SDN Controller Flow Table for VM Packet Forwarding Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In OpenStack networks, virtual machine (VM) packets do not pass through compute nodes, preventing them from filtering and controlling these packets, which hinders forwarding control.
Innovation Solution
Introducing a Software Defined Network (SDN) controller that creates a port for the VM, informs it of a universally unique identifier (UUID), and generates a flow table based on forwarding rules, enabling the virtual network apparatus to forward packets according to this table, thus achieving forwarding control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If VM packets do not pass through compute nodes, then network forwarding efficiency is improved, but forwarding control capability deteriorates
Solution Approach 1:
The patent introduces a security group manager as an intermediary component that bridges the gap between compute nodes and network nodes. This manager receives forwarding rules from the controller, associates them with VM port IDs, and pushes the corresponding security group rules to network nodes. This intermediary mechanism enables centralized forwarding control without requiring VM packets to pass through compute nodes, thus resolving the contradiction between forwarding efficiency and control capability.
2Adaptability or versatility
If centralized control is implemented through SDN controller, then network management flexibility is improved, but system complexity increases
Solution Approach 1:
The patent segments the centralized control function into distinct modular components: a controller that generates forwarding rules, a security group manager that processes and distributes these rules, and network nodes that enforce the rules. This segmentation allows each component to have a specific, simplified responsibility while collectively providing flexible centralized control, thereby reducing overall system complexity.
Solution Approach 2:
The security group manager serves multiple functions: it receives forwarding rules from the controller, associates them with VM port IDs, manages security group rule generation, and distributes rules to network nodes. This multi-functionality consolidates control operations into a single component, reducing the need for multiple separate systems and simplifying the overall architecture while maintaining network management flexibility.
Data Source
AI summary
Examples of the present disclosure provide a VM packet controlling method and apparatus, applicable for an OpenStack network. The OpenStack network includes an OpenStack controller node, an OpenStack compute node, and a virtual network system. The OpenStack network is communicatively connected with an SDN controller, the virtual network system includes a VM and a virtual network apparatus responsible for forwarding packets of the virtual machine. The OpenStack controller node creates a port for the VM, informs the SDN controller of a port UUID and a forwarding rule applied on the port; the OpenStack controller node receives a port ID, and transmits a corresponding relationship between the port ID and the port UUID to the SDN controller, the SDN controller generates a flow table according to the forwarding rule applied on the port, and issues the flow table to the virtual network apparatus according to the corresponding relationship.