Abstract:
Systems and methods for differentiating between a duplicate MAC address situation and a multiple MAC address movement situation are provided. A node receives a new MAC address determines if it is a known or unknown MAC address by comparing it with a stored MAC address table. If it is a previously known MAC address, the node initiates a duplicate MAC address detection process to determine if at least one of the duplicate MAC addresses is no longer valid or is the result of a MAC mobility event.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
       [0001]    This application claims the benefit of U.S. Provisional Application No. 61/836,406 filed on Jun. 18, 2013 the contents of which are hereby incorporated by reference. 
     
    
     TECHNICAL FIELD  
       [0002]    This disclosure relates generally to generally relate to telecommunications and more specifically to techniques for detecting duplicate Media Access Control (MAC) addresses. 
       BACKGROUND  
       [0003]    The telecommunications industry is working on network virtualization solutions. One of the network virtualization solutions, named Ethernet Virtual Private Network (E-VPN), is under discussion in standardization organizations. As discussed in Internet Engineering Task Force (IETF) drafts “BGP MPLS Based Ethernet VPN” draft-ietf-12vpn-evpn and “Requirements for Ethernet VPN (E-VPN)” draft-ietf-12vpn-evpn-req, E-VPN requires extensions to the existing Internet Protocol (IP) and Multiprotocol Label Switching (MPLS) protocols. In addition to these extensions, E-VPN uses several building blocks from existing MPLS technologies. 
         [0004]      FIG. 1  shows an overview of a Border Gateway Protocol (BGP) MPLS based E-VPN network  100 . Provider Edge (PE) routers  102   a  and  102   b  are shown at the edge of a service provider&#39;s network  104  in communication with Customer Edge (CE) routers  106   a  and  106   b  in various customer networks  108  and  110 . The service provider network  104  can also include Provider routers  112   a,    112   b,    112   c  and the customer networks  1108  and  110  can include customer routers  114   a,    114   b.  According to the IETF drafts referenced above, Media Access Control (MAC) address learning between PEs can occur in the control plane using multi-protocol (MP) BGP. 
         [0005]    In MAC address learning, the source MAC address of each received packet is stored in a MAC address table so that future packets destined for that address can be forwarded only to the interface (e.g. port number) where that address is located. 
         [0006]    In E-VPN, a PE (e.g.  102   a ) will advertise the MAC addresses learned from the CEs (e.g.  106   a ) that are connected to them, along with an MPLS label, to other PEs (e.g.  102   b ) in the control plane using MP-BGP. However, learning between PEs and CEs can be done by whatever method is best suited to the CE, which can include data plane learning, IEEE 802.1x, Link Layer Discovery Protocol (LLDP), 802.1aq, Address Resolution Protocol (ARP), management plane or other protocols. 
         [0007]    There are two scenarios for MAC address learning—MAC address learning for a new virtual machine (VM) and MAC mobility. 
         [0008]    When a new VM is started in a CE, a new MAC address is allocated for that VM. The PE in a particular E-VPN learns the new VM MAC address via data plane learning or control signaling, such as Dynamic Host Configuration Protocol (DHCP) requests. The PE then constructs a BGP E-VPN MAC address advertisement message to advertise these MAC addresses using the MAC Advertisement route type in the E-VPN Network Layer Reachability Information (NLRI) to its peer PEs. Upon receiving the MAC Advertisement, a peer PE shall update its stored MAC address forwarding table accordingly. There is a possibility that a duplicate MAC address can be allocated to a new VM belonging to the same VLAN, but in different Ethernet segments, if there is no centralized MAC address management function in the network. 
         [0009]    Alternatively, it is possible for a given host or VM (as defined by its MAC address) to move from one Ethernet segment to another. This is referred to as “MAC Mobility” or a “MAC move”. In a MAC move, there would be two sets of MAC Advertisement routes, one set with the new Ethernet segment and one set with the previous Ethernet segment, and the MAC address would appear to be reachable via each of these segments. In this case, the MAC Advertisement routes with the previous Ethernet segment should be withdrawn. There is a possibility that a given MAC address may move between two Ethernet segments multiple times within a short time period, in which case there may be multiple withdrawals and re-advertisements. 
         [0010]    In both of the above described cases, there is a potential issue referred to as a MAC address duplication situation. The situation may arise where the same MAC address is learned by different PEs in the same VLAN because of two (or more hosts) being mis-configured with the same, duplicate MAC address. In this situation, the traffic originating from these hosts would trigger continuous MAC moves among the PEs attached to these hosts, which will be detected as the multiple movements. The related situation is that such a “duplicate” MAC address may be detected due to multiple MAC movements. 
         [0011]    Therefore, it would be desirable to provide a system and method that obviate or mitigate the above described problems. 
       SUMMARY  
       [0012]    In a first aspect of the present invention, there is provided a method for verifying a duplicate Media Access Control (MAC) address, performed by a network node. The method comprises the steps of receiving a first MAC address through a MAC address learning mechanism; determining that the first MAC address matches a second MAC address stored in a MAC address table, the second MAC address having been previously learned; attempting to reach both the first MAC address and the second MAC address; and responsive to receiving acknowledgement that the first MAC address and the second MAC address are both reachable, re-attempting to reach both the first MAC address and the second MAC address. 
         [0013]    In an embodiment of the first aspect, the network node can wait a predetermined period of time prior to re-attempting to reach both the first MAC address and the second MAC address. In another embodiment, the network node can re-attempt to reach both the first MAC address and the second MAC address without reporting a duplicate MAC address situation. 
         [0014]    In another embodiment, it can be determined that the first MAC address is not a duplicate MAC address in response to receiving an indication that the second MAC address was not reachable. The MAC address table can be updated by removing the second MAC address from the table and adding the first MAC address to the table. 
         [0015]    In another embodiment, it can be determined that the first MAC address is a duplicate MAC address in response to receiving an indication that the second MAC address was reachable. The duplicate MAC address can be reported to a network management system. 
         [0016]    In another embodiment, the network node can attempt to reach the first MAC address by transmitting an instruction to a peer node to attempt to reach the first MAC address. 
         [0017]    In a second aspect of the present invention, there is provided a network node comprising a processor and a memory, the memory containing instructions executable by the processor whereby the network node is operative to receive, at a communication interface, a first Media Access Control (MAC) address through a MAC address learning mechanism; determine that the first MAC address matches a second MAC address stored in a MAC address table, the second MAC address having been previously learned; attempt to reach both the first MAC address and the second MAC address; and responsive to receiving acknowledgement that the first MAC address and the second MAC address are both reachable, re-attempt to reach both the first MAC address and the second MAC address. 
         [0018]    Other aspects and features of the present invention will become apparent to those ordinarily skilled in the art upon review of the following description of specific embodiments of the invention in conjunction with the accompanying figures. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS  
         [0019]    Embodiments of the present invention will now be described, by way of example only, with reference to the attached Figures, wherein: 
           [0020]      FIG. 1  is a prior art BGP MPLS based E-VPN network; 
           [0021]      FIG. 2  is a block diagram of an example network architecture; 
           [0022]      FIG. 3  is a flow chart illustrating a method for detecting a duplicate MAC address situation; 
           [0023]      FIG. 4   a  is a flow chart illustrating a method for initiating a duplicate MAC address detection process at a locally connected node; 
           [0024]      FIG. 4   b  is a flow chart illustrating a method for initiating a duplicate MAC address detection process at a peer node; 
           [0025]      FIG. 5  is a flow chart illustrating a method for verifying a duplicate MAC address; 
           [0026]      FIG. 6  is a block diagram illustrating an example network node. 
       
    
    
     DETAILED DESCRIPTION  
       [0027]    Reference may be made below to specific elements, numbered in accordance with the attached figures. The discussion below should be taken to be exemplary in nature, and not as limiting of the scope of the present invention. The scope of the present invention is defined in the claims, and should not be considered as limited by the implementation details described below, which as one skilled in the art will appreciate, can be modified by replacing elements with equivalent functional elements. 
         [0028]    In the above described prior art, it is not possible to distinguish a valid duplicate MAC address situation from a multiple movement situation. It is important to detect the MAC address learning situations and distinguish between the two differing cases, in order to avoid a network signaling crash. 
         [0029]    It should be noted that, although some embodiments will be described with respect to the IETF drafts on E-VPN referenced herein, it will be readily apparent to those skilled in the art that these concepts can be extended to other overlay network architectures. Other examples of overlay networks include Provider Backbone Bridging E-VPN (PBB-EVPN), Shortest Path Bridging MAC-in-MAC (SPBM), Virtual Extensible LAN (VxLAN), Network Virtualization using Generic Routing Encapsulation (NVGRE), and others. VxLAN, in particular, is described in IETF draft “VXLAN: A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks”, draft-mahalingam-dutt-dcops-vxlan. 
         [0030]    Some embodiments will be described as using BGP control signaling, however those skilled in the art will appreciate that other protocols can be used as appropriate for the different types of overlay networks. 
         [0031]    In an overlay network such as E-VPN, a network end-point (e.g. the PE) maintains an inner-to-outer address mapping table. This table is used for the network end-point to forward any outgoing packets. The inner address is the VM address (e.g. its MAC address). The outer address is the remote network end-point. 
         [0032]    Embodiments of the present invention allow for a PE to verify with a peer PE if there is an inner address that was learned from a local CE that matches an address that was received from the peer PE, both inner addresses belonging to the same overlay network. The PE can thus detect the duplicate address situation correctly and avoid exhausting network signaling. 
         [0033]      FIG. 2  illustrates an example network that will be used to describe various embodiments of the present invention. PE1  206  and PE2  208  are Provider Edge nodes in the service provider network  200 . CE1  210  is a Customer Edge node, in a first customer network  202 , connected to PE1  206 . CE2  212  and CE3  214  are Customer Edge nodes, in a second customer network  204 , connected to PE2  208 . 
         [0034]    In a first example, PE2  208  learns a MAC address from CE2  212  on a given Ethernet Tag. Next, PE2  208  performs the MAC address look up in its stored MAC address table. If the MAC address is found, meaning PE2  208  has previously received a MAC address advertisement for the same MAC address from one or more other PEs (e.g. PE1  206 ) or has learned it from locally connected CE (e.g. CE3  214 ), it is considered as a known MAC address. Otherwise, the MAC address is considered as an unknown MAC address. 
         [0035]    For an unknown MAC address, the handling procedure is the conventional process as specified in the IETF drafts referenced herein, which involves PE2  208  sending a MAC address advertisement to its peer PEs (i.e. PE1  206 ). 
         [0036]    For a known MAC address, a duplicate MAC address detection procedure can be initiated by PE2  208 . 
         [0037]    If the MAC address was learned from a locally connected different CE, PE2  208  shall perform the MAC address reachability procedure locally with the attached CEs (i.e. CE3  212 ). For instance, PE2  208  can send a network reachability message (e.g. APR) to the MAC address if the MAC address was learned via the data plane. Or alternatively, PE2  208  can use network signaling to verify if the MAC address is still reachable if the MAC address was learned via the control plane. 
         [0038]    If both MAC addresses are reachable, a duplicate MAC address situation is detected. PE2  208  can report it to the network management system. If only one of the MAC addresses is reachable, PE2  208  can update its stored MAC address table accordingly to reflect the verified MAC address. 
         [0039]    If the MAC address was learned from a MAC address advertisement from a peer PE (e.g. PE1  206 ), an alternative procedure can be initiated. PE2  208  shall send a BGP message to the peer PE (PE1  206 ) from which the MAC address advertisements message was received. The BGP message contains a “MAC reachability Extended Community” parameter. The MAC reachability Extended Community message is new transitive extended community with the format specified in IETF RFC 4360 “BGP Extended Communities Attribute”. The type and value shall be allocated by the Internet Assigned Numbers Authority (IANA). After sending the MAC reachability Extended Community message, the PE2  208  waits for a response from PE1  206 . 
         [0040]    Upon receiving the MAC reachability Extended Community message, PE1  206  performs the MAC address reachability procedure locally with its attached CEs (e.g. CE1  210 ). For example, PE1  206  can send a network reachability message to the MAC address if the MAC address was learned via data plane. Or PE1  206  can use network signaling to verify if the MAC address is still reachable if the MAC address was learned via the control plane. 
         [0041]    If the MAC address is not reachable (for example, if the VM has been removed), PE1  206  sends a NOK response to PE2  208  from which the MAC reachability Extended Community was received. The NOK response message indicates to PE2  208  that the MAC address advertisement route which was sent at an early time is no longer valid and it is withdrawn. Upon receiving this NOK response, PE2  208  can update its MAC address table and send MAC address advertisement messages to each of its peer PEs (e.g. PE1  206 ) as specified in the IETF draft “BGP MPLS Based Ethernet VPN” draft-ietf-12vpn-evpn. 
         [0042]    If the MAC address is reachable, PE1  206  shall send an OK response to PE2  208  from which the MAC reachability Extended Community was received. The OK response message indicates to PE2  208  that the MAC address advertisements route which was sent at an early time is still valid. Upon receiving this OK response, a duplicate MAC address situation is detected. PE2  208  can then report it to the network management system. Optionally, PE2  208  may retry the MAC address reachability detection procedure by re-sending the MAC reachability Extended Community after a configurable time delay. This is to distinguish a duplicate MAC address situation from a multiple movement situation. 
         [0043]    An alternative to using BGP messages for MAC address learning from a peer PE, is that the PE (PE2  208 ) may send a network reachability message to the MAC address in the remote PE (PE1  206 ) for MAC address reachability detection. The network reachability message is sent as a data plane packet. If the remote MAC is reachable, a duplicate MAC address situation is detected and PE2  208  can report it to the network management system. If the remote MAC is not reachable, PE2  208  can update its MAC address table accordingly. 
         [0044]    An alternative to using BGP messages as the MAC address learning mechanism from a peer PE, is to report the issue to a centralized network controller. The network controller can make the decision if it knows there is a MAC mobility or out of controlled MAC allocation. 
         [0045]      FIG. 3  is an example process for detecting a duplicate MAC address situation according to some embodiments of the present invention. The process begins with obtaining or receiving a new MAC address (block  300 ). It is determined if the newly received MAC address matches a previously received MAC address by looking up the newly received MAC address in a stored MAC address table (block  310 ). If the newly received MAC address is determined to be unknown, MAC address advertisement messages can be sent to any peer nodes (block  320 ). If the newly received MAC address is known (i.e. it matches a previously received MAC address), a duplicate MAC address detection process can be initiated (block  330 ). The duplicate MAC address detection process can include determining if the matching previously received MAC address was received from a locally connected node or if it was received as a MAC address advertisement from a peer node. 
         [0046]      FIG. 4   a  is flow chart illustrating initiating a duplicate MAC address detection process at a locally connected node according to some embodiments of the present invention. The process begins by determining that a newly received MAC address at a node matches a MAC address that was previously received from a locally connected node (block  400 ). A MAC address reachability procedure is performed with the locally connected nodes by attempting to reach both of the duplicate MAC addresses (block  410 ). If a response is received from only one of the duplicate MAC addresses, it is determined that the reachable MAC address is valid (block  420 ). The MAC address table can be updated accordingly with the valid MAC address. If both duplicates are reachable, and respond, a duplicate MAC address situation is determined and can be reported to the network management system (block  430 ). 
         [0047]      FIG. 4   b  is flow chart illustrating initiating a duplicate MAC address detection process at a peer node according to some embodiments of the present invention. The process begins by determining that a newly received MAC address at a node matches a MAC address that was previously received from a peer node via a MAC address advertisement (block  440 ). A message is sent to the peer node instructing the peer to attempt to reach the MAC address (block  450 ). The node waits for a response while the peer node performs its MAC address reachability procedure locally. A message is received from the peer node indicating if the MAC address was reachable or not (block  460 ). If the response from the peer node indicates that the MAC address was not reachable, the MAC address table can be updated in accordance with the newly received MAC address, similar to as was discussed with respect to block  420 . The node can then send a MAC advertisement message to any peer nodes. Alternatively, if the response from the peer node indicates that the MAC address was reachable, a duplicate MAC address situation is detected. In this case, the node can report the duplicate situation to the network management system, similar to as was discussed with respect to block  430 . 
         [0048]    Optionally, the node may not immediately report the duplicate situation to the network management system. The node can optionally verify the duplicate MAC address prior to reporting it. The node may be configured to re-try the MAC address reachability procedure after a predetermined delay in order to avoid a multiple movement situation being detected as a duplicate MAC address situation. Following a predetermined period of time, the node can send a subsequent instruction to the peer node to re-attempt to reach the MAC address a second time (block  470 ). If the peer node responds to indicate that the MAC address was not reachable on the subsequent attempt (block  480 ), it is determined that a duplicate MAC address situation does not exist (block  490 ). The MAC address table can be updated in accordance with the newly received MAC address. In the example embodiment illustrated in blocks  470 ,  480 ,  490 , an initially detected duplicate MAC address was verified and determined to not exist without unnecessarily reporting the situation to the network management system. However, if the peer node responds to indicate that the MAC address remained reachable on the subsequent re-attempt, a duplicate MAC address situation is determined to be valid and can then be reported. 
         [0049]    The optional MAC address reachability re-attempt (block  470 ) can be performed iteratively. A time delay between iterative attempts can be configured appropriately. 
         [0050]      FIG. 5  illustrates a method for verifying a duplicate MAC address according to some embodiments of the present invention. The method of  FIG. 5  can be executed by a network node in an overlay network. The method begins by receiving or obtaining a first MAC address (block  500 ) through a MAC address learning mechanism. The first MAC address can be learned via data plane or control plane signaling. The first MAC address can be an inner address of a virtual machine in the overlay network. It is determined that the first MAC address matches a second MAC address stored in a MAC address table, the second MAC address having been previously learned (block  510 ). The network node attempts to reach both the first MAC address and the second MAC address (block  520 ). If the MAC address was learned from a locally connected node, the network node can send a reachability message to the MAC address. If the MAC address was learned from a peer node, the network node can send an instruction message to the peer node. The instruction message can include a request that the peer node sends a reachability message to the specified MAC address. 
         [0051]    Acknowledgement is received that both the first MAC address and the second MAC address are reachable (block  530 ). The acknowledgement can be received as a response from a local or peer node that the attempt to reach the first or second MAC address was successful. The network node can optionally wait for a predetermined period of time (block  540 ). Responsive to receiving the acknowledgement that the first and second MAC addresses were both reachable, the network node then re-attempts to reach both the first MAC address and the second MAC address (block  550 ) in order to verify if a duplicate MAC address situation does in fact exist. The network node can re-attempt to reach both the first and second MAC addresses without reporting the initially detected duplicate MAC address situation. 
         [0052]    Responsive to receiving an indication that the second MAC address was not reachable on the re-attempt, the network node can determine that the first MAC address is not a duplicate MAC address. The stored MAC address table can be updated by removing the second MAC address from the table and adding the first MAC address to the table. 
         [0053]    Responsive to receiving an indication that the second MAC address was reachable on the re-attempt, the network node can determine that the first MAC address is a duplicate MAC address. The duplicate MAC address can be reported to a network management system. 
         [0054]      FIG. 6  is a block diagram of a network node  600  that can implement the various embodiments of the present invention as described herein. Node  600  can be a PE node or CE node as were illustrated in  FIG. 2 . Node  600  includes a processor  602 , a memory or data repository  604 , and a communication interface  606 . The memory  604  contains instructions executable by the processor  602  whereby the node  600  is operative to perform the various methods and processes described herein. The communication interface  606  is configured to send and receive messages. The processor  602  is configured to compare a MAC address received via the communication interface  606  with at least one previously received MAC address stored in memory  604  to determine if a duplicate MAC address situation exists. The processor  602  is configured to initiate MAC address reachability procedures with both locally connected nodes and peer nodes. 
         [0055]    Network node  600  is operative to receive, at communication interface  606 , a first MAC address through a MAC address learning mechanism. Node  600  determines that the first MAC address matches a second MAC address stored in a MAC address table in memory  604 , the second MAC address having been previously learned. Node  600  attempts to reach both the first MAC address and the second MAC address. This can include sending reachability instructions via the communication interface  606 . Responsive to receiving acknowledgement that the first MAC address and the second MAC address were both reachable, node  600  re-attempts to reach both the first MAC address and the second MAC address, optionally after waiting a predetermined period of time and optionally without reporting that a duplicate MAC address situation has been detected. 
         [0056]    Embodiments of the present invention allow a network node to detect a MAC address duplication using either control signaling or data plane. The network node can distinguish a true duplicate MAC address situation from a multiple movement situation. This can avoid exhaustive network signaling and limits the impacts on PE nodes with no additional BGP signaling required. 
         [0057]    Embodiments of the invention may be represented as a software product stored in a non-transitory machine-readable medium (also referred to as a computer-readable medium, a processor-readable medium, or a computer usable medium having a computer readable program code embodied therein). The machine-readable medium may be any suitable tangible medium including a magnetic, optical, or electrical storage medium including a diskette, compact disk read only memory (CD-ROM), digital versatile disc read only memory (DVD-ROM) memory device (volatile or non-volatile), or similar storage mechanism. The machine-readable medium may contain various sets of instructions, code sequences, configuration information, or other data, which, when executed, cause a processor to perform steps in a method according to an embodiment of the invention. Those of ordinary skill in the art will appreciate that other instructions and operations necessary to implement the described invention may also be stored on the machine-readable medium. Software running from the machine-readable medium may interface with circuitry to perform the described tasks. 
         [0058]    The above-described embodiments of the present invention are intended to be examples only. Alterations, modifications and variations may be effected to the particular embodiments by those of skill in the art without departing from the invention, which is defined solely by the claims appended hereto.