Switch Forwarding Congestion Notification in Private VLANs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In private VLANs, congestion notification messages (CNMs) with isolated VLAN IDs are blocked from reaching the source of congestion due to forwarding rules, preventing effective congestion management, and existing solutions require significant configuration overhead to determine the primary VLAN ID.
Innovation Solution
A switch is designed to forward frames with isolated VLAN IDs via isolated VLAN ports and enforces egress access control lists (eACLs) to allow CNM frames with isolated VLAN IDs to propagate, while preventing other traffic, using modified egress filtering rules and Ethertype examination to ensure secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If forwarding rules for isolated sub-domain are enforced, then security and traffic isolation are improved, but congestion notification message flow is blocked
Solution Approach 1:
The patent introduces a special handling mechanism for CNM frames that acts as an intermediary exception to the isolated port forwarding rules. When a frame is identified as a congestion notification message (through Ethertype examination), it is allowed to pass through isolated ports despite the general blocking rule, thereby enabling congestion management while maintaining security for other traffic
Solution Approach 2:
The patent changes the forwarding behavior parameter for isolated ports based on frame type. By examining the Ethertype field in the frame header, the switch dynamically adjusts whether to apply the restrictive forwarding rule or allow passage, enabling selective enforcement of isolation rules that permits CNM flow while blocking other traffic
2Reliability
If egress filtering rules are enforced to block non-CNM traffic, then security is improved, but configuration complexity increases
Solution Approach 1:
The patent implements a self-service mechanism where the frame itself carries identification information (Ethertype field) that enables the switch to automatically distinguish CNM frames from other traffic. This eliminates the need for complex manual configuration of access control lists, as the frames self-identify their type through standard Ethernet header fields
Solution Approach 2:
The patent simplifies configuration by changing the enforcement parameter from complex ACL-based filtering to a simpler Ethertype-based classification. The switch examines the Ethertype field in the frame header to determine whether to apply egress filtering, reducing configuration overhead while maintaining security
Data Source
AI summary
One embodiment of the present invention provides a switch. During operation, in a network with a private VLAN configuration, the switch allows a congestion notification message with an isolated virtual local area network identifier (VLAN ID) to be forwarded via an isolated VLAN port.