Source MAC access controls in a virtual redundant router protocol environment

In general, techniques provide a mapping of host devices to different virtual router identifiers used to identify the source MAC address used for forwarding packets to the participating host devices. For example, a method may include receiving an Address Resolution Protocol (ARP) request for a first Internet protocol (IP) address from a host device, the first IP address comprising a virtual IP address of the virtual router. The method may also include determining a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the first IP address. The method may further include generating a mapping between the host device and the determined VRID. The method may also include determining a virtual source MAC address of the virtual router based on the mapping and forwarding a second packet to the host device that specifies a virtual source MAC address for the second packet.

TECHNICAL FIELD

This disclosure relates generally to computer network routers, and more specifically to virtual routers executing according to virtual router redundancy protocol (VRRP).

BACKGROUND

Information is communicated over the Internet using packet switching technology, in which information is broken up into packets of data that are routed from a source to a destination, typically based on a destination Internet Protocol (IP) address. Routers and other machines in the network use routing protocols to ensure that data makes it from the source machine to the intended destination, which is then able to reassemble the packets to form the original information sent, such as an email, a movie, or a web page. Each router in the network maintains a routing table or other data structure, which includes information regarding the available routes to various network destinations. Routers execute routing protocols to dynamically update the routing tables of the routers. In general, a router executes routing protocols to discover information about the network topology around the router. Routing tables often also include metrics such as the distance associated with various routes, such as the number of hops and amount of time needed to communicate with a remote system over a certain network path.

After determining routes through a network, routers select certain routes to reach various destinations. In particular, a control plane of a router may select routes to reach various destinations that have shortest paths and/or lowest costs for reaching the destinations. The control plane then programs one or more forwarding tables of the router to include information indicating “next hops” along the corresponding selected route. The forwarding information of the forwarding tables map network destinations to interfaces of the corresponding router, such that forwarding units of the router can forward packets destined for the network destinations via the corresponding interfaces to reach the next hops.

In some cases, virtual routers, which are executed by one or more physical routers, perform routing and forwarding operations. In a more detailed example, a virtual router redundancy protocol (VRRP) is often used to specify a router group including a master virtual router, and one or more backup virtual routers on a different physical router operable to take over the master virtual router's routing tasks should the master virtual router fail. VRRP provides redundancy to routers within a local area network (LAN). VRRP allows a network to provide alternate router paths for a host without changing the IP address or MAC address with which the host associates its gateway. That is, the default gateway of a participating host is assigned to the virtual router instead of a physical router. A virtual router may be defined by its virtual router identifier (VRID) and IP addresses, and is also associated with a single virtual MAC address. This virtual MAC address may map to the VRRP virtual router ID.

In some cases, an enterprise may use MAC filtering to perform access control to the enterprise's network. MAC addresses can be used to uniquely identify a device in a broadcast domain and hence used to create a “black list” and “white list” to deny and permit access, respectively, to specific devices. These approaches to filtering can be effective in controlling network access in data centers and in closed wireless environments. MAC layer filtering may build access lists based on source or destination addresses in the MAC layer headers in the Ethernet/IEEE 802.3 frame.

SUMMARY

In general, the techniques provide a mapping of host devices to different virtual router identifiers used to identify the source MAC address used for forwarding packets to the participating host devices. For example, routers may provide an operating environment for virtual routers. The virtual routers may implement a Virtual Router Redundancy Protocol (VRRP) to provide dynamic failover of IP addresses from one router to another in the event of a failure. In a VRRP environment, the router may identify a grouping of host devices to the VRRP group identifier from Address Resolution Protocol (ARP) messages sent by host devices to the router. The router may extract a VRRP group identifier from a virtual MAC address corresponding to the virtual IP address contained in the ARP message. The router may use the extracted information to map the host devices to different virtual router identifiers. The router utilizes the mapping to determine the source MAC address used for forwarding packets to the host devices in a VRRP environment.

In one example, a method includes receiving, by a virtual router executing on a physical router, an Address Resolution Protocol (ARP) request for a first Internet protocol (IP) address from a host device, the first IP address comprising a virtual IP address of the virtual router. The method also includes determining, by the virtual router, a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the first IP address. The method also includes generating, by the virtual router, a mapping between an IP address of the host device and the determined VRID.

In another example, a network device includes a memory. The network device also includes one or more processors operably coupled to the memory, wherein the one or more processors are configured to execute a virtual router to: receive an Address Resolution Protocol (ARP) request for a first Internet protocol (IP) address from a host device, the first IP address comprising a virtual IP address of the virtual router; determine a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the first IP address; generate a mapping between an IP address of the host device and the determined VRID; and store the mapping in the memory.

In another example, a non-transitory computer-readable storage medium includes instructions for causing at least one programmable processor of a network device to execute a virtual router, wherein the instructions that cause the at least one programmable processor to execute the virtual router comprise instructions that cause the virtual router to: receive an Address Resolution Protocol (ARP) request for a first Internet protocol (IP) address from a host device, the first IP address comprising a virtual IP address of the virtual router; determine a virtual router redundancy protocol (VRRP) virtual router identifier (VRID) associated with the first IP address; and generate a mapping between an IP address of the host device and the determined VRID.

In this way, the techniques provide heuristically classifying host devices to different virtual router identifiers such that routers are able determine the source MAC address used for forwarding packets to the host devices.

The details of one or more aspects of the techniques are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the techniques of this disclosure will be apparent from the description and drawings, and from the claims.

Like reference characters denote like elements throughout the figures and text.

DETAILED DESCRIPTION

FIG. 1is a block diagram illustrating an example router network configuration, according to the techniques described herein. In the example ofFIG. 1, a first router101and a second router102operate within network100, and are coupled by a layer 2 (L2) switch103. Multiple routers are provided here for purposes such as redundancy, should one of the two routers fail, and for other purposes such as load balancing. The configuration of network100illustrated inFIG. 1is merely an example. For example, a router network configuration may include any number of routers. Nonetheless, for ease of description, only routers101and102are illustrated inFIG. 1.

Switch103provides L2 switching operations for network100. As shown inFIG. 1, switch103is connected by network connections to both routers101and102, and switches data from one device to another on a local area network (LAN). More specifically, switch103receives messages from any of network devices such as client devices105A-105N (“client devices105” or “hosts105”), and uses a media access control (MAC) address table104to send the messages to desired destination devices by switching the incoming messages to the correct port coupled to the destination device. More particularly, switch103learns the MAC address of the connected devices on the local area network, and sends incoming data out the port associated with the MAC address of the destination node.

The routers101and102are further coupled to a public network106, such as the Internet, and are operable to route data between client devices105and devices on the public network106.

Routers101and102may implement an Address Resolution Protocol (ARP) to provide mapping of a MAC address to an IP address. ARP dynamically binds the IP address (the logical address) to a MAC address (the physical or hardware address). A host105may broadcast an ARP request with an enclosed IP address to indicate a sender IP address to all devices. Devices typically receive the ARP request and compare their IP address with the enclosed IP address associated with the host. In response to a match of the IP address, the router may send an ARP response including its MAC address to the host. The host may then transmit a packet using the MAC address.

Routers101and102provide operating environments for one or more virtual routers, shown as107A-107N and108A-108N, respectively, which perform various routing and data forwarding functions as though each virtual router were a standalone router. For example, as shown, each of virtual routers107and108includes a virtual control plane and a virtual data plane, such as virtual routing and forwarding (VRF) components.

Each of virtual routers107and108may be associated with one another to form a group of redundant routers (e.g., with a common group IP address), each group having a master virtual router and one or more backup virtual routers, where the one or more backup virtual routers track the state of the associated master router in operation so that they are able to take over routing functions for the master virtual router of the group should the master virtual router fail. That is, the backup virtual routers typically do not perform routing functions, but track the state of the master router using a virtual router communications protocol.

In one example, router101provides an operating environment for one or more master virtual routers107, while router102provides an operating environment for one or more backup virtual routers108that take over in the event that router101fails. Similarly, router102may provide an operating environment for one or more master virtual routers108that are associated with one or more backup virtual routers107running on router101, so that if router102fails the virtual routers running thereon are taken over by associated backup virtual routers running on router101. In general, each master virtual router typically has a different network address (such as a media access control (MAC) address) than the one or more backup virtual routers, and performs the routing functions for the virtual router group. In the example ofFIG. 1, router101may provide an operating environment for one or more master virtual routers107to provide routing functions110for the virtual router group to client devices105. Similarly, router102may provide an operating environment for one or more master virtual routers108to provide routing functions111for the virtual router group to client devices105.

As shown in the example ofFIG. 1, control planes of virtual routers107and108execute a virtual router communications protocol to establish communication sessions (e.g. communication session109) between virtual routers for managing each group of redundant routers, including electing and assigning one master router and at least one backup router per router group. The virtual router communications protocol may, for example, provide certain functionality of the virtual router redundancy protocol (VRRP). VRRP may be implemented to provide a default path to a gateway without configuring the dynamic routing or router discovery protocols on client devices. For example, client devices105are configured with default gateway IP address of the virtual router group IP address. That is, the VRRP routing platforms share the IP address corresponding to the default route configured on the hosts. In this way, VRRP provides dynamic failover of IP addresses from one router to another in the event of a failure. In a VRRP environment, the master router uses the IP address of the physical interface of the router and forwards packets sent to its IP address. If the master router fails, the backup router with the highest priority becomes the master router and provides uninterrupted service for the host devices. Further examples of VRRP are described in RFC 5798—Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6, Proposed Standard, dated March 2010, which is incorporated by reference in its entirety.

In a VRRP environment, on a participating host or a server (e.g., client device105), source MAC filters are configured to allow the corresponding virtual MAC addresses associated with the gateway addresses to be used by the participating host or server. On the router side, the virtual MAC address is used as the source MAC address while forwarding the packets to the corresponding hosts in order to pass the filter. Thus, the virtual MAC address may be referred to as a virtual source MAC address.

A virtual router (e.g., virtual router107) is configured to use a virtual MAC address which is based on its corresponding Virtual Router IDentifier (VRID) (also referred to as VRRP group identifier), which is different for each virtual router in the network. For example, a virtual router can use a virtual MAC address having the format 00:00:5E:00:01:XX, where the last byte of the address (XX) is the virtual router's VRID. The virtual router assigns the VRRP group identifier to associate all interfaces as a group to provide redundancy for one another. The virtual router may reply with this virtual MAC address when a client device sends an ARP request for the virtual router's IP address.

As a result, a router may host multiple different virtual routers (VRIDs) and their corresponding different virtual MAC addresses. Conventionally, routers may not have any configuration or explicit mapping of which hosts use which virtual IP addresses that the router is hosting. Without the explicit mapping of hosts and virtual IP addresses, routers are unable to determine the virtual MAC address to be used when forwarding the packets to client devices. For example, router101may host two separate virtual routers107A and107B and may not have an explicit mapping that indicates client device105B is using a particular virtual MAC address for router101.

In accordance with the techniques of the disclosure, routers are configured to classify the hosts to different virtual router IDs to establish a mapping that can be used to identify the source MAC address that should be used when forwarding packets to the participating hosts or servers. For example, a router is configured to glean membership information from an ARP request sent by a host to the router. The router may identify ARP requests that are arriving for a particular virtual IP address and gleans the sender IP address from the ARP payload. Because a host may configure its default gateway as one of the virtual IP address of the router, the router may determine a virtual IP address associated with the host, that is, the IP address to which to address packets in order for the packets to be sent to the host.

The router may also extract a VRRP group identifier (an identifier for a group of virtual routers) from the virtual MAC address corresponding to the virtual IP address, which is contained in a target IP address field of the ARP message. Using the above information, the router is able to determine a grouping of hosts-to-VRRP group identifier. The router maintains these group memberships and dynamically updates the information in situations where the group membership changes. The router may then use this information to decide on a source MAC address on a packet that is forwarded to the participating hosts or servers.

In the example ofFIG. 1, router101may host multiple virtual routers with virtual router IDs 1 and 3 in a master mode (i.e., “MR vrid=1,3”) and with virtual IDs 2 and 4 in a backup mode (i.e., “BR vrid=2,4”). Similarly, router102may host virtual routers with virtual router IDs 2 and 4 in a master mode (i.e., “MR vrid=2,4”) and with virtual router IDs 1 and 3 in a backup mode (i.e., “BR vrid=1,3”). Hosts105A and105B are configured to have their default gateway as one of the virtual IP addresses of router101, namely, IP A and IP C, respectively, and hosts105C and105D are configured to have their default gateway as one of the virtual IP addresses of router102, namely IP B and IP D, respectively.

In operation, when host105A sends out an ARP request for IP A, the request is received by both routers101and102. Routers101and102may extract the VRRP group ID (VRID 1) from the virtual MAC address corresponding to the target address (i.e., IP A) and map host105A to group ID 1. Once the ARP requests are processed, routers101(and102) may have the host-to-group mapping formed (i.e., group ID 1→host105A; group ID 3→host105B; group ID 2→host105C; group ID 4→host105D), which can be used for inserting the proper source MAC address in the packets forwarded to the hosts. On routers with separate forwarding planes, the “nexthop” of the route pointing to a host address can be programmed with the source MAC address based on a group's membership which could be used for forwarding the packets with appropriate MAC addresses. For example, when a virtual router107,108receives a packet to be forwarded to a host105, the router determines the virtual source MAC address to be specified in the source MAC address field of the packet header based on the mapping. That is, the mapping can allow a router to encapsulate and send packets with the correct source MAC address that will be properly filtered by access control lists. Accordingly, firewall or switches that sit between the hosts105and routers101,102can be configured to have Layer 2 (L2) access control lists as allowing packets with particular source MAC addresses as virtual MAC addresses for access control.

FIG. 2is a block diagram illustrating an example router according to techniques described herein. Router200is an example of router101ofFIG. 1, but may be any router. Router200includes a control unit236having a routing engine238, and control unit236is coupled to forwarding engine230. Forwarding engine230is associated with one or more interface cards232A-232N (“IFCs232”) that receive packets via inbound links258A-258N (“inbound links258”) and send packets via outbound links260A-260N (“outbound links260”). IFCs232are typically coupled to links258,260via a number of interface ports (not shown). Inbound links258and outbound links260may represent physical interfaces, logical interfaces, or some combination thereof.

Elements of control unit236and forwarding engine230may be implemented solely in software, or hardware, or may be implemented as combinations of software, hardware, or firmware. For example, control unit236may include one or more processors, one or more microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or any other equivalent integrated or discrete logic circuitry, or any combination thereof, which execute software instructions. In that case, the various software modules of control unit236may comprise executable instructions stored, embodied, or encoded in a computer-readable medium, such as a computer-readable storage medium, containing instructions. Instructions embedded or encoded in a computer-readable medium may cause a programmable processor, or other processor, to perform the method, e.g., when the instructions are executed. Computer-readable storage media may include random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM), non-volatile random access memory (NVRAM), flash memory, a hard disk, a CD-ROM, a floppy disk, a cassette, a solid state drive, magnetic media, optical media, or other computer-readable media. Computer-readable media may be encoded with instructions corresponding to various aspects of PE device200, e.g., protocols, processes, and modules. Control unit236, in some examples, retrieves and executes the instructions from memory for these aspects.

Routing engine238includes kernel243, which provides a run-time operating environment for user-level processes. Kernel243may represent, for example, a UNIX operating system derivative such as Linux or Berkeley Software Distribution (BSD). Kernel243offers libraries and drivers by which user-level processes may interact with the underlying system. Kernel243supports other software elements including elements executing as part of one or more virtual routers. For example, kernel243supports router management functions such as a routing protocol daemon253that is operable to perform tasks such as managing routing tables254by updating the routing table with newly learned routes, and providing forwarding information256for forwarding packets.

Hardware environment255of routing engine238includes microprocessor257that executes program instructions loaded into a main memory (not shown inFIG. 2) from a storage device (also not shown inFIG. 2) in order to execute the software stack, including both kernel243and processes executing on the operating environment provided by kernel243. Microprocessor257may represent one or more general or special-purpose processors such as a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or any other equivalent logic device. Accordingly, the terms “processor” or “controller,” as used herein, may refer to any one or more of the foregoing structures or any other structure operable to perform techniques described herein.

Kernel243provides an operating environment that executes various protocols244at different layers of a network stack, including protocols for implementing Address Resolution Protocol (ARP)246and Virtual Router Redundancy Protocol (VRRP)247. For example, routing engine238implements ARP246that operates at a link layer of the network stack to process ARP requests. Routing engine238also implements VRRP247that specifies an election protocol that dynamically assigns responsibility for a virtual router to one of the VRRP routers on a LAN. Although illustrated with ARP246and VRRP247, routing engine238may include other protocols not shown inFIG. 2.

Routing engine238is responsible for the maintenance of routing information242to reflect the current topology of a network and other network entities to which router200is connected. In particular, routing engine238may update routing information242to reflect the current topology of the network and other entities based on the mapping of hosts and virtual IP addresses by router200.

Kernel243may maintain one or more Address Resolution Protocol (ARP) tables251(also referred to as ARP caches). ARP tables251represents a data structure storing a plurality of address resolution entries each including a VRRP group ID from the virtual MAC address that to the target IP address in the ARP request message. The address resolution entries may also include a sender IP address representing the host that sent the ARP request message.

Forwarding engines230represent hardware and logic functions that provide high-speed forwarding of network traffic. Forwarding engines230typically includes a set of one or more forwarding chips programmed with forwarding information that maps network destinations with specific next hops and the corresponding output interface ports. In general, when PE device200receives a packet via one of inbound links258, one of forwarding engines230identifies an associated next hop for the data packet by traversing the programmed forwarding information based on information within the packet. Forwarding engines230forwards the packet on one of outbound links260mapped to the corresponding next hop. In accordance with the techniques described in this disclosure, kernel243may generate forwarding information256to include representations of information stored to ARP tables251in the form of forwarding information for optimized forwarding by forwarding engines30. For example, router200may determine a mapping of hosts-to-VRRP group identifier and store these group memberships in mapping table262of forwarding information256. Forwarding engine230may use the mapping information of mapping table262to update header information of a packet. That is, forwarding engine230may replace a source MAC address252of a packet destined for a host based on the VRRP group to which the host is mapped.

In the example ofFIG. 2, forwarding engine230includes forwarding information256having virtual MAC addresses252determined from the mapping of host devices to the VRRP group identifier. In accordance with routing information242, forwarding engine230stores forwarding information256that maps packet field values to network destinations with specific next hops and corresponding outbound interface ports. For example, routing engine238analyzes routing information242and generates forwarding information256to forward packets using virtual source MAC addresses252. Forwarding information256may be maintained in the form of one or more tables, link lists, radix trees, databases, flat files, or any other data structures.

Routing engine238includes a configuration interface241that receives and may report configuration data for router200. Configuration interface241may represent a command line interface; a graphical user interface; Simple Network Management Protocol (SNMP), Netconf, or another configuration protocol; or some combination of the above in some examples. Configuration interface241receives configuration data configuring the router200and other constructs that at least partially define the operations for router200. For example, an administrator may use configuration interface241to configure the VRRP group ID, the master router, the backup router, MAC source address filtering, etc. for router200.

Routing engine238also includes a mapping module261to glean membership information of hosts and virtual routers from ARP request messages received from the host devices. The mapping module261may determine from a received ARP request a sender IP address of the host device from the ARP payload. Mapping module261may also extract a VRRP group identifier (an identifier for a group of virtual routers) from the virtual MAC address corresponding to the virtual IP address, which is contained in a target IP address field of the ARP message. Using the above information, mapping module261is able to determine a grouping of hosts-to-VRRP group identifier. Router200maintains these group memberships and dynamically updates the information in situations where the group membership changes. Router200may then use this information to decide on a source MAC address on a packet that is to be forwarded to the participating hosts or servers.

FIG. 3is a flowchart illustrating an example operation of a router for mapping hosts to virtual IP addresses that can be used to identify the source MAC address used while forwarding packets to the participating hosts or servers, according to techniques described herein. Operation300is described with respect to virtual router107A of physical router101ofFIG. 1, but may be performed by any virtual router. In some examples, physical router101, operating as a virtual router (e.g., virtual router107A), may receive an Address Resolution Protocol (ARP) request message for a first Internet protocol (IP) address from a host device, e.g., client device105A (302). For example, host105A may configure its default gateway address as the virtual IP address of router101, e.g., IP A. Host105A may send an ARP request for IP A. Virtual router107A may receive the ARP request message that may include a first IP address representing the default gateway address that was configured as one of the virtual IP addresses of router101.

Virtual router107A of router101may determine a VRRP virtual router identifier (VRID) associated with the first IP address (304). As described above, virtual router107may extract the VRRP VRID from a virtual MAC address included in the target IP address (e.g., IP A) field of the received ARP request. In some examples, the virtual router107A may determine from the received ARP request a sender IP address specifying an IP address of the host device.

Based on the extracted information, virtual router107A may generate a mapping between the host device and the determined VRID (306). For example, virtual router107A may map an IP address of the host device that sent the ARP request, e.g., host105A, to the VRID associated with virtual router107A. Physical router101may perform similar processes for each of hosts105as hosts105send ARP requests to physical router101. Thus, multiple hosts105may be mapped to the same VRID, e.g., associated with virtual router107A. Router200may store the mapping in memory (308).

FIG. 4is a flowchart illustrating an example operation of a router for forwarding packets to a host device with a determined virtual source MAC address as a source MAC address for the packet, according to the techniques described herein. Operation400is described with respect to virtual router107A of physical router101ofFIG. 1, but may be performed by any virtual router. In some examples, operation400provides additional operation to operation300ofFIG. 3.

In some examples, physical router101, operating as a virtual router (e.g., virtual router107A), may receive a packet including a destination IP address field specifying an IP address of a host device (e.g., host device105A) that sent the packet (402). Virtual router107A may determine the destination IP address from the received packet that corresponds to the host device (404).

Virtual router107A of router101may determine a VRRP group identifier (VRID) to which the destination IP address is mapped (406). As described above, virtual router107may extract the VRRP VRID from a virtual MAC address included in the target IP address (e.g., IP A) field of a received ARP request.

Virtual router107A may determine a virtual source MAC address of the virtual router based on the mapping between the host device and the determined VRID (408). For example, virtual router107A may determine the VRID associated with the IP address of the host device based on the mapping. Virtual router107A may also determine based on the mapping the virtual source MAC address comprising a pre-determined byte address prefix and the VRID in a last byte of the virtual source MAC address.

Virtual router107A may forward a packet to the host device that specifies the determined virtual source MAC address as a source MAC address for the packet (410). For example, the router may configure the “nexthop” pointing to the host address with the source MAC address based on the mapping of host105A and the VRID associated with virtual router107A. When virtual router107A receives a packet to be forwarded to host105A, router107A determines the virtual source MAC address that is to be specified in the source MAC address field of the packet header based on the mapping. That is, virtual router107A may update a source MAC address field of the data packet to specify the virtual source MAC address such that the packet will be properly filtered by access control lists.

Various aspects of the techniques have been described. These and other aspects are within the scope of the following claims.