Some embodiments provide a method for employing the management and control system of a network to dynamically recover from a split-brain condition in the edge nodes of the network. The method of some embodiments takes a corrective action to automatically recover from a split-brain failure occurred at a pair of high availability (HA) edge nodes of the network. The HA edge nodes include an active machine and a standby machine. The active edge node actively passes through the network traffic (e.g., north-south traffic for a logical network), while the standby edge node is synchronized and ready to transition to the active state, should a failure occur. Both HA nodes share the same configuration settings and only one is active until a path, link, or system failure occurs. The active edge node also provides stateful services (e.g., stateful firewall, load balancing, etc.) to the data compute nodes of the network.

Dynamic recovery from a split-brain failure in edge nodes

Some embodiments provide a method for a controller that manages a physical network that implements multiple logical networks that include multiple logical routers. The method receives a command to change a particular centralized routing component of a logical router to an inactive state. At least two centralized routing components of the logical router are implemented on at least two different host machines in the physical network. The method identifies a host machine on which the particular centralized routing component operates. Other centralized routing components of other logical routers also operate on the identified host machine. The method sends a message to the identified host machine to cause the particular centralized routing component to change to an inactive state, without modifying a state of the identified host machine or the other centralized routing components operating on the identified host machine.

Migration of centralized routing components of logical router

A method of providing a set of network addresses associated with a managed forwarding element (MFE) in a logical network that includes a set of data compute nodes (DCNs). The DCNs are hosted on a set of physical hosts. Each DCN is connected to an MFE on the corresponding host. The method receives a request to translate an MFE into a set of network addresses, the request comprising an identification of the MFE. The method identifies a logical network entity associated with the MFE based on the identification of the MFE. The method identifies a set of network addresses associated with the identified network entity and provides the set of network addresses as the set of network addresses associated with the identified network entity.

Method of translating a logical switch into a set of network addresses

Example methods are provided to handle failure at one or more logical routers according to a non-preemptive mode The method may include in response to detecting, by a first routing component operating in a standby state, a failure associated with a second routing component operating in an active state, generating a control message that includes a non-preemptive code to instruct the second routing component not to operate in the active state after a recovery from the failure, sending the control message to the second routing component, and performing a state transition from the standby state to the active state The method may also include in response to detecting, by the first routing component operating in the active state, network traffic during the failure or after the recovery of the second routing component, forwarding the network traffic from the first network to the second network, or from the second network to the first network

Failure handling at logical routers according to a non-preemptive mode

One embodiment performs longest prefix matching operations in one or more different manners that provides packet processing and/or memory efficiencies in the processing of packets. In one embodiment, a packet switching device determines a set of one or more mask lengths of a particular conforming entry of a multibit trie or other data structure that matches a particular address of a packet via a lookup operation in a mask length data structure. A conforming entry refers to an entry which has less than or equal to a maximum number of different prefix lengths, with this maximum number corresponding to the maximum number of prefix lengths which can be searched in parallel in the address space for a longest matching prefix by the implementing hardware. The packet switching device then performs corresponding hash table lookup operation(s) in parallel in determining an overall longest matching prefix for the particular address.

Longest prefix matching providing packet processing and/or memory efficiencies in processing of packets

A novel method for troubleshooting a logical network is provided. The logical network has logical forwarding elements operating inside virtual network forwarding engines. The method receives a source identifier and a destination identifier that correspond to nodes in the logical network. The method then retrieves a set of network data from a virtual network forwarding engine and identifies a path in the logical network by traversing the logical network according to the retrieved set of network data. This traversal starts at an initial network node that is identified by the source identifier and continues through a set of next-hop network nodes that are each identified based on the destination identifier. At least some of the network nodes are logical ports associated with logical forwarding elements implemented by the virtual network forwarding engine. The method then reports the set of traversed logical nodes.

Troubleshooting virtual network reachability

Some embodiments provide a method for configuring a gateway datapath that processes data messages between a logical network implemented in a datacenter and an external network The method receives configuration data including security policy rules for a logical router implemented by the datapath that indicate whether to apply a security protocol to certain data messages transmitted from a particular interface of the logical router The method identifies a particular security policy rule that applies to data messages that (i) have a destination address in a set of destination addresses and (ii) meet at least one additional criteria The method generates a static route, for a routing table used by the datapath to implement the logical router, that routes data messages with destination addresses in the set of destination addresses to the particular interface The datapath applies the security policy rules for data messages transmitted from the particular interface

Static routes for policy-based VPN

Example methods are provided for a first routing component to handle failure at a logical router in a first network. One method may comprise learning first path information associated with a first path provided by an active second routing component, and second path information associated with a second path provided by a standby second routing component. The method may also comprise in response to detecting a first egress packet destined for a second network, sending the first egress packet to the active second routing component based on the first path information. The method may further comprise in response to detecting a failure at the active second routing component and detecting a second egress packet destined for the second network, sending the second egress packet to a new active second routing component based on the second path information.

Handling failure at logical routers

The technology disclosed herein enables network traffic routing using a hybrid routing table. In a particular embodiment, a method provides adding a first portion of a network prefix to one or more tiers of one or more tries in the hybrid routing table. Upon reaching a lowest node of the one or more tries when adding the first portion of the network prefix, the method provides adding key information to the lowest node. The key information and at least a second portion of the network prefix comprise a key to locate a value in a hash table of the hybrid routing table. The value indicates routing information for the network prefix. Additionally, the method provides routing packets using the hybrid routing table.

David J. Leroy

Papers

Troubleshooting virtual network reachability

Static routes for policy-based VPN

Handling failure at logical routers

Hybrid routing table for routing network traffic