POLICY ENFORCEMENT FOR UPSTREAM FLOOD TRAFFIC

摘要

Systems, methods, and computer-readable media are provided for enforcing policy for upstream (e.g., traffic from an endpoint to the physical network layer or hardware fabric of a data center) flood traffic (e.g., broadcast, unknown unicast, or multicast traffic) originating from a virtual endpoint via a network fabric. In one embodiment, upstream flood traffic can be transmitted using a special multicast group to which only elements of the data center fabric (e.g., physical switches, routers) are subscribed. That is, upstream flood traffic is assigned to the special multicast group, resulting in unintended endpoints not receiving the flood traffic. However, the hardware fabric receives the flood traffic and will then enforce applicable policies to route the packets to intended endpoints.

主权项

1. A method comprising:
receiving network traffic from a source virtual endpoint to be forwarded to one or more destination endpoints; determining the network traffic corresponds to flood traffic; generating encapsulated flood traffic including the flood traffic and destination information corresponding to a multicast group to which only one or more elements of a physical network are subscribed; and forwarding the encapsulated flood traffic, wherein the flood traffic is received by the one or more elements of the physical network prior to being received by the one or more destination endpoints based at least in part upon encapsulation of the flood traffic with the destination information.