Interconnecting external networks with overlay networks in a shared computing environment

A method includes obtaining, by one or more processor, data from a virtual network of a tenant and an identifier of the tenant, where the virtual network of the tenant is one of at least two virtual networks in a shared computing environment where the at least two virtual networks overlay a physical network. Based on obtaining the identifier of the tenant, the method includes setting, by one or more processor, the identifier in metadata of the data and based on the identifier in the metadata, identifying, by the one or more processor, a network connection associated with the tenant. The method also includes identifying, by the one or more processor, a policy of the network connection and processing the data with the policy to create processed data and transmitting, by the one or more processor, the processed data through the network connection.

TECHNICAL FIELD

One or more aspects of the present invention relates to utilizing a virtual private network (VPN) gateway to interconnect external networks of different tenants in a shared environment, such as a data center, with an overlay network.

BACKGROUND

The use of overlay networks, also called virtual networks, is gaining popularity in data centers and other multiple tenant data storage environments for its ability to decouple physical and virtual networks and allow one physical network infrastructure to provide virtual networks for multiple tenants. In an overlay network, the separation of tenants is hidden from the underlying physical infrastructure. Thus, the underlying transport network does not need to know about tenancy separation to forward traffic correctly. To enable individual tenants to utilize this environment, the resource provider for the data center, for example, a cloud service provider (CSP), sets up a respective VPN gateway for each tenant to provide access to each respective tenant. This infrastructure is problematic because per-tenant VPN gateway deployment utilizes network resources and increases the management overhead for the infrastructure of the data center as a whole. Thus, both capital and operational expenses can increase dramatically as the number of tenants of the multi-tenant data storage environment expands.

SUMMARY

Shortcomings of the prior art are overcome and additional advantages are provided through the provision of a method to interconnect external networks of different tenants in a shared environment through a shared connection. The method includes, for instance: obtaining, by one or more processor, data from a virtual network of a tenant and an identifier of the tenant, wherein the virtual network of the tenant is one of at least two virtual networks in a shared computing environment wherein the at least two virtual networks overlay a physical network; based on obtaining the identifier of the tenant, setting, by the one or more processor, the identifier in metadata of the data; based on the identifier in the metadata, identifying, by the one or more processor, a network connection associated with the tenant; identifying, by the one or more processor, a policy of the network connection and processing the data with the policy to create processed data; and transmitting, by the one or more processor, the processed data through the network connection.

Shortcomings of the prior art are overcome and additional advantages are provided through the provision of a computer program product interconnect external networks of different tenants in a shared environment through a shared connection. The computer program product includes, for instance, a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method including: obtaining, by the one or more processor, data from a virtual network of a tenant and an identifier of the tenant, wherein the virtual network of the tenant is one of at least two virtual networks in a shared computing environment wherein the at least two virtual networks overlay a physical network; based on obtaining the identifier of the tenant, setting, by one or more processor, the identifier in metadata of the data; based on the identifier in the metadata, identifying, by the one or more processor, a network connection associated with the tenant; identifying, by the one or more processor, a policy of the network connection and processing the data with the policy to create processed data; and transmitting, by the one or more processor, the processed data through the network connection.

Computer systems and methods relating to one or more aspects of the technique are also described and may be claimed herein. Further, services relating to one or more aspects of the technique are also described and may be claimed herein.

Additional features and are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention.

DETAILED DESCRIPTION

The accompanying figures, in which like reference numerals refer to identical or functionally similar elements throughout the separate views and which are incorporated in and form a part of the specification, further illustrate the present invention and, together with the detailed description of the invention, serve to explain the principles of the present invention.

Embodiments of the present invention recognize that when a controller, such as a CSP, in a multi-tenant environment, deploys a VPN gateway for each individual tenant to access that individual tenant's overlay network, the overhead for and the complexities of managing the environment greatly increases with each additional tenant, which limits the ability of the environment to function effectively. The time and labor required to maintain these separate VPN connections impacts the efficiency with which the environment is able to operate.

The present disclosure provides, in part, methods, computer programs, and/or computer systems, for utilizing a tenant identifier in the metadata of a packet to enable a VPN overlay gateway, interfacing with a data center physical underlay network, and an Internet-facing network, to tunnel tenant frames to and from other Network Virtualization Edges (NVEs) (i.e., network entities that sit at the edge of underlay networks and implement network virtualization functionality) within the data center, and conversely, to tunnel tenant IP packets to and from remote VPN peers. Embodiments of the present invention include methods, computer programs, and/or computer systems that implement a multi-tenant VPN-Overlay gateway for interconnecting external networks, belonging to different tenants, with overlay networks. One advantage of certain embodiments of this invention is that by utilizing certain aspects, tenants can share a gateway to connect their respective remote networks to the overlay networks through secure connections, including but not limited to, respective secured VPN tunnels.

Certain embodiments of the present invention represent a technological improvement over prior systems and methods for managing multi-tenant environments by providing multi-tenancy access by utilizing fewer VPN-overlay gateways than tenants, including, utilizing a single VPN-overlay gateway to accommodate all the tenants of a given data center. This aspect of certain embodiments of the present invention provides an advantage by greatly decreasing the overall capital expenditure associated with a multi-tenant environment by enabling different tenants of a physical data storage environment, including but not limited to, a data center which may be comprised of a cloud computing environment, to share a common VPN-overlay gateway, eliminating the necessity of providing a gateway for each tenant and the associated costs of any hardware and/or software required to provide the individual gateways.

Advantages of certain embodiments of the present invention are particularly relevant to multi-tenant environments because as the number of tenants increases, the number of VPN-overlay gateways can remain constant, which greatly reduces the management overhead of the environment, including time and costs associated with deployment, configuration, and change management, across the environment.

Certain embodiments of the present invention may provide additional advantages to overall system efficiency and eliminate unnecessary expenditures by utilizing existing VPN clients and are compatible with legacy hardware and software within data centers and other data storage environments.

Certain embodiments of the present invention provide further advantages by being platform independent such that aspects of the invention may be integrated into both hardware and network function virtualization (NFV) based VPN gateways. Embodiments of the present invention may also be protocol independent and may utilize protocols including, but not limited to, IPSec VPN, and SSL VPN.

Aspects of various embodiments of the present invention provide a unique solution for separately managing network traffic in multiple virtual networks across a single physical environment shared by multiple tenants, by providing at least one shared VPN-overlay gateway, rather than a separate gateway for each tenant. The approach is unique at least because in an overlay network, the separation of tenants is hidden from the underlying physical infrastructure, which renders counterintuitive using a shared network element to transport data to a destination that is a tenant-specific virtual resource. In fact, current systems are configured specifically to task dedicated resources with these tenant-specific virtual destinations.

For clarity, the term data center in the present disclosure is utilized to represent a hardware and/or software environment capable of providing network resources at least one tenant, including providing resources, such as those that comprise virtual networks, for use by the tenant. The data center may represent resources across one or more locations and may include a cloud computing environment. Additionally, throughout the present disclosure, the terms overlay network and virtual network are used interchangeably.

As discussed above, the shared environment may be a cloud and therefore some embodiments of the present invention may offer functionality described below to a user in a Software as a Service (SaaS) model, i.e., aspects of the method described are executed by one or more processors in a cloud infrastructure. Embodiments of the present invention that utilize the cloud infrastructure may be especially advantageous when it is the resources of the cloud that are providing various services to different users of the cloud, wherein the individual services may be executed on dedicated virtual resources within the cloud computing environment. By utilizing the cloud infrastructure, in certain embodiments of the present invention, the potential to utilize embodiments of the present invention to provide dedicated virtual resources to a large tenant pool may be realized.

FIGS. 1-4depict various aspects of computing, including cloud computing, in accordance with one or more aspects set forth herein.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Workloads layer90provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation91; software development and lifecycle management92; virtual classroom education delivery93; data analytics processing94; transaction processing95; and identifying a network connection associated with the tenant96, as described herein. Element96can be understood as one or more program440described inFIG. 4.

FIG. 4depicts a hardware overview of a computing node10, in accordance with one or more aspects set forth herein.

Program/utility40as set forth inFIG. 1can include one or more program440as set forth inFIG. 4, and program/utility40, including, for example one or more program440to identify a network connection associated with the tenant, as described in work layer96. Program/utility40as set forth inFIG. 1can include one or more program440and can optionally include some or all of one or more program441,442,443,444,445.

One or more program440can have a set (at least one) of program modules, and may be stored in memory28by way of example, and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, program data, and one or more program, or some combination thereof, may include an implementation of a networking environment. One or more program440(and optionally at least one of one or more program441,442,443,444,445) generally carry out the functions and/or methodologies of embodiments of the invention as described herein.

As aforementioned, absent the unique functionality of certain embodiments of the present invention, shared physical environments that provided dedicated virtual resources for multiple tenants were taxed by the requirement of providing dedicated communication channels from each tenant to that tenant's virtual resources. This type of technical environment is depicted inFIG. 5.

FIG. 5depicts an example of existing overlay network framework, and illustrates how tenant overlay networks can be accessed from the Internet581with each tenant of a data center500utilizing an individual VPN tunnel (e.g., VPN TunnelA592and VPN TunnelB594) to access tenant-specific virtual networks formed from a (physical) data center underlay network510. One or more program440(as depicted inFIG. 4) executing on at least one resource of the data center500ofFIG. 5, uses an underlay network510to provide tenants with virtual networks (i.e., overlay networks). As seen in the depicted logical views, each tenant may access its virtual network(s). For example, referring toFIG. 5, the aforementioned one or more program440provides Tenant A with a two virtual networks VN1520, and VN2530, which are part of a layer 3 (L3) virtual network540. The one or more program440provides Tenant B with a virtual network, VN3550.

Tenant overlay networks are referred to herein as virtual networks (VNs). To create these virtual networks from the underlay network510, the technical environment of the data center100is also comprised of a Network Virtualization Edge (NVE), for each tenant. In the data center500, NVE1560and NVE2570, are network entities that sit on the edge of the underlay network510. Program440(FIG. 4) executing on at least one computing resource in the data center500and/or accessible to at least one resource in the data center500utilizes the NVEs to implement layer 2 (L2) or layer 3 (L3) network virtualization functions.

As is the case in many shared environments, inFIG. 5, the tenants are not located in the same physical location at the data center500and connect to their respective virtual resources remotely. In this example, each tenant accesses the resources of its virtual environment within the data center500from its remote location, TenantA site580, and TenantB site590. One or more program440(FIG. 4) executing on at least one resource in the data center500, e.g., a CSP, sets up a VPN gateway (e.g., VPN TunnelA592and VPN TunnelB594) for each tenant to provide access to each tenant to its network(s). As more tenants utilize the data center500, the more dedicated VPN gateways must be provided. For each tenant, the VPN gateway terminates the VPN tunnel and passes the packet to the virtual network.

Rather than tax a system with creating and supporting individual VPN gateways for each tenant of a multi-tenant environment, like inFIG. 5, embodiments of the present invention may be utilized to implement a multi-tenant VPN overlay gateway for interconnecting external networks with overlay networks. In an embodiment of the present invention, tenants may share VPN gateways, including but not limited to all tenants sharing a single VPN gateway, to connect their respective remote networks to overlay networks. Certain embodiment of the method of the present invention support multi-tenancy in a single VPN gateway for overlay-based networks.

FIG. 6depicts a shared multi-tenant environment, in this example, a data center600, where the tenants may share a single VPN gateway, to connect their respective remote networks to overlay networks. In the environment ofFIG. 6, a controlling entity, for example, the cloud service provider (CSP) executed one or more program440(FIG. 4) to configure and maintain a VPN Overlay Gateway696that the multiple tenants of the data center600(e.g., Tenant A and Tenant B) may utilize to access their respective virtual networks (e.g., VN1620, and VN2630, for Tenant A, and VN3650, for Tenant B). In an embodiment of the present invention, VPN Overlay Gateway696has at least two interface; VPN Overlay Gateway696is communicatively coupled to a data center physical underlay network610, and to an Internet-facing (and/or other public or shared) network, depicted inFIG. 6, as the Internet681. The data center facing side of the VPN Overlay Gateway696may utilize an underlying network, such as, in this non-limiting example, the underlying L3 virtual network640, to tunnel tenant frames to and from other network virtual environments (NVEs). The side of the gateway that faces the Internet681may use VPN to tunnel tenant IP packets to and from remote VPN peers.

In an embodiment of the present invention, VPN Overlay Gateway696, by interfacing with both the data center600and the remote tenant sites (i.e., remote VPN peers), can route packets from the sites to the appropriate virtual network resources within the data center600, and vice versa.

In an embodiment of the present invention, when the VPN Overlay Gateway696obtains an overlay encapsulated IP packet from a resource in the data center600, one or more program440(FIG. 4) at the VPN Overlay Gateway696decapsulates the packet, extracts the inner packet, and routes the inner packet through the appropriate VPN tunnel to the appropriate remote VPN peer. Conversely, after receiving an encrypted IP packet from a resource at its Internet-facing side, the VPN Overlay Gateway696decrypts the packet and then inserts the decrypted packet to appropriate VN to tunnel it to the appropriate NVE within the data center600.

As described in the context ofFIG. 6, the VPN Overlay Gateway696conducts packets received from a VPN tunnel to the proper virtual network (VN), and the VPN Overlay Gateway696conducts frames obtained from an NVE to the proper VPN tunnel. For ease of understanding, only, the functionality of the VPN Overlay Gateway is described as comprising three modules: an NVE Module, a Conductor Module, and a VPN Module. However, as understood by one of skill in the art, the implementation of the present invention is not limited by this description. This approach is utilized merely to assist in describing certain aspects of the invention with clarity.

FIGS. 7-8provide workflow diagrams of methods utilized by a VPN Overlay Gateway to route data from virtual tenant resources in a shared environment to remote tenant resources and vice versa. Specifically,FIG. 7depicts an example of the flow of data from virtual tenant resources in a shared environment to remote tenant networks andFIG. 8depicts the flow of data from remote tenant networks to the virtual tenant resources in a shared environment.FIG. 9provides additional detail into certain embodiments of the present invention by depicting certain elements of a proposed technical architecture. For clarity and consistency, both the workflows and the architecture overview denote one or more program440within the three modules performing certain aspects of the disclosed method.

FIG. 7depicts a workflow of an embodiment of the present invention where data is obtained from a tenant's virtual network in a shared environment and routed to that tenant's remote network.FIG. 8depicts a workflow of an embodiment of the present invention where data is obtained from a tenant's remote network and routed to the tenant's virtual network in the shared environment. Portions of the methods are illustrated with reference to the technical environment depicted inFIG. 9.

Referring toFIG. 7, one or more program440(FIG. 4) (e.g., in the NVE Module925) obtains a data from a virtual network of a tenant and an identifier of the tenant (710). In an embodiment of the present invention, the one or more program440obtains the data as a frame. In an embodiment of the present invention, when the program code obtains the data, which is a frame, the program code remove the header of the frame. In an embodiment of the present invention, the virtual network of the tenant is one of at least two virtual networks in a shared computing environment where the at least two virtual networks overlay a physical network. In an embodiment of the present invention, the identifier of the tenant is an origination point of the data, which is a logical connection point between the physical network and the virtual network.

Based on obtaining the identifier of the tenant, the program code sets the identifier in metadata related to the data (720) (e.g., in the Conductor Module915). For example, in an embodiment of the present invention where the program code removed an outer header leaving a packet, the program code sets the identifier in the metadata of the remaining packet. In an embodiment of the present invention, the program code determines whether the data utilizes an address resolution protocol (ARP). In this embodiment, the ARP module maintains an IP-MAC mapping table for each tenant, enabling the routing of the data utilizing this table, which will be described in greater detail later.

Based on the identifier in the metadata, the program code identifies a network connection associated with the tenant (730) (e.g., in the VPN Module905). In an embodiment of the present invention, the network connection is a VPN tunnel coupled to a remote network of the tenant. In an embodiment of the present invention, the network connection is a VPN tunnel over the Internet. In an embodiment of the present invention, the program code utilizes at least one field in the packet and the tenant identifier to identify the network connection.

The program code identifies a policy associated with the network connection and processes the data utilizing the policy (740).

In an embodiment of the present invention, the program code transmits the data through the identified network connection (750). In an embodiment of the present invention, the program code transmits a pre-processed packet through a VPN tunnel over the Internet. In an embodiment of the present invention, the VPN tunnel is coupled to a remote network of the network.

Referring now toFIG. 8, the program code obtains data from a network connection to a remote resource of a tenant (810) (e.g., in the VPN Module905) and a tenant identifier for the network connection. In an embodiment of the present invention, when obtaining the data, in a packet, the program code enforces a security policy of the network connection to decrypt the packet. In an embodiment of the present invention, the network connection is a VPN tunnel from a remote resource of a tenant.

Based on the tenant identifier for the network connection, the program code sets an identifier in metadata associated with the data (820). In an embodiment of the present invention, the data comprises a packet and the metadata is part of the packet.

The program code obtains the data and the identifier in metadata (e.g., the packet) and the program code matches the tenant identifier to a tenant of a shared computing environment (830) (e.g., in the Conductor Module915). In an embodiment of the present invention, the program code matches the identifier to a tenant using an entry in a tenant table913.

In an embodiment of the present invention, based on identifying the tenant, the program code inserts the data into an access virtual network of the tenant (840). In an embodiment of the present invention, the data is inserted through a logical connection point on a network virtualization edge coupled to the virtual network. In an embodiment of the present invention, the virtual network is coupled to a system of the tenant.

In an embodiment of the present invention, the data inserted into the virtual network is a frame. In this embodiment, the program code obtained the packet and reconstructed a header to create the frame. In an embodiment of the present invention, the program code reconstructed the header by utilizing the identifier in the metadata to setting a next hop MAC address as a destination MAC address and a pseudo MAC as a source MAC address. Based on setting these addresses, the program code inserted the frame into the access VN through the corresponding the logical connection point on the NVE, for connecting a tenant system to a VN.

Additional details of certain embodiments of the invention described inFIG. 7-8are described in the context ofFIG. 9. Referring toFIG. 9, an embodiment of the VPN Overlay Gateway996of the present invention. The VPN Overlay Gateway996comprises one or more program440(FIG. 4) and the one or more program440that can be described as three modules: a VPN Module905, a Conductor Module915, and an NVE Module925. This modular separation of the one or more program440is not limiting and offered only to lend clarity to this description. For ease of understanding, this disclosure will describe each module separately before discussing their combined functionality.

In an embodiment of the present invention, an NVE Module925is communicatively coupled to the physical underlay network910of the data center900, and the Conductor Module915. At this orientation, the NVE had two primary roles. First, the NVE Module925obtains data from resources in the shared environment and sends the data to the Conductor Module915in a manner that assists the Conductor Module915in determining which remote tenant environment should receive the data. Second, the NVE Module925obtains data from the Conductor Module915and routes it to the correct tenant virtual network and/or resource within the shared environment. Thus, the NVE Module925communicates with the underlay network910to route tenant data (e.g., tunnel tenant frames) to and from NVEs within the shared computing environment. The NVE Module925also communicates with the Conductor Module915to obtain data (e.g., Ethernet frames) from the Conductor Module915and to route this data to NVEs within the shared computing environment.

The NVE Module925aids in routing data from a tenant virtual resource within a shared computing environment to the remote network of that tenant, in part, by tracking the movement of the data in the data center900, i.e., where the data originated from so that one or more program440can associate the data with the correct tenant as the data moves through the system. For example, in an embodiment of the present invention, the NVE Module925may communicate with the Conductor Module915via a logical connection point on the NVE for connecting a tenant system to a virtual network. In a further embodiment of the present invention, the NVE Module925obtains data (e.g., a frame) and sets an access VN identifier in metadata associated with the data. Then, when the NVE Module925sends the data out of the virtual port, one or more program440(e.g., in the NVE Module925) sets the VN identifier in the metadata associated with the data. In a further embodiment of the present invention, the NVE Module925includes multiple internal/virtual ports through which it interacts with the Conductor Module915. In this embodiment, the one or more program440can identify a logical connection point on the NVE for connecting a tenant system to a VN through the local port identifier, as each port is designated as this type of logical connection for a specific VN, and by identifying the logical connection, the one or more program440can route the frame to a resource in the correct tenant's virtual environment, such as an NVE.

In an embodiment of the present invention, the Conductor Module915acts as an intermediary between the NVE Module925and the VPN Module905and routes data between them. In addition to tracking data using port identifiers, the NVE Module925may also employ a tenant table913to track data ownership, which the Conductor Module915can reference when routing packets between the VPN Module905and the NVE Module925, and vice versa. In an embodiment of the present invention, the NVE Module925makes an entry for each tenant of the data center900in the tenant table913. For example, the one or more program440may index each tenant of the shared environment in the tenant table913.

The one or more program440utilizes the described identifiers and identification methods to identify the origin of data, and therefore, the destination of data (e.g., frames and packets), by utilizing the metadata associated with the object. In an embodiment of the present invention, the tenant information includes an identifier of the VPN access VN, the default next hop IP address, and/or a local pseudo IP address with subnet mask. These identifiers aid the one or more program440in identifying the tenant associated with data and routing the data accordingly. The one or more program440may use the VPN access VN for egressing the packets from VPN tunnels to access the tenant overlay networks, the VNs. The access VN can connect to a L3 VN to yield interconnectivity with other VNs through routing. The one or more program440may utilize the next hop IP address to identify access point for the access VN. The one or more program440may use the local pseudo IP address as the next hop to reach to the external network at the other end of a VPN tunnel as a corresponding pseudo MAC address is accompanied with the pseudo IP address. If a tenant only employs 1 VN, that VN can be used as the access VN, and the next hop IP is not necessary in this case to identify the destination for the data. The next hop IP address in different tenant entry can be overlapped, as can the local pseudo IP address.

Returning toFIG. 9, in an embodiment of the present invention, the VPN Module905is communicatively coupled to both the Conductor Module915and to the tenants' remote locations, which it may access utilizing VPN tunneling and the Internet, (e.g., via VPN TunnelA992and VPN TunnelB994).

In an embodiment of the present invention, the VPN Module905is comprised of a VPN server that can handle data encryption, authentication, authorization and establishing secured tunnels with peers.

Like the NVE Module925, in an embodiment of the present invention, the VPN Module905also assists in tracking which tenant is associated with data that is being routed through a shared environment so that this data is ultimately routed to that tenant's virtual network in the shared environment. In an embodiment of the present invention, the VPN Module905obtains data from the tenants' remote networks via a secure connection on a public network, e.g., a VPN tunnel, such as VPN TunnelA992, over the Internet981, and associates a credential to authenticate a tenant identifier. After the VPN Module905establishes a tunnel, the program code associates the tunnel with the tenant identifier of a credential used for the authentication. Thus, when the VPN Module905processes an inbound packet from a remote peer, in addition to decrypting the packet, instead of going through an IP routing pipeline, as seen inFIG. 5, the one or more program440sets the tenant identifier in the packet's metadata to an identifier associated with the tunnel from which the program code in the VPN Module905obtained the packet, and passes the decrypted packet to Conductor Module915for further processing.

The VPN Module905also obtains packets from the Conductor Module915. In an embodiment of the present invention, upon obtaining data (e.g., a packet) from the Conductor Module915, based on identifying information in the data, including but not limited to, a tenant identifier in the metadata of a packet and/or other fields in a packet, the VPN Module905routes the data to a peer (e.g., via a tunnel to the peer's remote network) associated with the virtual network from which the NVE Module925originally obtained the data.

In an embodiment of the present invention, the VPN Module905comprises an IPsec VPN server. The VPN Module905may further comprise a Peer Authentication Database (PAD) and/or a Security Association Database (SAD). These databases include a field to hold a tenant identifier. To form an IPsec security association (SA), the VPN Module905sets the tenant ID to a corresponding PAD entry which is used for the authentication. The VPN Module905on the IPSec VPN server processes inbound packets and sets the tenant identifier of the IPsec SA to the metadata associated with the packet. This one or more program440then adds a tenant identifier selector in Security Policy Database (SPD), which enables overlapped IP address for different tenants.

In an embodiment of the present invention, the one or more program440in the VPN Module905may utilize SPD for outbound traffic. With the tenant identifier selector, the outbound packets of different tenants can match to their corresponding outbound SA without ambiguity and the VPN Module905can deliver the packets to the correct peers successfully.

Returning toFIG. 9, as aforementioned, the Conductor Module915is communicatively coupled to the VPN Module905and the NVE Module925. In an embodiment of the present invention, the Conductor Module915mediates between the NVE Module325and the VPN Module305to data between the virtual networks of various tenants and their respective VPN tunnels. In an embodiment of the present invention, conduct packets obtained from the VPN-facing side to the correct VN, the Conductor Module915conducts the frames received from its NVE-facing side, to the correct VPN tunnels.

In an embodiment of the present invention, the Conductor Module915may include an Address Resolution Protocol (ARP) sub-module. In this embodiment, upon obtaining a frame from the NVE Module925, the Conductor Module915, if it is an ARP packet, passes the packet to the ARP snooping sub-module912for further processing.

In a further embodiment of the present invention, the Conductor Module915sets the tenant identifier in the metadata associated with the frame if the NVE Module925has not done so and passes the frame to VPN Module905for further processing.

In a further embodiment of the present invention, to aid in routing packets, the ARP snooping sub-module912may monitor ARP packets and maintain an IP-MAC mapping table for each tenant access VN. The ARP snooping may also resolve the next hop IP address of a tenant entry to a corresponding MAC address by sending an ARP request to the next hop IP address through a logical connection point on the NVE for connecting a tenant system to a VN, for the VN associated with the frame. In an embodiment of the present invention, the ARP snooping sub-module912answers an ARP request to a local pseudo IP address with the pseudo MAC address. In this embodiment, the program code sends an ARP reply packet through the logical connection point for the VN, on which the initial request packet was received.

Upon receiving an IP packet from VPN Module905, the Conductor Module915may match a tenant identifier, for example, in the packet metadata, to an entry in a tenant table913. In an embodiment of the present invention one or more program440in the Conductor Module915reconstructs an L2 Ethernet header for an IP packet by setting an appropriate next hop MAC address as the destination MAC address and the pseudo MAC address as the source MAC address. Based on setting these addresses, the Conductor Module915inserts the frame into the access VN through the corresponding a logical connection point on the NVE for connecting a tenant system to a VN on the NVE Module925.