Customer isolation using a common forwarding database with hardware learning support

[0001] Embodiments described herein relate to packet forwarding in private virtual local area networks.

[0002] A private virtual local area network (VLAN) includes switch ports that cannot communicate with each other but can access another network. These ports are called private ports. Each private VLAN contains one or more private ports and a single uplink port (or network port). A typical application of a private VLAN is in a hotel where each room has a different port that connects to or can access the Internet. In this situation, it is undesirable to allow communication between rooms, hence the use of the private VLAN.

[0003] A traditional private VLAN implementation has separate forwarding databases for network VLANs, isolated subscriber VLANs, and non-isolated subscriber VLANs. This traditional forwarding database setup causes a scaling issue. For example, a switch (e.g., a network switch) that is configured with a private VLAN domain will have a plurality of ports. Each port on the network switch may be connected to a different VLAN, necessitating a separate forwarding database for forwarding packets. Private VLANs can prevent packets originating from an isolated subscriber VLAN from being forwarded on a port associated with another isolated subscriber VLAN. To accomplish this, a single forwarding entry must be duplicated on each separate forwarding database for each port in to cover all of the different forwarding scenarios. Given that each port needs its own forwarding database, as the number of ports increase on a network switch, the complexity and the number of forwarding entries that are duplicated also increase.

[0004] To satisfy traditional private VLAN forwarding domain rules, the learning forwarding database entries are software driven. This has a direct impact on the forwarding database learning rate. For example, it is common for a software learning rate to be about 5,000 entries per second. In contrast, hardware learning rates can achieve or exceed 100,000 entries per second. Because of the necessity of replicating forwarding database entries in traditional private VLAN domains, it is not cost effective to learn forwarding database entries in hardware. The replication of entries wastes hardware space.

[0005] A network switch having a private domain is described herein. The network switch includes a plurality of isolated ports, each of which is associated with the private domain. The network switch also includes a network port that is associated with the private domain. Additionally, a network switch includes a memory that maintains a hardware-based forwarding table for the entire private domain. A network processor is also included to prevent forwarding of packets between isolated ports within the private domain based at least in part on a privacy level associated with each entry in the hardware base forwarding table for the private domain.

[0009] As provided herein, methods, apparatuses, and systems enable forwarding of data traffic on a network switch having a private VLAN domain configured. As used herein, a network switch refers to any network device that facilitates traffic flow or data packet flow on a network. Network switches can include, for example, Open Systems Interconnection (OSI) layer 2 bridges, layer 3 switches (or “routers”), and other known routing/forwarding devices.

[0010] Embodiments described herein conform to a rule that requires that packets not be forwarded between isolated ports on the same switch. Whereas traditional private VLAN implementations require duplication of forwarding entries for each of a plurality of VLAN types (each VLAN type—isolated VLAN, network VLAN, etc. having a respective forwarding database), embodiments described herein include a hardware-based forwarding database (or forwarding table) that allows all forwarding entries to be stored in hardware. A forwarding table includes a collection of forwarding entries indicating, for example, an egress port for a given destination address. As used herein, a forwarding database may also be referred to, for example, as a forwarding table or a routing table.

[0011] In various embodiments, a network switch may have multiple domains but at least one private VLAN domain programmed on the switch.

[0012] FIG. 1 is a block diagram according to various embodiments. As shown, switch 110 includes a network processor 112, a memory 116, and a plurality of ports. The network processor 112 could be replaced by an application specific integrated circuit (ASIC) or other programming logic in alternate embodiments. Additionally, while six ports are shown in FIG. 1, one of skill in the art will appreciate that more ports or fewer ports could be used in different embodiments. At least some of the ports on switch 110 are considered isolated ports. For example, ports 3 and 4 are isolated ports given that they are each connected to isolated VLAN 150. Ports 2, 5 and 6 are considered non-isolated ports. Ports 2 and 6 are connected to the same non-isolated VLAN 130, while port 5 is connected to a separate non-isolated VLAN 140. Port 1 is considered a network port because it is connected to network 120. All of the ports shown in FIG. 1 on switch 110 are encompassed by or belong to private VLAN domain 102.

[0013] In various embodiments, an individual port can be associated with multiple private VLAN domains. For example, port 1 could be an isolated port (e.g., connected to an isolated VLAN) for a first private VLAN domain and a non-isolated port (e.g., connected to a non-isolated VLAN) for a second private VLAN domain. Within a single private VLAN domain, the ports described in various embodiments herein are connected to a single VLAN type within the private VLAN domain.

[0014] Memory 116 maintains a hardware-based forwarding table for the private VLAN domain. Unlike traditional private VLAN domain forwarding tables where a separate forwarding table is maintained for each different type of VLAN (e.g., network VLAN, isolated subscriber VLAN, non-isolated subscriber VLAN, etc.), memory 116 maintains a hardware-based forwarding table for the private VLAN domain 102. This hardware-based forwarding table maintains entries for all ports within private VLAN domain 102 to eliminate replication of forwarding database entries. In other words, it is not necessary to have a separate forwarding table for each different VLAN and/or port within the private VLAN domain.

[0015] By consolidating all forwarding entries into a single hardware-based forwarding table, the absence of forwarding entry replication enables the use of a hardware forwarding table. As discussed previously, hardware-based forwarding tables have a much higher learning rate (e.g., 100,000 entries per second) than multiple software forwarding tables.

[0016] Network processor 112 prevents forwarding of packets between isolated ports within the private VLAN domain 102 based at least in part on a privacy level associated with each entry in the hardware-based forwarding table maintained in memory 116. (As noted above, other types of processing logic, such as an ASIC, firmware, etc. could be used in place of a network processor.) For example, network processor 112 would prevent packets arriving at port 3 from being forwarded out on port 4 given that both ports are attached to isolated VLAN 150 and in view of the rule that packets cannot be exchanged between isolated ports. Network processor 112 includes a gatekeeper 114 to help enforce this rule. Specifically, gatekeeper 114 receives packets from the various ports on the switch and determines an egress port privacy level for the packet. Gatekeeper 114 also determines an ingress port privacy level for the packet in various embodiments.

[0017] The privacy level in each forwarding entry in the forwarding table stored in memory 116 is determined by two privacy bits (although a different number of bits could be used in other embodiments). Thus, when a packet is received by switch 110, the header of the packet is checked to determine the value of the two privacy bits. The privacy bits are then compared with the corresponding forwarding entry for that packet (stored in memory 116). If the privacy bits indicate that either the ingress port privacy level or the egress port privacy level is associated with an isolated port, then that packet will not be forwarded out on switch 110 unless one of the two ports is a network port.

[0018] For example, if gatekeeper 114 determines that a packet was received from an isolated port (e.g., port 3) and gatekeeper 114 determines that the egress port privacy level for the outgoing port (e.g., port 4) is indicative of another isolated port, then that packet will not be forwarded (e.g., the packet will be blocked, filtered, dropped, etc.). If, however, a packet is received at an isolated port (e.g., port 3) and gatekeeper 114 determines that the egress port privacy level is indicative of a network port (e.g., port 1) then the packet will be forwarded out on the egress port.

[0019] Another way of looking at it is that if either the ingress port or the egress port is a network port (e.g., port 1 as shown in FIG. 1), then the packet will always be forwarded because at least one of the ports is a network port (connected to network 120).

[0020] Forwarding packets between non-isolated ports presents a different scenario. Packets may be forwarded through switch 110 on the same non-isolated VLAN. For example, if a packet is received from a non-isolated VLAN (e.g., VLAN 130 on port 2) and that packet has a destination address that requires forwarding the packet through switch 110 on port 6 (also connected to non-isolated VLAN 130), then gatekeeper 114 may allow the packet to be forwarded to its destination. However, in cases where gatekeeper 114 determines that both the ingress port and the egress port are associated with different non-isolated VLANs (e.g., ingress port is port 2 connected to VLAN 130 while the egress port is port 5 connected to VLAN 140), then gatekeeper 114 will prevent the packet from being forwarded on switch 110 (e.g., by blocking, filtering, dropping the packet, etc.). As discussed previously, the forwarding actions of gatekeeper 114 are determined based on the privacy bits contained in the packet header of the packet to be forwarded and comparing the privacy bits with an appropriate forwarding entry.

[0021] In some embodiments, the packet header includes the privacy bits for the ingress port or the egress port or both. For example, if the privacy check is performed on packet ingress, only the egress privacy bits may be necessary. If, in another example, if the privacy check is performed on packet egress, both ingress and egress privacy bits might be used in packets.

[0022] FIG. 2 is a flow diagram illustrating various embodiments. A packet is received at a network switch 210. The network switch belongs to a private virtual local area network (or private VLAN) domain. Ingress and egress ports for the packet are determined 220. The ingress port is the port on which the packet is received by the switch while the egress port is the port from which the packet is to be forwarded from the network switch. Based on the ingress and egress ports of the packet, a table look up is performed 230 to determine the privacy levels of the ingress and egress ports. In various embodiments, the table lookup is performed by accessing a hardware-based forwarding table in a memory (random access memory, content addressable memory, flash memory, etc.).

[0023] Each packet header includes one or more bits dedicated to indicating a privacy level of the ingress port. Using the destination address to access the appropriate forwarding entry in the forwarding database, the privacy bit(s) for the egress port may also be determined. For example, if two privacy bits are used, “00” might indicate a non-private VLAN, “01” might indicate a network VLAN, “10” might indicated a non-isolated subscriber VLAN, and “11” might indicate an isolated subscriber VLAN.

[0024] Based on the privacy bits, it is determined 240 whether one of the two ports (i.e., either the ingress or the egress port) is a network port. If one of the ports is a network port, then the packet is forwarded 270 to its destination. Packets traveling to or from a network port within the private VLAN may always be forwarded. If neither of the two ports is a network port, then it is determined 250 whether at least one port is an isolated port. Packet may not be forwarded between isolated ports. If at least one of the ports is an isolated port, then packet egress is denied 280 (e.g., the packet is blocked, filtered, dropped, etc.).

[0025] If neither of the ports are network ports and neither of the ports are isolated ports, it is determined 260 whether both ports are associated with the same non-isolated VLAN. If both ports are associated with the same non-isolated VLAN, then the packet may be 270 forwarded to its destination. If the two ports are associated with separate or different non-isolated VLANs, then packet egress is again denied 280. Per the defined rule, packets to and/or from the same non-isolated VLAN may be forwarded, but packet to and/or from different non-isolated VLANs may not be forwarded.

[0026] The process flow described above (e.g., with respect to FIG. 2) for determining port type and/or privacy level can follow various modified orders in different embodiments. For example, the privacy bits described herein may directly dictate a forwarding decision.

[0027] Elements of embodiments may also be provided as a machine-readable storage medium for storing the machine-executable instructions. The machine-readable storage medium may include, but is not limited to, flash memory, optical disks, CD-ROMs, DVD ROMs, RAMs, EPROMs, EEPROMs, magnetic or optical cards, or other type of machine-readable media suitable for storing electronic instructions. For example, embodiments of the invention may be downloaded as a computer program which may be transferred from a memory on a remote computer (e.g., a server) to a memory on a requesting computer (e.g., a client).

[0028] Various components described herein may be a means for performing the functions described herein. Each component described herein includes software, hardware, firmware or a combination of these. The operations and functions described herein can be implemented as software modules, hardware modules, special-purpose hardware (e.g., application specific hardware, application specific integrated circuits (ASICs), digital signal processors (DSPs), etc.), embedded controllers, hardwired circuitry, etc.

[0029] Aside from what is described herein, various modifications may be made to the disclosed embodiments and implementations of the invention without departing from their scope. Therefore, the illustrations and examples herein should be construed in an illustrative, and not a restrictive sense.