Service chaining based on labels in control and forwarding

Abstract

A method for routing is disclosed. The method comprises establishing an overlay network, comprising a plurality of network elements and an overlay controller; wherein the overlay controller is in communication with each network element via a secure tunnel established through an underlying transport network; receiving by the overlay controller, information from each service-hosting network element information said information identifying a service hosted at that service-hosting network element, and label associated with the service-hosting network element; identifying by the overlay controller, at least one policy that associates traffic from a site with a service; and causing by said overly controller, the at least one policy to be executed so that traffic from the site identified in the policy is routed using the underlying transport network to the service-hosting network element associated with the said service.

The invention claimed is: 
     
       1. A method for routing, comprising:
 establishing an overlay network, comprising a plurality of network elements and an overlay controller, wherein the overlay controller is in communication with each network element via a secure tunnel established through an underlying transport network; 
 receiving, by the overlay controller, a first message from a first network element of the plurality of network elements, wherein the first message identifies a first service hosted at available through the first network element and a first label associated with the first service; 
 receiving, by the overlay controller, a second message from a second network element of the plurality of network elements, wherein the second message identifies a second service hosted at available through the second network element and a second label associated with the second service; 
 constructing, by the overlay controller, a policy defining a service chain that links the first service and the second service; and 
 pushingdistributing, by the overlay controller, the policy to a site so that traffic from the site including the first label is routed using the underlying transport network to the first network element hosting the first service and subsequently to the second network elementhosting the second service. 
 
     
     
       2. The method of  claim 1 , wherein the pushing distributing comprises:
 in response to the policy also defining flow of outbound traffic, pushing distributing the policy created on the overlay controller to the plurality of network elements characterized as being one of including an edge router and a hub router. 
 
     
     
       3. The method of  claim 1 , wherein the pushing distributing comprises:
 in response to the policy also defining flow of inbound traffic, pushing distributing the policy created on the overlay controller to the first network element. 
 
     
     
       4. The method of  claim 1 , wherein the pushing distributing comprises applying the policy to an overlay route prior to sending the overlay route to a third network element of the plurality of network elements, wherein the third network element is associated with an overlay next hop that refers to the first network element and traffic at the third network elements is associated with the first label. 
     
     
       5. A non-transitory computer-readable medium having stored thereon, instructions which, when executed by a controller, cause the controller to perform or control performance of operations comprising:
 establishing an overlay network, comprising a plurality of network elements and an overlay controller, wherein the overlay controller is in communication with each network element via a secure tunnel established through an underlying transport network; 
 receiving, by the overlay controller, a first message from a first network element of the plurality of network elements, wherein the first message identifies a first service hosted at available through the first network element and a first label associated with the first service; 
 receiving, by the overlay controller, a second message from a second network element of the plurality of network elements, wherein the second message identifies a second service hosted at available through the second network element and a second label associated with the second service; 
 constructing, by the overlay controller, a policy defining a service chain that links the first service and the second service; and 
 pushingdistributing, by the overlay controller, the policy to a site so that traffic from the site including the first label is routed using the underlying transport network to the first network element hosting the first service and subsequently to the second networkelement hosting the second service. 
 
     
     
       6. The non-transitory computer-readable medium of  claim 5 , wherein the pushing distributing comprises:
 in response to the policy also defining flow of outbound traffic, pushing distributing the policy created on the overlay controller to the plurality of network elements characterized as being one of including an edge router and a hub router. 
 
     
     
       7. The non-transitory computer-readable medium of  claim 5 , wherein the pushing distributing comprises:
 in response to the policy also defining flow of inbound traffic, pushing distributing the policy created on the overlay controller to the first network element. 
 
     
     
       8. The non-transitory computer-readable medium of  claim 5 , wherein the pushing distributing comprises applying the policy to an overlay route prior to sending the overlay route to a third network element of the plurality of network elements, wherein the third network element is associated with an overlay next hop that refers to the first network element and traffic at the third network elements is associated with the first label. 
     
     
       9. An overlay controller, comprising:
 a processor; and 
 a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the overlay controller to perform or control performance of operations, comprising:
 establishing an overlay network, comprising a plurality of network elements and an overlay controller, wherein the overlay controller is in communication with each network element via a secure tunnel established through an underlying transport network; 
 receiving, by the overlay controller, a first message from a first network element of the plurality of network elements, wherein the first message identifies a first service hosted at available through the first network element and a first label associated with the first service; 
 receiving, by the overlay controller, a second message from a second network element of the plurality of network elements, wherein the second message identifies a second service hosted at available through the second network element and a second label associated with the second service; 
 constructing, by the overlay controller, a policy defining a service chain that links the first service and the second service; and 
 pushingdistributing, by the overlay controller, the at least one policy to a site so that traffic from the site including the first label is routed using the underlying transport network to the first network element hosting the first service and subsequently to the second network elementhosting the second service. 
 
 
     
     
       10. The overlay controller of  claim 9 , wherein the pushing distributing comprises:
 in response to the policy also defining flow of outbound traffic, pushing distributing the policy created on the overlay controller to the plurality of network elements characterized as being one of including an edge router and a hub router. 
 
     
     
       11. The overlay controller of  claim 9 , wherein the pushing distributing comprises:
 in response to the policy also defining flow of inbound traffic, pushing distributing the policy created on the overlay controller to the first network element. 
 
     
     
       12. The overlay controller of  claim 9 , wherein the pushing distributing comprises applying the policy to an overlay route prior to sending the overlay route to a third network element of the plurality of network elements, wherein the third network element is associated with an overlay next hop that refers to the first network element and traffic at the third network elements is associated with the first label. 
     
     
       13. The method of  claim 1 , wherein packets of the traffic from the site include a stack of labels, including the first label and a third label identifying a virtual private network (VPN). 
     
     
       14. The non-transitory computer-readable medium of  claim 5 , wherein packets of the traffic from the site include a stack of labels, including the first label and a third label identifying a virtual private network (VPN). 
     
     
       15. The overlay controller of  claim 9 , wherein packets of the traffic from the site include a stack of labels, including the first label and a third label identifying a virtual private network (VPN). 
     
     
       16. The overlay controller of  claim 9 , wherein the first message indicates that the first service is associated with a particular virtual private network (VPN). 
     
     
       17. The overlay controller of  claim 16 , wherein the policy instructs the site to insert the first label into data packets that are sent through the particular VPN and forgo insertion of the first label into data packets that are sent outside the particular VPN. 
     
     
       18. The overlay controller of  claim 16 , wherein the second message indicates that the second service is associated with the particular VPN. 
     
     
       19. A method for forwarding network traffic to a network service in an overlay network, the method comprising:
 establishing an overlay network, comprising a plurality of network devices and an overlay controller, wherein the overlay controller is in communication with one or more of the network devices via a communications channel established through an underlying transport network, wherein at least a plurality of the network devices are overlay network devices, each overlay network device operative to establish a network layer tunnel with at least one other overlay network device of the overlay network;   receiving, by the overlay controller, a first message from at least one of the plurality of network devices, the first message relating to a network service available through a first overlay network device of the overlay network, the first message comprising a first identifier associated with the network service;   receiving, by the overlay controller, a second message from at least one of the plurality of network devices, the second message identifies a user service available through a first network device and including a second identifier associated with the user service;   constructing based on at least a portion of the first and second message, one or more policies;   distributing the one or more policies to one or more of the overlay network devices of the overlay network,   at least one of the one or more policies defining a service chain and linking the network service to the user service, the policy operative to cause one or more of the overlay network devices of the overlay network to forward, over a corresponding network layer tunnel, network traffic associated with one or more services and matching an attribute to the first overlay network device;   wherein the first overlay network device is operative to provide the network traffic to the first network service, and subsequently forward the network traffic received from the network service to the first network device.   
     
     
       20. The method of  claim 19 , wherein the network service is any one of a service in the group consisting of firewall services, intrusion detection services, traffic scrubbing services, caching services, traffic sampling and analytical services, deep packet inspection services, and internet services. 
     
     
       21. The method of  claim 19 , wherein the user service is accessible through a browser. 
     
     
       22. The method of  claim 19 , further comprising
 receiving, by the overlay controller, a first message from the first overlay network device, wherein the first message identifies the network service available through the first overlay network device.   
     
     
       23. The method of  claim 19 , wherein each overlay network device is operative to establish a secure network layer tunnel with at least one other overlay network device of the overlay network. 
     
     
       24. The method of  claim 19 , wherein at least one of the plurality of overlay network devices is a hub network device, and at least another one of the plurality of overlay network devices is an edge network device. 
     
     
       25. The method of  claim 19 , wherein at least a second one of the one or more policies is operative to cause the first overlay network device to forward, over a corresponding network layer tunnel, the network traffic associated with the user service and matching the attribute to a second overlay network device. 
     
     
       26. The method of  claim 19 , wherein the communications channels between the overlay controller and the overlay network devices are secure communications channels. 
     
     
       27. The method of  claim 19 , wherein the communications channels between the overlay controller and the overlay network devices are secure tunnel connections. 
     
     
       28. An overlay network controller, comprising:
 a processor;   a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 establish an overlay network; comprising a plurality of overlay network devices and the overlay controller; 
 communicate with each overlay network device via a communications channel established through an underlying transport network; 
 facilitate the establishment by each overlay network device of a network layer tunnel with at least one other overlay network device of the overlay network; 
 access a first message defining a network service available through a first overlay network device of the overlay network, wherein the first message comprising a first identifier associated with the network service; 
 access a second message identifying a user service available through a first network device and including a second identifier associated with the user service; 
 construct one or more policies and distribute the one or more policies to one or more of the overlay network devices of the overlay network, 
 at least one of the one or more policies defining a service chain and linking the network service to the user service, the policy operative to cause one or more of the overlay network devices of the overlay network to forward, over a corresponding network layer tunnel, network traffic associated with the user service and matching an attribute to the first overlay network device; 
 wherein the first overlay network device is operative to provide the network traffic to the network service, and subsequently forward the network traffic received from the network service to the first network device. 
   
     
     
       29. The overlay network controller of  claim 28 , wherein the network service is any one of a service in the group consisting of firewall services, intrusion detection services, traffic scrubbing services, caching services, traffic sampling and analytical services, deep packet inspection services, and internet services. 
     
     
       30. The overlay network controller of  claim 28 , wherein the user service is accessible through a browser. 
     
     
       31. The overlay network controller of  claim 28 , wherein the instructions which when executed by the processor causes the controller to receive the first message from the first overlay network device, wherein the first message identifies the network service available through the first overlay network device. 
     
     
       32. The overlay network controller of  claim 28 , wherein each overlay network device establishes a secure network layer tunnel with at least one other overlay network device of the overlay network. 
     
     
       33. The overlay network controller of  claim 28 , wherein at least one of the plurality of overlay network devices is a hub network device, and at least another one of the plurality of overlay network devices is an edge network device. 
     
     
       34. The overlay network controller of  claim 28 , wherein at least a second one of the one or more policies is operative to cause the first overlay network device to forward, over a corresponding network layer tunnel, the network traffic associated with the user service and matching the attribute to a second overlay network device. 
     
     
       35. The overlay network controller of  claim 28 , wherein the communications channels between the overlay controller and the overlay network devices are secure communications channels. 
     
     
       36. The overlay network controller of  claim 28 , wherein the communications channels between the overlay controller and the overlay network devices are secure tunnel connections. 
     
     
       37. A system for forwarding network traffic to a network service in an overlay network, the system comprising:
 a controller and a plurality of overlay network devices, the plurality of overlay network devices each operative to establish a network layer tunnel with at least one other overlay network device of the plurality of overlay network devices;   the controller comprising:
 a processor; 
 a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the controller to:
 establish an overlay network comprising the plurality of overlay network devices and an overlay controller, wherein the overlay controller communicates with each overlay network device via a communications channel established through an underlying transport network, 
 access a first message defining the network service available through a first overlay network device of the overlay network, the first message comprising a first identifier associated with the network service; 
 access a second message identifying to a user service available through a first network device and including a second identifier associated with the user service; 
 construct one or more policies and distribute the one or more policies to one or more of the overlay network devices of the overlay network, 
 at least one of the one or more policies defining a service chain and linking the network service to the user service, the policy operative to cause one or more of the overlay network devices of the overlay network to forward, over a corresponding network layer tunnel, network traffic associated with the user service and matching an attribute to the first overlay network device; 
 wherein the first overlay network device is operative to provide the network traffic to the network service, and subsequently forward the network traffic received from the network service to a second network device having reachability to the first network device. 
 
   
     
     
       38. The system of  claim 37 , wherein the network service is any one of a service in the group consisting of firewall services, intrusion detection services, traffic scrubbing services, caching services, traffic sampling and analytical services, deep packet inspection services, and internet services. 
     
     
       39. The system of  claim 37 , wherein the user service is accessible through a browser. 
     
     
       40. The system of  claim 37 , wherein the instructions which when executed by the processor causes the controller to receive a first message from the first overlay network device, wherein the first message identifies the network service available through the first overlay network device. 
     
     
       41. The system of  claim 37 , wherein each overlay network device is operative to establish a secure network layer tunnel with at least one other overlay network device of the overlay network. 
     
     
       42. The system of  claim 37 , wherein at least one of the plurality of overlay network devices is a hub network device, and at least another one of the plurality of overlay network devices is an edge network device. 
     
     
       43. The system of  claim 37 , wherein at least a second one of the one or more policies is operative to cause the first overlay network device to forward, over a corresponding network layer tunnel, the network traffic associated with the user service and matching the attribute to a second overlay network device. 
     
     
       44. The system of  claim 37 , wherein the communications channels between the overlay controller and the overlay network devices are secure communications channels. 
     
     
       45. The system of  claim 37 , wherein the communications channels between the overlay controller and the overlay network devices are secure tunnel connections.