VM Network Interface Segmentation for Cloud Overlay Underlay Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public cloud environments, third-party network virtualization platforms lack access to the underlying hypervisor, limiting their ability to provide network and security services to guest virtual machines (VMs), as they can only manage VMs and not the underlying infrastructure controlled by the cloud service provider.
Innovation Solution
Implementing a managed forwarding element (MFE) kernel driver, such as Open vSwitch (OVS), within VMs to create virtual adapters for both overlay and underlay networks, allowing VMs to access both the third-party logical network and the cloud service provider's native network using a single network interface and routing table, with packet forwarding and translation mechanisms to facilitate communication and security enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a third party network virtualization platform is used in public cloud, then network and security capabilities are enhanced, but access to underlying hypervisor is lost
Solution Approach 1:
The patent introduces a managed forwarding element (MFE) as an intermediary component that operates within the guest VM to bridge the third-party logical network with the cloud service provider's native network. The MFE kernel driver acts as a mediator between the overlay virtual adapter and underlay virtual adapter, enabling network translation and forwarding without requiring direct hypervisor access. This resolves the contradiction by providing enhanced network capabilities through the MFE while maintaining the third-party platform's independence from the hypervisor.
Solution Approach 2:
The patent segments the network interface functionality into separate virtual adapters: an overlay virtual adapter for third-party logical network access and an underlay virtual adapter for native network access. The MFE kernel driver further segments packet processing by creating distinct paths for overlay traffic (requiring tunneling) and underlay traffic (direct forwarding). This segmentation allows the system to provide multiple network capabilities simultaneously while maintaining clear separation of responsibilities between the third-party platform and cloud provider infrastructure.
2Device complexity
If a single network interface is used for both overlay and underlay networks, then device complexity is reduced, but packet routing control becomes more difficult
Solution Approach 1:
The patent segments packet routing control by creating separate virtual adapters (overlay and underlay) that each handle specific traffic types, while maintaining a single physical network interface. The MFE kernel driver implements separate packet processing paths: one for overlay traffic that requires encapsulation and tunneling, and another for underlay traffic that uses direct forwarding. This segmentation of routing logic within a single interface simplifies the virtualization layer while maintaining clear routing control.
Solution Approach 2:
The MFE kernel driver serves as an intermediary packet forwarding element that mediates between the network stack and the physical NIC. It receives packets from the network stack, determines whether they belong to overlay or underlay networks, and forwards them through the appropriate virtual adapter. This intermediary layer simplifies the overall device architecture by consolidating routing decisions in a single managed component while maintaining operational clarity through structured packet processing.
3Ease of operation
If overlay virtual adapter is given higher priority in routing table, then access to logical network is improved, but access to underlay network is restricted
Solution Approach 1:
The patent segments routing by creating separate route entries for overlay and underlay networks in the VM's routing table. The overlay virtual adapter is assigned a lower interface metric (higher priority) for overlay traffic, while the underlay virtual adapter has a higher interface metric for native network traffic. This segmentation of routing rules allows the system to prefer overlay access for logical network communication while maintaining the ability to access underlay networks when needed, resolving the contradiction between priority and versatility.
Data Source
AI summary
A data compute node executes (i) a set of tenant applications connected to a third party overlay network, (ii) a set of network manager applications, and (iii) a managed forwarding element that includes a pair of overlay and underlay network virtual adapters. A packet that is received from a network manager application and addressed to an underlay network destination is sent to the underlay network destination address through a physical NIC of the host without network address translation or encapsulation. A packet that is received from a tenant application and addressed to an underlay network destination is subject to SNAT and is sent to the underlay network destination address. A packet that is received from a tenant application and is addressed an overlay destination address is encapsulated with the header of the overlay network and is sent to the overlay network destination address through the underlay virtual adapter.