PVLAN Enforcement in Distributed Virtual Switches
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale Distributed Virtual Switch (DVS) networks, existing solutions face scalability issues due to the inefficient distribution of Media Access Control (MAC) address lists, leading to leakage of secondary VLAN information and violation of Private Virtual Local Area Network (PVLAN) paradigms, as every server receives MAC addresses for all PVLAN VM ports, even if they do not host them.
Innovation Solution
Maintaining a list of source identifiers on each virtual switch, allowing only authorized sources to send packets to PVLAN ports, with the list being stored only on servers hosting PVLAN host ports, and propagated by a supervisory device to ensure efficient and scalable enforcement of PVLAN semantics across multiple servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If every server receives MAC addresses for all PVLAN VM ports, then PVLAN isolation can be enforced, but system scalability deteriorates
Solution Approach 1:
The patent segments the centralized MAC address list into distributed port identifier lists at each virtual switch. Instead of every server receiving all PVLAN VM port MAC addresses, each virtual switch maintains only the port identifiers for ports locally hosted on that server. This segmentation eliminates the scalability problem while preserving PVLAN isolation through localized forwarding table checks.
Solution Approach 2:
The patent applies local quality by making each virtual switch store and enforce only the port identifiers relevant to its local ports. The supervisory device propagates these localized lists server-to-server, ensuring that each server processes only the subset of PVLAN information necessary for its hosted ports, rather than distributing all MAC addresses to all servers.
2Productivity
If secondary VLAN information is converted to primary VLAN at uplink ports, then traffic can flow between servers, but VLAN identifying information is lost
Solution Approach 1:
The patent applies preliminary action by having the supervisory device pre-calculate and propagate port identifier lists to each virtual switch before traffic flow issues arise. Each virtual switch receives in advance the specific port identifiers it needs to recognize and enforce PVLAN policies for, eliminating the need for runtime VLAN information conversion and preventing information loss.
Solution Approach 2:
The patent introduces the supervisory device as an intermediary between the centralized PVLAN configuration and the distributed virtual switches. This intermediary pre-processes the PVLAN port information and distributes appropriate subsets to each virtual switch, enabling traffic flow without requiring the virtual switches to perform complex VLAN conversion operations that would lose identifying information.
3Reliability
If PVLAN policies are enforced at each virtual switch, then isolation is maintained, but distribution overhead increases
Solution Approach 1:
The patent changes the parameter representation from full MAC addresses to simplified port identifiers. Each virtual switch stores and processes only compact port identifier lists rather than complete MAC address information. This parameter change reduces the distribution overhead and memory requirements while maintaining the ability to enforce PVLAN isolation policies through identifier matching.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a list of source identifiers is maintained at a virtual switch. These source identifiers are allowed to send packets through the virtual switch to ports in a private virtual local area network (PVLAN). When a packet is received at the virtual switch from a particular source destined for a particular port in the PVLAN, the virtual switch determines whether a particular identifier associated with the particular source matches one of the source identifiers in the list. If that particular source identifier is not on the list, the packet is prevented from being forwarded to the particular port in the PVLAN.