Policy-Based VRF Assignment Using Layer 3 Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VRF assignment technologies are not scalable and require frequent updates as the number of hosts in a VLAN increases, as they rely on pair-wise definition of segregation policies using tables, which become cumbersome and inefficient.
Innovation Solution
Implementing a method that assigns virtual routers at layer 3 of the TCP/IP protocol, utilizing a classification engine with TCAM or similar memory to perform multi-field classification based on packet IP addresses and other information, allowing policy-based VRF-ID assignment without the need for pair-wise tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pair-wise tables are used to define segregation policies between hosts, then traffic segregation between different VLANs can be achieved, but the table size increases greatly and the system becomes non-scalable as the number of hosts increases
Solution Approach 1:
The patent segments the policy definition from host pairs to host groups. Instead of creating individual policy entries for each host pair, the system divides hosts into groups (e.g., by VLAN or department) and defines policies at the group level. This segmentation reduces the number of policy entries from O(n²) to O(g) where g is the number of groups, directly resolving the scalability issue while maintaining traffic segregation reliability
Solution Approach 2:
The patent implements universal group-based policy rules that can apply to multiple hosts simultaneously. A single policy rule defined for a group can govern traffic from any host in that group to any host in another group, making the policy system multi-functional and applicable to dynamic host configurations without requiring updates to individual host policies
2Adaptability or versatility
If pair-wise tables are used to define segregation policies, then traffic control between specific hosts can be implemented, but frequent updates are required each time a host is added to a VLAN
Solution Approach 1:
The patent performs preliminary grouping of hosts by VLAN or organizational criteria before policy enforcement. Hosts are pre-categorized into groups based on their VLAN membership, and policies are pre-configured for these groups. When a host is added to a VLAN, it automatically inherits the group policy without requiring manual policy updates, eliminating the need for frequent productivity-consuming updates while maintaining flexible traffic control
Solution Approach 2:
The system implements automatic feedback mechanisms where the router monitors host VLAN membership changes and dynamically updates group assignments. When a host joins or leaves a VLAN, the system receives feedback about the configuration change and automatically adjusts the policy application, ensuring traffic control flexibility is maintained without manual intervention
3Reliability
If VRF assignment is made at layer 2 using port, VLAN tag or MPLS interface identification, then virtual router segregation can be achieved, but the resolution and precision of virtual router assignment is limited
Solution Approach 1:
The patent transitions from layer 2 identification (port, VLAN tag, MPLS interface) to layer 3 identification (source and destination IP addresses). This dimensional change from data link layer to network layer provides finer granularity for virtual router assignment, as IP addresses offer more specific identification capability than VLAN tags or port numbers, thereby improving assignment resolution while maintaining segregation reliability
Data Source
AI summary
A network switch device includes network interfaces configured to receive and transmit packet based communications within a computer network, a virtual router classification engine, and a packet forwarding engine. The virtual router classification engine is configured to generate a search key for a packet received at a first network interface using header information, and additional information associated with the packet, to select a rule corresponding to the generated search key, and to apply an action associated with the selected rule to the packet. The virtual router classification engine is configured to apply an action associated with the selected rule to the packet at least by assigning a virtual router identifier to the packet. The packet forwarding engine is configured to serve organizations forming the computer network, and segregate packet communications of the first organization from packet communications traffic of other organizations based on the assigned virtual router identifier.