together to link the sites 110 through the common network 160 within the network fabric 100. Although Figure 1 each spine switch 120 in a given site 110 is shown as connected to each leaf switch 130, other arrangements are contemplated.

[0027] Various host devices 140 are connected to the leaf switches 130 and host workloads for various tenants. The host devices 140 can provide services or clients for various tenants of the network fabric 100, and although Figure 1One host device 140 is shown for each leaf switch 130, but it should be understood that the network fabric 100 can include multiple host devices 140, with each individual host device 140 connected to one port of a single leaf switch 130. Each leaf switch 130 can include multiple ports and can be connected to one or more host devices 140 through those ports, which can be assigned to one or more different tenants.

[0028] Communications in the network fabric 100 that are routed from one leaf switch 130 to another leaf switch 130 (via one or more spine switches 120 at or across multiple sites 110) are encapsulated into tunnels that identify an address of the source leaf switch 130 and an address of the destination leaf switch 130 for routing the communication. The communication also includes a class identifier (ID) (or endpoint group ID) of the source workload or host device 140 and a network ID (or subnet ID) of the source workload or host device 140. Because several different tenants can share computing resources provided in a given site 110 and a tenant can wish to manage communications between workloads associated with a particular tenant, the communications can be encrypted and / or the tenant can specify various security policies for how the communications are to be handled. For example, a security policy can: allow a first workload to communicate with a second workload, can block communications from the first workload from being received by the second workload, can limit the first workload to only receive communications from known sources (e.g., a whitelist), can block the first workload from receiving communications from known sources (e.g., a blacklist), etc. When a security policy blocks or otherwise prevents a communication from being received by a given workload, the communication can be discarded, ignored, quarantined (e.g., held or forwarded to a different device for analysis), or forwarded to a different device or workload than originally specified as the destination.

[0029] When enforcing security policies at the leaf switch 130, the decision to allow an incoming packet to reach an intended workload results in the leaf switch 130 delivering the packet to the indicated host device 140, blocking the packet from being received by the indicated host device 140, or forwarding the packet to a different host device 140 or node (e.g., an isolation device). In a multi-tenant SDN, where multiple parties share some or all of the hardware of the network fabric 100, such as in a data center, the network fabric 100 can be divided into several virtual private network routing and forwarding (VRF) groups (also referred to as VRFs) for managing workloads and security policies of individual tenants. Workloads and / or host devices 140 used by different tenants are grouped into one or more endpoint groups (EPGs), which collect workloads and / or host devices 140 with the same networking and policy requirements. In some embodiments, an EPG represents all workloads connected to a single port of a particular leaf switch 130. In other embodiments, subnets, VLAN (virtual local area network) identifiers, IP (Internet Protocol) addresses, MAC (media access control) addresses, virtual machine hostnames, and the like, as well as combinations thereof, can be used to group one or more endpoints into an EPG.

[0030] Figure 2 A policy grouping 200 that can be used in policy flattening is shown in accordance with embodiments of the disclosure. As shown, a first group of EPGs 210 (specifically, EPGs 210a-210d) have been established by security policies to allow a communication channel 220 to a second group of EPGs 210 (specifically, EPGs 210e-h). The one-way security policies allow each EPG 210 in the first group to send communications to each EPG 210 included in the second group over the communication channel 220. As used herein, the first group of EPGs 210 defines a policy group (PG) 230 with the same security policies as each other that allow the communication channel 220 to a destination group (DG) 240 that includes the second group of EPGs 210. The EPGs 210 in the PG 230 can belong to one complete VRF, a subset of one VRF, or can belong to multiple VRFs, but have the same security policies. The EPGs 210 in the DG 240 can belong to one complete VRF, a subset of one VRF, or can belong to multiple VRFs, and can have the same or different security policies from each other.

[0031] Although the communication channels 220 are depicted as unidirectional (i.e., allowing communication from the first set of EPGs 210 to the second set of EPGs 210), in some embodiments, the second set of EPGs 210 includes a set of reciprocal security policies for allowing communication to the first set of EPGs 210. In such embodiments, the illustrated destination group 240 can be considered the second policy group 230 and the illustrated policy group 230 can be considered the second destination group 240.

[0032] Each communication channel 220 is associated with a security policy that allows communication from an EPG 210 in the PG 230 to an EPG 210 in the DG 240. For example, the first EPG 210a is allowed to communicate with the fifth through eighth EPGs 210e-h via four communication channels 220, each associated with a security policy maintained by the leaf switch 130 hosting the first EPG 210a. For a PG 230 of X EPGs 210 to be allowed to communicate with a DG 240 of Y EPGs 210, X*Y security policies are maintained to allow X*Y communication channels 220 to be established. For example, as shown, the PG 230 of four EPGs 210a-d and the DG 240 of four EPGs 210e-h have sixteen communication channels 220 (i.e., 4*4 = 16), each associated with a security policy maintained on the leaf switch 130. Figure 2

[0033] By establishing the first set of EPGs 210a-d as belonging to the PG 230 and the second set of EPGs 210e-h as belonging to the DG 240, the security policies can be flattened into a PG policy 250 to describe the communication channels 220 allowed by the individual policies. For example, instead of maintaining X*Y security policies that describe all X*Y allowed communication channels 220 between the associated EPGs 210, the PG policy 250 defines one policy that allows communication from the PG 230 to be sent to the DG 240 without reference to the individual EPGs 210 therein.

[0034] By flattening the security policies into the PG policy 250, the number of security policies that need to be maintained in the memory of the leaf switch 130 is reduced, saving computational resources. However, if the individual EPGs 210 are distributed across multiple leaf switches 130 that manage the security policies, the collection of leaf switches 130 that manage the security policies will maintain multiple copies of the PG policy 250; diminishing the benefits of policy flattening. For example, if EPG 210a is managed by a first leaf switch 130a and EPGs 210b-d are managed by a second leaf switch 130b, two copies of the PG policy 250 are created and maintained; one at the first leaf switch 130a and one at the second leaf switch 130b.​

[0035] Furthermore, while a given EPG 210 can conceptually belong to several different candidate PGs 230, in practice, an administrator or controller assigns the EPG 210 to a selected one of the candidate PGs 230 when flattening security policies, and a poor assignment can reduce the benefits of policy flattening (e.g., result in more PGs 230 distributed across more leaf switches 130, inefficient allocation of leaf switch computing resources). For example, a first EPG 210a can potentially belong to n PGs 230, but has been assigned to the illustrated PG 230 with second through fourth EPGs 210b-d, which can be the most efficient assignment of the first EPG 210a to one of the n candidate PGs 230.

[0036] Accordingly, optimizing the assignment of EPGs 210 to PGs 230 and the assignment of PGs 230 to leaf switches 130 can improve / maximize the overall benefit of policy flattening to the network fabric 100. While the assignment of EPGs 210 can include changing which host device 140 in the network fabric 100 hosts a workload in an EPG 210 or which leaf switch 130 a given host device 140 is connected to, in a self-healing embodiment, as described in this disclosure, the assignment of EPGs 210 includes offloading an EPG 210 from one leaf switch 130 to another leaf switch 130.

[0037] Figure 3 An offload operation 300 according to embodiments of the present disclosure is illustrated. In Figure 3 Three leaf switches 130a-c are illustrated, with first through fourth EPGs 210a-d shown as physically connected to the third leaf switch 130c (e.g., by a host device 140 providing the workload of the EPG 210). As shown, the first and second EPGs 210a and 210b belong to a first PG 230a, which has an associated first PG policy 250a that is offloaded to the first leaf switch 130a. Similarly, the third and fourth EPGs 210c-d belong to a second PG 230b, which has an associated second PG policy 250b that is offloaded to the second leaf switch 130b.

[0038] A first tunnel 320a (generally referred to as a tunnel 320) links the first leaf switch 130a with the third leaf switch 130c, and a second tunnel 320b links the second leaf switch 130b with the third leaf switch 130c. In embodiments such as the illustrated embodiment, the tunnels 320 are configured to carry the first and second PG policies 250a and 250b from the first and second leaf switches 130a and 130b to the third leaf switch 130c. Figure 1In the Clos architecture of the network structure 100 shown, tunnel 320 can be relayed between leaf switches 130 via one or more backbone switches 120 (not shown) and / or public network 160 (not shown), depending on the physical location of the leaf switches 130. To ensure the correct routing of communication (where EPG 210 belongs to PG 230 with PG policy 250, which is offloaded to another leaf switch 130), a third leaf switch 130c redirects communication received from the connected EPG 210 to the leaf switch 130 that maintains the PG policy 250 of the associated PG 230.

[0039] As a message source or connection switch, the third-leaf switch 130c sends messages to the offloading switch (e.g., Figure 3 The communication in the first leaf switch 130a or the second leaf switch 120b includes additional addressing information so that the communication can be correctly analyzed and directed to / from the requesting host. In several embodiments, the addressing information includes a source IP address S modified with a port offset identifying the port number P on the source switch connected to the sending EPG 210, the destination address D of the switch implementing the processing policy, the network identifier V of the VRF to which the EPG 210 belongs (modified with a group offset G identifying the PG 230 to which the EPG 210 belongs), and a class identifier C assigned to the EPG 210. Therefore, an example tuple of the addressing information can be represented as: [S+P, D, V+G, C]. For example, when a packet originates from EPG 210 connected to leaf switch 130 at port 2 (P=2) with IP address 10.0.0.1 (S=10.0.0.1), leaf switch 130 can add a port offset to the IP address to generate a source IP address 10.0.0.3 for transmission to the destination switch. The connected switch uses this addressing information when encapsulating communication from EPG 210 for transmission through network tunnel 320 to the offloading switch, and the encapsulated communication includes the IP address of EPG 210, the IP address (or other identifier) ​​of the destination of the communication, and the communication payload, error correction / identification information, etc.

[0040] Other embodiments envision addressing information and other arrangements for predefined relationships of how the various elements are combined. For example, the port number P could be subtracted from the second byte of the address instead of being added to the first byte. Thus, while the examples in this disclosure are primarily given with respect to IP version 4 (IPv4) addresses, IP version 6 (IPv6) addresses are also considered.

[0041] When the offloading switch receives outbound communication via network tunnel 320, it decapsulates the communication (e.g., removes tunnel header and tail fields) and identifies the security policy to be applied to the communication. Furthermore, the offloading switch learns from the addressing information in a session-based manner that the source IP address modified by the port offset is associated with the IP address of the EPG 210 indicated in the decapsulated communication. The offloading switch uses the VRFID modified by the group offset in the communication to identify the security policy to be applied to the communication, allowing or blocking the transmission of the communication to the destination indicated in the decapsulated packet. The offloading switch uses the IP address of the EPG 210 when transmitting the decapsulated communication to the destination and uses the known association between the modified source IP address and the EPG IP address when processing inbound messages to the EPG 210 (e.g., responses from the destination or another party).

[0042] When the offloading switch receives an inbound message for a given EPG 210, it identifies the modified source IP address associated with the destination IP address (e.g., the EPG IP address) indicated in the message, encapsulates the message, and forwards it to the connected switch for processing. Once the message is received at the connected switch (e.g., third-leaf switch 130c), the connected switch decapsulates the message (e.g., removes tunnel header and tail fields) and removes the connected switch's source IP address from the modified source IP address indicated by the offloading switch, resulting in a port offset. The connected switch then forwards the message to the EPG 210 connected to the connected switch at the port indicated by the port offset. Therefore, the connected switch can abandon the use of an endpoint table (which lists and associates each endpoint with each port) and instead use a mapping table (which associates PG 230s (including multiple EPG 210s connected to a specific port) with ports), thus reducing the number of entries maintained in memory and freeing up space in the endpoint table.

[0043] Despite Figure 3 The diagram illustrates a given number of leaf switches 130, EPGs 210, and PGs 230 (with associated PG policies 250), but other embodiments may include more or fewer of these elements. For example, various additional EPGs 210 (not shown) may be connected to ports of a first leaf switch 130a or a second leaf switch 130b. In another example, various additional EPGs 210 belonging to a third PG 230c (not shown) may be connected to a third leaf switch 130c that locally processes the security policies of the third PG 230c (i.e., does not offload the third PG policy 250c (not shown) to different leaf switches 130).

[0044] Figure 4This is a flowchart of a method 400 for optimizing a network structure 100 according to an embodiment of this disclosure. Method 400 begins at block 410, where a network controller in the network structure 100 receives a command to optimize the network structure 100. In some embodiments, the network controller receives a manually instructed command from an administrator to optimize the network structure 100. In other embodiments, such as in a self-healing network, the network controller recognizes the addition of a new switch to the network structure 100, the removal of an existing switch from the network structure 100, or the reconfiguration of an existing switch (in adjusting physical connections with other devices or updating software running thereon) as a command to optimize the network structure 100, and begins method 400 accordingly.

[0045] Method 400 is repeated through several iterations of blocks 420 to 450 to allow the network controller to recursively group, analyze, and allocate EPGs 210 in network structure 100 to develop and deploy PGs 230 as efficiently as possible during each iteration of blocks 420 to 450, given the available computational and network resources.

[0046] In block 420, the network controller groups EPG 210 in network structure 100 into multiple PG 230s. In a given iteration of block 420, each of the multiple PG 230s includes one or more EPG 210s that have not yet been assigned to leaf switch 130 in earlier iterations of blocks 420-450. Thus, for the initial or first iteration of block 420, all EPG 210s connected to network structure 100 are grouped into the initial or first multiple PG 230s, but in subsequent iterations, fewer than all EPG 210s are grouped into subsequent multiple PG 230s.

[0047] The network controller can group an EPG 210 into several different PGs 230 based on different grouping rules or policies. In some embodiments, EPGs 210 are grouped into a specific PG 230 based on having the same security policy. For example, a first EPG 210a with security policy A, a second EPG 210b with security policy A, and a third EPG 210c with security policy A can be grouped together into the first PG 230a, but a fourth EPG 210d with security policy B will not be grouped into the first PG 230a due to its different security policy. In some embodiments, a PG 230 includes all EPGs 210 connected to a given port of the leaf switch 130. In other embodiments, EPGs 210 are grouped into a specific PG 230 based on having shared characteristics (but not necessarily a complete set of identical characteristics). For example, the network controller can evaluate whether a group of EPGs 210 belongs to the same VRF, whether EPGs 210 communicate with each other, whether EPGs 210 communicate with the same DG 240, etc.

[0048] At block 430, the network controller identifies the PG 230 among the multiple PGs 230 developed at block 420 that has the highest resource requirement for the available resources of network structure 100 in the current iteration. For each candidate PG 230 created for a given iteration among the multiple PGs 230, the network controller simulates the resource consumption and resource savings for allocating that candidate PG 230 to each available leaf switch 130 in network structure 100. The network controller compares the resources consumed by each candidate PG 230 on each leaf switch 130 (including content-addressable memory space, LAN tablespace, endpoint tablespace, and routing tablespace) and identifies the given PG 230 and given leaf switch 130 that can maximize resource savings in network structure 100.

[0049] In many cases, the PG 230 that results in the greatest resource savings in an earlier iteration of method 400 includes more EPGs 210 than the PG 230 that results in the greatest resource savings in a later iteration. Ultimately, the multiple PGs 230 developed for a given iteration may include PGs 230, each including a single EPG 210. To determine where to allocate a single EPG PG 230, the network controller ranks the remaining leaf switches 130 using a dynamic weighting of the remaining resources based on the demand for the remaining unallocated EPGs 210.

[0050] In one embodiment, the network controller uses a comprehensive ranking of resource usage to determine how to rank leaf switches 130 to select which leaf switch 130 to place a specific PG 230 on. For example, in w jIt is the ranking index weight of the tracked resource j, r j Given the current utilization of resource j, and assuming that resource j is selected from n resources, the network controller can determine the composite metric C for each leaf switch 130 according to the following formula.

[0051]

[0052] The network controller calculates the composite metric C for each leaf switch 130 and identifies the leaf switch 130 with the highest composite metric C value in order to assign a specific PG 230 to that leaf switch 130.

[0053] To calculate the ranking index weight w for each resource on a specific leaf switch 130 j The network controller checks the utilization of each tracked resource on leaf switch 130 relative to the average resource utilization of each tracked resource on leaf switch 130. For example, the network controller can calculate the utilization based on the utilization r according to Formula 2 below. i The z-score of resource i is calculated using the average utilization μ of all resources on leaf switch 130 and the standard deviation σ of the utilization of individual resources relative to the average utilization.

[0054]

[0055] For example, the network controller tracks four resources A, B, C, and D and their corresponding utilization (r). i With utilization rates of 90%, 88%, 82%, and 77% respectively, the average utilization rate (μ) will be 84.25%, and the standard deviation (σ) will be 5.9. Therefore, according to Formula 2, Z... A =0.97, Z B =0.63, Z c = -0.38, and Z D =-1.2.

[0056] Once the z-score is calculated, the network controller can determine the ranking index weight w for a specific resource i. i For example, the network controller can use Formula 3 below, based on the number of tracked resources n and the utilization rate r of individual resources. i w is calculated using the z-score of individual resource i and a normalization factor based on the sum of the individual utilization rate and z-score of individual resource n. i .

[0057]

[0058] In block 440, the network controller assigns PG 230, identified in block 430, to the leaf node identified in block 430. The network controller creates a security policy for the assigned PG 230 or moves it to the assigned leaf switch 130. In various embodiments, when EPG 210s share a security policy, the PG's security policy is flattened on the assigned leaf switch 130. When the leaf switch 130 to which PG 230 is assigned is not the leaf switch 130 to which PG 230 is physically connected to its EPG 210, the network controller creates rules on the connected leaf switch 130 to forward communication from the connected leaf switch to the assigned (offloaded) leaf switch 130.

[0059] In block 450, the network controller determines whether any EPG 210 has not yet been assigned to leaf switch 130. In response to determining that not all EPG 210s have been assigned to leaf switches 130, method 400 can return to block 420 to begin a new iteration grouping the unassigned EPG 210s into multiple new PGs 230 to determine which EPG 210s should be assigned to which leaf switch 130. In response to determining that all EPG 210s have been assigned to leaf switches 130, method 400 can then terminate.

[0060] Figure 5A This is a flowchart of a method 500 for processing outbound communications from EPG 210 in an optimized network structure 100 according to an embodiment of the present disclosure. Figure 5B This is a flowchart of a method 590 for processing inbound messages to EPG 210 in an optimized network structure 100 according to an embodiment of the present disclosure. In the optimized network structure 100, security policies of one or more EPGs 210 are offloaded from leaf switches 130 (i.e., connected switches) to which the EPG 210 is connected to to one or more other leaf switches 130 (i.e., offloading switches) determined to provide network and computing resources more efficiently to process the implementation of these security policies. In some embodiments, the network controller, based on information regarding... Figure 4 Method 400, as discussed, determines which leaf switches 130 will be the offloading switches for the designated PG 230 used for EPG 210. Method 500 may begin in response to the end of method 400.

[0061] Method 500 begins at block 505, wherein the connected switch establishes a network tunnel 320 to an offloading switch (which handles the security policies of the connected switch). In various embodiments, network tunnel 320 is a VPN tunnel established between switches to handle traffic between two leaf switches 130, and may include one or more backbone switches 120 and / or a public network 160.

[0062] In block 510, the connected switch sets port offset and group offset for EPG 210. The port offset is based on the port on the connected switch to which EPG 210 is connected. The port offset, when added to the IP address of the connected switch in an incoming message, allows the connected switch to identify which port routes inbound messages to EPG 210 without using a routing table. The group offset is based on the identifier of the PG 230 to which EPG 210 belongs, and each PG 230 connected to the connected switch has a unique group identifier. The group identifier, when added to VRFID in outbound communication, allows the offloading switch to identify which subset of the VRF EPG 210 belongs to, thereby identifying the PG policy 250 to be applied to the communication.

[0063] In block 515, the connected switch receives outbound communication from EPG 210 destined for a destination (e.g., a different EPG 210 within network structure 100, or a host outside network structure 100). The connected switch encapsulates (e.g., with a VPN header) the outbound communication for transmission through network tunnel 320 to an offloading switch assigned to process the security policy of the PG 230 to which EPG 210 belongs. The connected switch modifies the addressing information in the header or routing field of the encapsulated communication using the offset set in block 510. The connected switch modifies the source IP address of the connected switch indicated in the header by port offset according to predefined rules (e.g., by adding, subtracting, multiplying, or applying another reversible mathematical operation to specified portions or bytes in the IP address and port number). The connected switch modifies the VRFID of EPG 210 indicated in the header by group offset according to predefined rules (e.g., by adding, subtracting, multiplying, etc., to specified bytes in the VRFID address with the identity of the PG to which EPG 210 belongs).

[0064] In block 525, the connected switch forwards the encapsulated communication to the offloading switch via network tunnel 320, and in block 530, the offloading switch receives this encapsulated communication via network tunnel 320.

[0065] In block 535, the offloading switch decapsulates the communication received through network tunnel 320 to obtain the original outbound communication. In various embodiments, the offloading switch learns, in a session-based manner, the association between the IP address of EPG 210 (indicated as the IP address in the original outbound communication) and the IP address of the connected switch (modified by the port offset) from the encapsulated header information and the header information of the original outbound communication. This association between the two IP addresses can be stored in a routing or forwarding table on the offloading switch to correctly guide inbound messages from EPG 210, which will relate to method 590 and... Figure 5BLet's discuss this in more detail. For example, when an offloading switch receives a VPN packet encapsulated with the original communication, the offloading switch associates the VPN packet's routing information and the source IP address in the header (e.g., the modified source IP address of the connected switch) with the decapsulated communication's routing information and the source EPG IP address in the header.

[0066] In block 540, the offloading switch identifies the security policy to be applied to outbound communications based on the group offset. In various embodiments, the PG policy 250 stored on the offloading switch is associated with a VRFID modified by the group offset, and the offloading switch identifies the PG policy 250 based on the modified VRFID.

[0067] In block 545, the offloading switch applies a recognized security policy to determine whether outbound communication is permitted or otherwise allowed to be sent to the destination indicated in the outbound communication. The security policy may specify various destinations to which communication from a PG 230 to which EPG 210 belongs is permitted (e.g., a whitelist), various destinations to which communication from a PG 230 to which EPG 210 belongs is prohibited (e.g., a blacklist), and various restrictions or requirements on how communication is handled (e.g., encryption, size limits, transport protocols). In some embodiments, the security policies are flattened security policies that are applied to all members of PG 230 and to all destinations within a given DG 240, rather than individual EPG-to-EPG security policies.

[0068] When the offloading switch determines that the security policy does not allow communication from EPG 210 to reach the indicated destination, method 500 proceeds to block 505, where the offloading switch blocks outbound communication from being sent to the indicated destination. In some embodiments, outbound communication is dropped from the offloading switch, sent to an isolation device in the network, or transmitted to the network controller seeking permission to overturn or update the security policy to allow communication to be sent. In various embodiments, the offloading switch sends a message to EPG 210 indicating that communication has been blocked from transmission. Method 500 can then terminate.

[0069] When the offloading switch determines that the security policy allows communication from EPG 210 to the indicated destination, method 500 continues to block 555, where the offloading switch forwards the communication to the indicated destination. Method 500 can then terminate.

[0070] Figure 5B This is a flowchart of method 590, which responds to receiving an inbound message (such as, regarding) at the offloading switch. Figure 5A The discussion begins at block 560 with the response message sent for outbound communication at block 555 of method 500.

[0071] At block 565, the offloading switch identifies the network tunnel 320 associated with the connected switch to which the offloading EPG 210 is connected, as indicated in the inbound message received at block 560. In various embodiments, the offloading switch identifies the offloading EPG 210 based on header address information in the message (e.g., the destination IP address field in the message) and identifies the network tunnel 320 based on the association between the EPG IP address and the IP address (modified) of the connected switch. In some embodiments, when processing outbound communication from the EPG 210, the relationship between the EPG IP address and the network tunnel 320 linking the offloading switch to the connected switch is learned session-wise (e.g., as...). Figure 5A (Part of block 535 in the text).

[0072] In block 570, the offloading switch encapsulates the inbound message (e.g., encapsulates it in a VPN packet) and forwards the encapsulated message via network tunnel 320 to the switch connected to the destination EPG 210 indicated in the message. In various embodiments, the encapsulated message includes the IP address of the connected switch, modified by port offset, as the destination IP address of this encapsulated message.

[0073] In block 575, the connected switch receives the encapsulated message via network tunnel 320, and in block 580, the connected switch decapsulates the message (e.g., by removing VPN header fields) and identifies the port offset. Because the connected switch knows its own IP address (i.e., the source IP address in outbound communication) and predefined rules for modifying the IP address of the connected switch in the encapsulated outbound communication (and used in the encapsulated inbound message), the connected switch applies the predefined rules in reverse to identify the port offset of the inbound message. For example, when the predefined rules add a port offset (e.g., P=1 for port 1) to the fourth byte of the source IP address of the outbound communication (e.g., S=10.0.0.1) (e.g., producing S+P=10.0.0.2), the connected switch can generate the port offset value (e.g., S+PS=1 for port 1) by subtracting the fourth byte of its IP address from the received destination IP address of the encapsulated inbound message.

[0074] In block 585, the connected switch forwards the decapsulated message to the destination EPG210 on the identified port. Then method 590 can end.

[0075] Figure 6Hardware of a network switch 600 according to an embodiment of this disclosure is shown, which can be used as one of a backbone switch 120 or a leaf switch 130. The network switch 600 includes a monitor module 610 and a plurality of line cards 620a-n. The monitor module 610 includes a processor 611 and a memory 612. The memory 612 stores software instructions executed by the processor 611. Specifically, the memory 612 may store various security policies 630 (including individual EPG security policies and PG policies 250) for performing one or more methods described in this disclosure, category IDs, instructions for routing data to other devices (e.g., external devices or other network switches 600 in the network structure), and optimized offloading communication algorithms 640.

[0076] Each line card 620 includes a control path processor 621, an application-specific integrated circuit (ASIC) 622, multiple ports / interfaces 623 coupled to the ASIC 622, a ternary content-addressable memory (TCAM) 624, and a static random access memory (SRAM) 625. The control path processor 621 is a CPU / processor that receives configuration commands from the monitor module 610 to program the TCAM 624 and SRAM 625. The ASIC 622 is a hardware device that directs incoming packets at port / interface 623 to a specific additional port / interface on another device (e.g., another network switch 600, host device 140, router, firewall, etc.) based on the contents of the TCAM 624 and SRAM 625. The ASIC 622 may buffer received packets in the TCAM / SRAM to delay transmission to other devices. Multiple TCAM / SRAM pairs may exist in the line card 620.

[0077] In summary, embodiments of this disclosure provide system resource management in a self-healing network by: grouping endpoint groups (EPGs) into multiple policy groups based on a shared security policy; identifying a first policy group with the highest resource requirements; assigning a first security policy corresponding to the first policy group to a first switch among multiple switches; identifying a second plurality of EPGs from the remaining EPGs not included in the first policy group; grouping the second plurality of EPGs into a second plurality of policy groups based on a shared security policy; identifying a second policy group with the highest resource requirements among the second plurality of policy groups; and assigning a second security policy corresponding to the second policy group to a second switch among multiple switches.

[0078] Various embodiments have been referenced in this disclosure. However, the scope of this disclosure is not limited to the embodiments specifically described. Rather, any combination of features and elements described, whether or not associated with different embodiments, is contemplated for implementation and practice of the intended embodiments. Furthermore, when elements of an embodiment are described in the form of "at least one of A and B," it will be understood that embodiments that exclusively include only element A, exclusively include only element B, and include both element A and element B are contemplated. Moreover, while some embodiments disclosed herein may achieve advantages over other possible solutions or prior art, whether a particular advantage is achieved by a given embodiment does not limit the scope of this disclosure. Therefore, aspects, features, embodiments, and advantages disclosed herein are merely illustrative and should not be considered elements or limitations of the appended claims (unless expressly stated in the claims). Similarly, references to "the invention" should not be construed as a generalization of any inventive subject matter disclosed herein and should not be considered elements or limitations of the appended claims (unless expressly stated in the claims).

[0079] As those skilled in the art will understand, the embodiments disclosed herein can be embodied as systems, methods, or computer program products. Therefore, embodiments can take the form of entirely hardware embodiments, entirely software embodiments (including firmware, resident software, microcode, etc.), or embodiments combining software and hardware aspects (which may be collectively referred to herein as “circuit,” “module,” or “system”). Furthermore, embodiments can take the form of computer program products contained in one or more computer-readable media having computer-readable program code contained thereon.

[0080] The program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, fiber optic cable, RF, or any suitable combination thereof.

[0081] Computer program code used to perform the operations of embodiments of this disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​(e.g., Java, Smalltalk, C++, etc.) and traditional procedural programming languages ​​(e.g., the "C" programming language or similar programming languages). The program code may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet through an Internet service provider).

[0082] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments presented herein. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine, such that, when executed via the processor of the computer or other programmable data processing apparatus, the instructions create means for implementing the functions / actions specified in the blocks of the flowchart illustrations and / or block diagrams.

[0083] These computer program instructions may also be stored in a computer-readable medium, which can instruct a computer, other programmable data processing apparatus, or other device to operate in a particular manner, such that the instructions stored in the computer-readable medium produce an article of writing comprising instructions that implement the functions / actions specified in the blocks of flowcharts and / or block diagrams.

[0084] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other apparatus to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other apparatus to produce a computer-implemented process, such that when the instructions are executed on the computer, other programmable data processing apparatus, or other apparatus, they provide a process for implementing the function / action specified in the block of the flowchart and / or block diagram.

[0085] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments. In this regard, each block in a flowchart or block diagram may represent a module, segment, or code portion, comprising one or more executable instructions for implementing one or more specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the blocks may not be performed in the order indicated in the figures. For example, depending on the functions involved, two blocks shown consecutively may actually be executed substantially simultaneously, or sometimes these blocks may be executed in reverse order. It will also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a system based on dedicated hardware or a combination of dedicated hardware and computer instructions that performs the specified functions or actions.

[0086] In view of the foregoing, the scope of this disclosure is defined by the appended claims.

Claims

1. A method for system resource management at a network controller, comprising: Based on a shared security policy, a first plurality of endpoint groups (EPGs) are grouped into a first plurality of policy groups, wherein the first plurality of EPGs are connected to a plurality of switches in the network. Identify the first policy group among the first plurality of policy groups that has the highest resource requirement; The first security policy corresponding to the first policy group is assigned to the first switch among the plurality of switches; Identify a second plurality of EPGs from the remaining EPGs that were not included in the first strategy group from the first plurality of EPGs; Based on the shared security policy, the second or more EPGs are grouped into a second or more policy groups; Identify the second strategy group among the multiple strategy groups that has the highest resource requirement; as well as The second security policy corresponding to the second policy group is assigned to the second switch among the plurality of switches.

2. The method according to claim 1, wherein, At least one of the first plurality of EPGs belongs to a plurality of strategy groups in the first plurality of strategy groups.

3. The method according to claim 1, wherein, The available resources at each of the plurality of switches include: Content-addressable memory space; Local area network tablespace; Endpoint tablespaces; and Routing tablespace.

4. The method according to claim 1, further comprising: After allocating the first security policy, the available remaining resources at each of the plurality of switches are determined in the following manner: Determine the utilization rate of each of the plurality of switches for each of the plurality of resources, including the available remaining resources; Based on the utilization rate of each of the available remaining resources, a composite metric with ranking index weights is determined for each of the plurality of switches. and The second switch is associated with the highest composite metric value among the plurality of switches.

5. The method according to claim 4, wherein, The composite metric for each of the plurality of switches is based on the z-score of a given resource on a given switch relative to the plurality of resources available on the given switch.

6. The method according to any one of claims 1 to 5, further comprising: On the first switch, the shared security policy for the EPG included in the first policy group is flattened into the first security policy, which allows communication with the destination group.

7. The method according to claim 6, wherein, The first policy group is physically connected to the second switch, and the first security policy is offloaded from the second switch to the first switch.

8. The method according to claim 7, further comprising: Establish a network tunnel between the first switch and the second switch; Based on the port of the second switch that is connected to the EPG of the first policy group, set the port offset for the Internet Protocol IP address of the second switch for the first policy group. Based on the identity of the first policy group, set a group offset for the first policy group as a Virtual Private Network (VPN) routing and forwarding identifier (VRFID). In response to receiving at the second switch a communication from the first EPG intended for destination, the communication including the source IP address of the second switch and the VPN routing and forwarding identifier (VRFID) to which the EPG of the first policy group belongs: Use the port offset to modify the source IP address; Use the group offset to modify the VRFID; and The communication is transmitted from the second switch to the first switch via the network tunnel; and In response to receiving the communication from the second switch via the network tunnel at the first switch: The first security policy is identified based on the group offset; and In response to determining that the first security policy allows the communication, the communication is transmitted to the destination.

9. The method according to claim 8, wherein, The method further includes: the first switch learns from the communication in a session-based manner that the EPG IP address of the first EPG is associated with the source IP address modified by the port offset; In response to receiving a message for a given EPG for the first policy group at the first switch, the message including the destination IP address of the first EPG: The message is encapsulated for transmission via the network tunnel based on the association between the destination IP address and the source IP address modified by the port offset; Using the source IP address modified by the port offset, the message is forwarded from the first switch to the second switch over the network tunnel; and In response to determining at the second switch that the message is destined for the port based on a predefined rule between the source IP address and the port offset, the communication is forwarded to the first EPG via the port.

10. The method according to claim 8 or 9, further comprising: In response to receiving a second communication at the second switch from the EPG intended for a second destination, the second communication including the source IP address and the VRFID: Use the port offset to modify the source IP address; The VRFID is modified using the group offset; and The second communication is transmitted from the second switch to the first switch via the network tunnel; as well as In response to receiving the second communication from the second switch via the network tunnel at the first switch: The first security policy is identified based on the group offset; and In response to determining that the first security policy does not allow the second communication, the transmission of the second communication to the second destination is blocked.

11. A device for system resource management at a network controller, comprising: A means for grouping a first plurality of endpoint groups (EPGs) into a first plurality of policy groups based on a shared security policy, wherein the first plurality of EPGs are connected to a plurality of switches in a network; A means for identifying the first strategy group with the highest resource requirement among the first plurality of strategy groups; A means for assigning a first security policy corresponding to the first policy group to a first switch among the plurality of switches; A means for identifying a second plurality of EPGs from the remaining EPGs in the first plurality of EPGs that are not included in the first strategy group; A means for grouping the second plurality of EPGs into a second plurality of policy groups based on a shared security policy; A means for identifying the second strategy group with the highest resource requirement among the second plurality of strategy groups; and A means for assigning a second security policy corresponding to the second policy group to a second switch among the plurality of switches.

12. The apparatus of claim 11, further comprising means for implementing the method of any one of claims 2 to 10.

13. A computer-readable medium comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 10.

Images