Managed Forwarding Element for Single Interface Cloud Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public cloud environments, virtual machines (VMs) cannot access both the cloud service provider's native network and a third-party managed logical network using a single network interface and routing table, limiting network and security capabilities for workloads.
Innovation Solution
Implementing a managed forwarding element (MFE) kernel driver, such as Open vSwitch, which creates virtual adapters for both the native and logical networks, allowing packet forwarding between them and enabling access to both network spaces through a single interface with prioritized routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single network interface is used in public cloud environments, then device complexity is reduced, but the ability to access both native and logical networks is lost
Solution Approach 1:
The network interface is segmented into two virtual adapters: a first virtual adapter for accessing the overlay network and a second virtual adapter for accessing the underlay network. This segmentation allows the single physical interface to function as multiple specialized interfaces, resolving the contradiction between simplicity and versatility.
Solution Approach 2:
A managed forwarding element (MFE) is introduced as an intermediary component that receives packets from the network stack and forwards them to the appropriate virtual adapter based on routing table lookups. This intermediary enables intelligent packet routing between different network spaces without requiring complex configuration at the application level.
2Device complexity
If a single routing table is used, then device complexity is reduced, but the ability to route traffic to both overlay and underlay networks is lost
Solution Approach 1:
The routing functionality is segmented by creating separate routing tables: a first routing table for overlay network routes and a second routing table for underlay network routes. This segmentation allows each routing table to be optimized for its specific network type while maintaining overall system simplicity through unified management.
Solution Approach 2:
The MFE acts as an intermediary that performs routing table lookups and packet forwarding based on destination IP addresses. It determines whether to use the overlay or underlay routing table and forwards packets through the appropriate virtual adapter, enabling versatile routing without complex configuration.
3Reliability
If overlay networking is implemented, then security capabilities are improved, but access to cloud service provider's native network is restricted
Solution Approach 1:
The network architecture is segmented into overlay and underlay networks with dedicated virtual adapters for each. This segmentation allows security policies to be enforced at the overlay level while maintaining independent access to the underlay network through the second virtual adapter, resolving the contradiction between security and accessibility.
Solution Approach 2:
The MFE provides multi-functional capability by supporting both overlay and underlay network operations through a single unified component. It can perform routing, forwarding, and security functions for both network types, enabling the system to maintain security while accessing multiple network spaces.
Data Source
AI summary
A physical host machine of a public cloud system includes a set of processing units for executing instructions stored in non-transitory machine readable media. The physical host machine also includes a physical network interface cars (PNIC) and a non-transitory machine readable medium that stores a data compute node (DCN). The DCN includes first and second applications, first and second logical interfaces, a network stack, and a managed forwarding element (MFE). The first application is connected to the pNIC through the network stack, the first logical interface, and the MFE. The second application is connected to the PNIC through the network stack, the second logical interface, and the MFE.