Abstract: A network of switches having ports coupled to other switches or end hosts may be controlled by a controller. The controller may identify whether any switch ports have failed. In response to identifying that a port has failed at a first switch, the controller may modify link aggregation group mappings of the other switches to handle failover. The controller may modify the link aggregation group mapping of each other switch to include a first mapping that includes ports coupled to the first switch and a second mapping that does not include any ports coupled to the first switch. The controller may configure forwarding tables at the switches to forward network packets using the first or second mappings based on network topology information maintained by the controller.

Abstract: A controller implemented on computing equipment may be used to control switches in a network. End hosts may be coupled to the switches. The controller may generate a virtual network topology of virtual switches, virtual routers, and virtual system routers that are distributed over underlying switches in the network. The controller may form virtual switches from respective groups of end hosts, virtual routers from groups of virtual switches that include virtual interfaces that are coupled to virtual switches, and a virtual system router from groups of virtual routers that includes virtual system router interfaces that are coupled to the virtual routers. The controller may control the virtual network topology by generating respective flow table entries based on identified network policies for each of the virtual routers, virtual system routers, and virtual switches. The controller may control the virtual system routers to route packets between the virtual routers.

Abstract: A packet forwarding network may include switches that forward network traffic between end hosts that are coupled to the forwarding network. An analysis network may be connected to the forwarding network. A controller may control the switches in the forwarding network to implement desired forwarding paths. The controller may configure the switches to form switch port groups. The controller may identify a port group that is connected to the analysis network. The controller may select a subset of the forwarded packets and may control selected switches to copy the subset to the identified port group. The controller may establish network tunnels between the switches and the port group. In this way, the controller may control the switches to perform efficient traffic monitoring regardless of the location on the forwarding network at which the traffic monitoring network is connected and without interfering with normal packet forwarding operations through the forwarding network.

Abstract: A packet forwarding network may include switches that forward network traffic between end hosts that are coupled to the forwarding network. An analysis network may be connected to the forwarding network. A controller may control the switches in the forwarding network to implement desired forwarding paths. The controller may configure the switches to form switch port groups. The controller may identify a port group that is connected to the analysis network. The controller may select a subset of the forwarded packets and may control selected switches to copy the subset to the identified port group. The controller may establish network tunnels between the switches and the port group. In this way, the controller may control the switches to perform efficient traffic monitoring regardless of the location on the forwarding network at which the traffic monitoring network is connected and without interfering with normal packet forwarding operations through the forwarding network.

Abstract: In one embodiment, a list of source identifiers is maintained at a virtual switch. These source identifiers are allowed to send packets through the virtual switch to ports in a private virtual local area network (PVLAN). When a packet is received at the virtual switch from a particular source destined for a particular port in the PVLAN, the virtual switch determines whether a particular identifier associated with the particular source matches one of the source identifiers in the list. If that particular source identifier is not on the list, the packet is prevented from being forwarded to the particular port in the PVLAN.

Abstract: A network of switches having ports coupled to other switches or end hosts may be controlled by a controller. The controller may identify whether any switch ports have failed. In response to identifying that a port has failed at a first switch, the controller may modify link aggregation group mappings of the other switches to handle failover. The controller may modify the link aggregation group mapping of each other switch to include a first mapping that includes ports coupled to the first switch and a second mapping that does not include any ports coupled to the first switch. The controller may configure forwarding tables at the switches to forward network packets using the first or second mappings based on network topology information maintained by the controller.

Abstract: A controller implemented on computing equipment may be used to control switches in a network. End hosts may be coupled to the switches. The controller may generate a virtual network topology of virtual switches, virtual routers, and virtual system routers that are distributed over underlying switches in the network. The controller may form virtual switches from respective groups of end hosts, virtual routers from groups of virtual switches that include virtual interfaces that are coupled to virtual switches, and a virtual system router from groups of virtual routers that includes virtual system router interfaces that are coupled to the virtual routers. The controller may control the virtual network topology by generating respective flow table entries based on identified network policies for each of the virtual routers, virtual system routers, and virtual switches. The controller may control the virtual system routers to route packets between the virtual routers.

Abstract: Described herein are techniques for preventing MAC address spoofs in a virtualization cluster. When a virtual switch first sees a new MAC address on a port designated as being a secure port, the packet is redirected to a virtual supervisor agent used to manage the distributed virtual switch. Assuming the MAC may be bound to the secure port, the supervisor agent broadcasts a message to both the virtual switch that redirected the packet and to virtual switches on other virtualization servers within the cluster.

Abstract: In one embodiment, a list of source identifiers is maintained at a virtual switch. These source identifiers are allowed to send packets through the virtual switch to ports in a private virtual local area network (PVLAN). When a packet is received at the virtual switch from a particular source destined for a particular port in the PVLAN, the virtual switch determines whether a particular identifier associated with the particular source matches one of the source identifiers in the list. If that particular source identifier is not on the list, the packet is prevented from being forwarded to the particular port in the PVLAN.