Method and apparatus for implementing and managing virtual switches

Abstract

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g, GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

1 - 26 . (canceled) 
     
     
         27 . A method of implementing a virtual network for a tenant over a physical network shared among a plurality of tenants in a datacenter, the method comprising:
 defining a logical forwarding element (LFE) to be implemented by a plurality of physical forwarding elements (PFEs) associated with a plurality of host computers in the datacenter;   distributing data to the plurality of PFEs to configure the PFEs to implement the LFE, said data providing a mapping between a port of the LFE to a port of at least one particular PFE executing on at least one host computer; and   said PFEs using the distributed data and provided mapping to forwarding packets associated with the LFE.   
     
     
         28 . The method of  claim 27 , wherein the PFEs include software forwarding elements (SFEs) executing on the plurality of host computers. 
     
     
         29 . The method of  claim 28 , wherein the PFEs further include at least one hardware forwarding elements of the datacenter. 
     
     
         30 . The method of  claim 27 , wherein the LFE processes packets between machines of a first tenant while isolating the first tenant's machines from the machines of other tenants hosted within the datacenter. 
     
     
         31 . The method of  claim 30 , wherein the LFE is a first LFE, and the plurality of SFEs implement at least one second LFE to process packets between machines of at least a second tenant while isolating the machines of the second tenant from the first tenant. 
     
     
         32 . The method of  claim 27 , wherein said defining and distributing are performed by a virtualization platform of the datacenter. 
     
     
         33 . The method of  claim 32 , wherein a PFE performs packet forwarding operation for the LFE by mapping the logical port of the LFE to a physical port of the PFE that is associated with a physical next hop address, encapsulating the packet with the physical next hop address, and forwarding the packet out of the physical port of the particular PFE. 
     
     
         34 . The method of  claim 27 , wherein each PFE uses the distributed data to perform logical forwarding decisions for forwarding the packets received from machines of the first tenant. 
     
     
         35 . The method of  claim 34 , wherein the logical forwarding decisions comprise at least (i) L2 lookups for a logical switch and (ii) L3 lookups for a logical router. 
     
     
         36 . The method of  claim 34 , wherein the plurality of machines comprises a plurality of virtual machines. 
     
     
         37 . A non-transitory machine readable medium storing a program for execution by at least one processing unit, the program for implementing a virtual network for a tenant over a physical network shared among a plurality of tenants in a datacenter, the program comprising sets of instructions for:
 defining a logical forwarding element (LFE) to be implemented by a plurality of physical forwarding elements (PFEs) associated with a plurality of host computers in the datacenter;   distributing data to the plurality of PFEs to configure the PFEs to implement the LFE, said data providing a mapping between a port of the LFE to a port of at least one particular PFE executing on at least one host computer; and   said PFEs using the distributed data and provided mapping to forwarding packets associated with the LFE.   
     
     
         38 . The non-transitory machine readable medium of  claim 37 , wherein the PFEs include software forwarding elements (SFEs) executing on the plurality of host computers. 
     
     
         39 . The non-transitory machine readable medium of  claim 38 , wherein the PFEs further include at least one hardware forwarding elements of the datacenter. 
     
     
         40 . The non-transitory machine readable medium of  claim 37 , wherein the LFE processes packets between machines of a first tenant while isolating the first tenant's machines from the machines of other tenants hosted within the datacenter. 
     
     
         41 . The non-transitory machine readable medium of  claim 40 , wherein the LFE is a first LFE, and the plurality of SFEs implement at least one second LFE to process packets between machines of at least a second tenant while isolating the machines of the second tenant from the first tenant. 
     
     
         42 . The non-transitory machine readable medium of  claim 37 , wherein the program is a virtualization platform of the datacenter. 
     
     
         43 . The non-transitory machine readable medium of  claim 32 , wherein a PFE performs packet forwarding operation for the LFE by mapping the logical port of the LFE to a physical port of the PFE that is associated with a physical next hop address, encapsulating the packet with the physical next hop address, and forwarding the packet out of the physical port of the particular PFE. 
     
     
         44 . The non-transitory machine readable medium of  claim 27 , wherein each PFE uses the distributed data to perform logical forwarding decisions for forwarding the packets received from machines of the first tenant. 
     
     
         45 . The non-transitory machine readable medium of  claim 37 , wherein the distributed data comprises flow entries, wherein the flow entries are distributed using OpenFlow, wherein the distributed flow entries are used to modify flow tables of the physical forwarding elements. 
     
     
         46 . The non-transitory machine readable medium of  claim 42 , wherein the set of instructions for distributing the data to the PFEs comprises a set of instructions for using a set of secure channels to communicate with the PFEs from the virtualization platform.