VLAN-Aware VMs Translate VXLAN Traffic for Secure Cross-Host Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers face challenges in enabling communication between virtual machines (VMs) across different layer-2 segments due to security and performance restrictions, and the cost of installing additional packages for Virtual Extended Local Area Network (VXLAN) support.
Innovation Solution
Implementing VLAN-aware VMs that translate and redirect VXLAN traffic between VMs running on different hosts, using VLAN-aware VMs to encapsulate and transmit packets, and utilizing open flow rules for micro-segmentation and firewall implementation, while supporting up to 4K private VLANs and complying with networking standards like OVSDB.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If overlay technology is used to span layer-2 segments across layer-3 network, then VMs in different layer-2 segments cannot communicate, but network security and performance are maintained
Solution Approach 1:
The patent introduces VLAN-aware VMs as intermediary components that terminate VXLAN tunnels and perform protocol translation. These intermediaries enable communication between VMs in different layer-2 segments by converting VXLAN-encapsulated packets into native VLAN frames, allowing cross-segment communication while maintaining the security boundaries enforced by the overlay network architecture.
2Adaptability or versatility
If additional packages are installed for VXLAN support, then VXLAN communication between VMs is enabled, but licensing cost increases
Solution Approach 1:
The patent implements VXLAN functionality within guest VMs themselves rather than requiring host OS packages. The VXLAN tunnel endpoints (VTEPs) run as virtual appliances inside the VMs, allowing the VMs to self-provide VXLAN communication capabilities using standard networking software that is already licensed, eliminating the need for additional host-level VXLAN licenses.
3Adaptability or versatility
If VLAN-aware VMs are used for translation, then communication between VMs on different hosts is enabled, but device complexity increases
Solution Approach 1:
The patent combines multiple functions into the VLAN-aware VMs: they serve as both VXLAN tunnel endpoints for receiving encapsulated traffic and as translation engines for converting to native VLAN frames. By merging the tunnel termination and protocol translation functions into a single component running inside the VM, the solution reduces infrastructure complexity compared to requiring separate translation devices or host-based translation services.
Data Source
AI summary
In one example, a virtual local area network (VLAN) tagged packet may be received from a first virtual machine (VM) running on a first host via a port group that spans across hosts by a first virtual bridge of a first VLAN-aware VM. The first VLAN-aware VM may run on the first host. The VLAN tagged packet from the first VM may be translated to a virtual extensible local area network (VXLAN) encapsulated packet by the first virtual bridge based on a network property of a VM port of the first VM. The VXLAN encapsulated packet may be transmitted to a second VM running on a second host by the first virtual bridge via a VXLAN tunnel endpoint (VTEP) provided by the first VLAN-aware VM.