Preventing loops on network topologies built with virtual switches and VMS

A method and apparatus is disclosed for preventing loops on a network topology which includes virtual switches and virtual machines. For example, a virtualization management application may prevent loops from being introduced into a network topology where a virtual machine forwards traffic between any two (or more) virtual network interface cards (vNICs). A method to prevent loops may include receiving a request to create a virtual network interface (vNIC) for a virtual machine (VM) instance on a computing system, and in response to determining that the requested vNIC is to be connected to the same network segment as an existing vNIC of the VM instance, failing the request to generate the requested vNIC.

TECHNICAL FIELD

Embodiments described in this disclosure generally relate to virtualized computer networks. More particularly, described embodiments relate to methods and apparatus for preventing loops on network topologies built with virtual switches and virtual machines.

BACKGROUND

Computer virtualization techniques provide a rich set of networking capabilities that integrate well with sophisticated enterprise networks. Virtual networking allows users to network virtual machines in the same manner as physical machines. Thus, users can build complex networks within a single physical server host or across multiple server hosts. Virtual switches allow virtual machines on the same server host to communicate with each other using the same protocols used over physical switches, without the need for additional networking hardware. Further, virtual switches support virtual LANs (VLANs) that are compatible with standard VLAN implementations from a variety of networking and virtualization vendors. A virtual machine can be configured with one or more virtual Ethernet adapters (vNIC), each of which each has its own MAC address. As a result, virtual machines have properties similar to those of physical machines, from a networking standpoint. In addition, virtual networks enable functionality not possible with physical networks.

Thus, virtual server environments use software based virtual switches inside a virtual server to enable communication among the virtual machines (VM) as well as between VMs and the outside world. The virtual switches are typically designed to not introduce loops in the network. They achieve this result without using a spanning-tree protocol; instead virtual switches use a combination of pinning VMs to a given physical NIC (MAC pinning) and a distance vector logic whereby a frame received by a virtual switch coming from outside into the physical server is not forwarded back to another physical NIC. This approach, however, assumes that the VMs operate as a computing node or an end-point destination and not as a networking node (e.g., a firewall or other networking appliance).

DESCRIPTION

Overview

Embodiments of the present disclosure provide techniques to prevent loops on network topologies which include virtual switches and virtual machines. For example, embodiments described herein protect against loops being introduced into a network topology where a virtual machine forwards traffic between any two (or more) virtual network interface cards (vNICs). One embodiment described herein includes a method for preventing loops on network topologies built with virtual switches and virtual machines. The method may generally include receiving a request to create a vNIC for a VM instance on a computing system. In response to determining that the VM instance does not include an existing vNIC, the requested vNIC is created. Otherwise, in response to determining that the VM instance includes one or more existing vNICs, the method includes determining whether the requested vNIC is to be connected to a same network segment as one of the existing vNICs of the VM instance. In response to determining that the requested vNIC is to be connected to the same network segment as one of existing vNICs of the VM instance, the request to generate the requested vNIC is failed.

In a particular embodiment, the VM instance operates as a networking appliance to bridge a first virtual local area network (VLAN) segment and a second VLAN segment. For example, the VM instance may operate as a layer 2 firewall appliance. Further, the request to create the vNIC may be associated with a request to create the VM instance. Alternatively, the request to create the vNIC may be received as a request to add the vNIC to an instantiated VM instance.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Embodiments of the present disclosure provide techniques to prevent loops on network topologies which include virtual switches and virtual machines. For example, embodiments described herein protect against loops being introduced into a network topology where a virtual machine forwards traffic between any two (or more) virtual network interface cards (vNICs). That is, where the virtual machine does not operate in the end-host, but acts as a network appliance. For example, the virtual machine may operate as a firewall connecting an untrusted VLAN segment to a trusted one. In such a case, one vNIC may connect the VM (operating as the firewall) to the untrusted segment and a second vNIC may connect it to the trusted segment.

When a second physical connection between a end-host or a network appliance and layer 2 segment increases the network bandwidth available to the host/appliance as well as allows for load balancing and redundancy. Further, in such a case, the physical network hardware may be configured to use a spanning tree protocol to cut loops in the network topology. In contrast, adding a second vNIC to a VM does not provide additional bandwidth or redundancy between that VM and a given VLAN segment. Further, spanning tree does not prevent loops when a host (regardless of whether the host is a physical server or a virtual machine) forwards traffic between two physical (or virtual) NICs. This occurs because hosts do not typically forward Bridge Protocol Data Units (BPDUs) and spanning tree protocol (STP) relies on BPDUs to ensure a loop-free topology for bridged LANs. Further, virtual switch implementations do not typically perform the spanning tree protocol because of how taxing spanning tree is on a host (server) control plane. As a result, spanning tree protocol does not prevent loops where a VM forwards Layer 2 traffic to two (or more) virtual network adapters connected to the same VLAN.

In one embodiment, a hypervisor managing multiple virtual machine (VM) instances on a computer system may be configured to prevent an instance of a virtual machine from being created with multiple vNICs connected to the same VLAN segment. Similarly, the hypervisor may prevent a vNIC from being added to an existing VM (or a vNIC configuration from being modified) where doing so results in multiple connections to the same VLAN segment. This may include preventing multiple vNICs from being connected to the same VLAN where the VLAN is presented to virtual machines using two or more distinct port-group names (which may lead an administrator to conclude that the VM is actually connecting to different VLANs).

This disclosure references various embodiments. However, it should be understood that this disclosure is not limited to embodiments described herein. Instead, any combination of the following features and elements, whether related to different embodiments or not, is contemplated to implement and practice an embodiment. Furthermore, in various embodiments, embodiments provide numerous advantages over the prior art. However, although embodiments may achieve advantages over other possible solutions and/or over the prior art, whether or not a particular advantage is achieved by a given embodiment is not limiting. Thus, the following aspects, features, embodiments and advantages are merely illustrative and are not considered elements or limitations of the appended claims except where explicitly recited in a claim

Additionally, application programs disclosed herein may be distributed on a variety of computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive) on which information is permanently stored; (ii) writable storage media (e.g., floppy disks within a diskette drive or hard-disk drive) on which alterable information is stored. For example, as described herein, one embodiment includes a computer-readable storage medium containing a program, which when executed on a processor is configured to perform an operation for preventing loops on network topologies built with virtual switches and virtual machines. Other media include communications media through which information is conveyed to a computer, such as through a computer or telephone network, including wireless communications networks.

FIG. 1is a block diagram illustrating a computer system120hosting multiple virtual machines130, according to one embodiment. As shown, the computer system120generally includes system hardware150, such as one or more network interface cards (NICs)151, a memory152, CPU(s)153and a storage device154. The hypervisor140, also known as a virtual machine monitor (VMM), generally runs over the system hardware150and allows the system hardware150to host multiple virtual machines130(sometimes referred to as guest systems). A cache155provides a high-speed memory accessed by the CPU153. While memory152can be segmented across virtual machines130, cache155is often shared, i.e., each virtual machine may be have a more-or-less dedicated partition of memory152(mapping to virtual memory132).

In one embodiment, the hypervisor140may be implemented as a software layer that runs directly on the system hardware150where an OS kernel143intercepts some, or all, operating system calls to the system hardware150. In some embodiments, the hypervisor140virtualizes CPU153and memory152, while a single privileged guest virtual machine manages and virtualizes network traffic and storage I/O. That is, the host (one of the virtual machines130) is also tasked with performing as a management system for some aspects of the virtualized system. The host generally runs using a specially privileged kernel (OS135) that can access system hardware150and can create/modify/destroy virtual machines130.

Illustratively, the hypervisor140includes a management application141, a virtual switch142and an operating system kernel143. The management application141may allow users to create and manage instances of the virtual machines130. As part of creating a VM instance, the user may specify a configuration for the virtual CPU133, virtual memory132and virtual storage134. Further, the user may specify networking components (e.g., one or more vNICs131) to include in a VM instance, as well as network configuration settings for the VM instance, e.g., an IP address, an Ethernet MAC address, as well as specify a network configuration, e.g., a connection between a given vNIC131and a virtual switch142. In turn, the virtual switch142may act as a networking device for multiple VM instances130, allowing network traffic to flow from an application136executing on one of the virtual machines130to another using the same network protocols that would be used if such applications were executing on distinct physical machines and connected to a physical switch.

As shown, virtualization allows multiple virtual machines130to run simultaneously on the computer system120, sharing the system hardware150. However, the virtual machines130are not generally aware of the system hardware150directly. Instead, the hypervisor140provides a collection of virtual hardware for each virtual machine130. As shown inFIG. 1, e.g., each virtual machine includes a virtual CPU133, a virtual memory132, one or more virtual network interfaces131and virtual storage134. Similarly, each virtual machine130runs an operating system (OS)135on the virtual hardware (131-134) exposed by the hypervisor140. Together, the virtual hardware (131-134) and operating system136provide a virtualized computing platform for applications136. Note, while these virtual hardware allocations appear distinct to the OS135and applications136running on each virtual machine130, often they are either shared or contend for some shared resource below the virtualization layer. That is, the virtual resources provide an abstraction for the underlying physical resources—and the underlying physical resources are shared among the virtual machines130.

Additionally, in one embodiment, one of the applications136may be a network application or appliance (e.g., a firewall) configured to evaluate and forward layer 2 network traffic (e.g., Ethernet frames). In such a case, traffic received over one vNIC131may be forwarded back towards virtual switch142over another vNIC131. Further, a management application141running as part of the hypervisor140may be configured to prevent a configuration for such a virtual machine130where multiple vNICs131are connected to the same VLAN segment.

FIG. 2illustrates an example network topology within a computer system hosting multiple virtual machines, according to one embodiment. In this example, four virtual machines1301-4have been instantiated on computer system120and each is running an operating system (OS)1351-4and applications1361-4. Additionally, each virtual machine1301-4includes one or more virtual NIC (vNICs)131. For example, vNIC1311connects virtual machine1301to virtual switch1421. Similarly, vNIC1312connects virtual machine1302to virtual switch1421. Virtual switch1421also includes a connection to two physical NICs1511-2, linking virtual switch1421with VLAN segment205. That is, physical NICs1511-2bridge the connection between the virtual network topology within the computer system120and a physical network infrastructure (i.e., with VLAN segment205).

Virtual machine1302also includes vNIC1313, connecting it to virtual switch1422and physical NIC1513. In turn, NIC1513is connected to VLAN segment210. Illustratively, virtual machine1303also includes two vNICS1304-5. The vNIC1314connects virtual machine1303to virtual switch1422and vNIC1315connects virtual machine1304to virtual switch1423. Lastly, virtual machine1304includes a vNIC1316connecting it to virtual switch142, itself connected to physical NIC1514(and VLAN segment215).

For this example, assume that the application1362on virtual machine1302is a firewall configured to permit certain traffic received over vNIC1312(from virtual switch1421and VLAN segment205) to be forwarded out over vNIC1313towards VLAN segment210. That is, application1362acts as a network bridge between VLAN segment205and VLAN segment210. Note, while the virtual machine1302includes two vNICS (1312-3), each is connected to a distinct VLAN (i.e., VLAN segments205and210). Thus, no loops are present in the network topology shown inFIG. 2. In contrast,FIGS. 3A-3Cillustrate an example of a network topology built with virtual switches and virtual machines which may result in looping network frames, according to one embodiment. The network topology shown inFIGS. 3A-3Ccorresponds to the network topology ofFIG. 2. However, the configuration of virtual machine1302is modified to include two vNICs connecting this VM to switch1421—represented inFIGS. 3A-3Cas links310and315.

FIG. 3Ashows virtual machine1301forwarding a MAC broadcast frame305towards virtual switch1421. As noted, virtual machine1302includes two links310,315to virtual switch1421. Assume each link310,315is the result of a vNIC created for virtual machine1302and that an application running on virtual machine1302acts as a network bridge passing layer 2 frames between VLAN205and VLAN210(e.g., a firewall).

FIG. 3Bshows virtual switch1421forwarding frame320towards virtual machine1302. One of ordinary skill in the art will recognize that virtual switch1421may forward a broadcast frame over both links310and315. However, for simplicity, frame320is shown being sent over link315. Once received, virtual machine1302, may forward the broadcast frame over each available network link.

This result is shown inFIG. 3C. As shown, the virtual machine1302forwards broadcast a frame330towards virtual switch1422. However, because link310is distinct from link315, virtual machine1302also forwards a frame325towards virtual switch1421over link310. Frame325completes the loop in this example because, once received by virtual switch1421, the frame is forwarded a second time back towards virtual machine1302. From here, the network simply loops between the state shown inFIG. 3B(where frame320is sent from virtual switch1421to virtual machine1302) andFIG. 3C(where frame325is sent from virtual machine1302to virtual switch1421). Further, because Layer 2 frames do not include any time-to-live (TTL) parameters, the loop just continues indefinitely. Further still, each additional broadcast (or multicast) frame are forwarded towards virtual machine1302results in another looping frame in this example network topology.

FIG. 4illustrates a method400for preventing loops on network topologies built with virtual switches and virtual machines, according to one embodiment. As shown, the method400begins at step405where the VM management application receives a request to create (or add) a virtual network interface (vNIC) to a virtual machine (VM). For example, a user may be defining a new VM instance to spawn on a virtualized system. In such a case, the user may specify what virtual hardware elements to create for the virtual machine instance (e.g., processor, memory, block storage devices) as well as one or more vNICs. The user may also specify a network configuration for a VM instance, e.g., an IP address and Ethernet MAC address, as well as specify a configuration between a given vNIC131and a virtual switch142(or a mapping between a vNIC and a physical NIC connected to a VLAN). Alternatively, a user may request to modify the configuration of a virtual machine to add a vNIC to a VM instance (or modify an existing vNIC configuration).

At step410, the management application may determine whether the VM instance already includes a vNIC. If not, then at step415the requested vNIC is created. Otherwise, at step420, the management application may determine whether the requested vNIC includes a connection to the same VLAN as an existing vNIC. For example, the management application may evaluate the network topology of the existing vNICs in a VM to identify what network segments (e.g., what VLAN segment) each vNIC is attached to. If the requested vNIC does not connect to the same network segment as any existing vNIC, then at step415, the management application creates the requested vNIC. Otherwise, if the user has requested a network configuration resulting in two vNIC connections to the same network segment, then at step325, the management application may fail the request to generate a vNIC. Further, in one embodiment, the management application may generate an error message to inform the user that the requested vNIC would result in a network topology prone to looping frames at the Layer 2 level.

Thus, as described, loops may be prevented on network topologies which include virtual switches and virtual machines. For example, loops may be prevented from being introduced into a network topology where a virtual machine forwards traffic between any two (or more) virtual network interface cards (vNICs). That is, where the virtual machine does not operate as an end-host, but acts as a network appliance or bridge between network subnets (e.g., bridging two VLAN segments).