Figure 3.5 The VFP place with the VMSwitch
The layers of the VFP are implemented and actioned as separate flow tables that
define the rules affecting the incoming packets from the physical NIC. A flow table
consists of the traffic flow and certain types of policies—for example, all traffic to a
certain subnet and then an action that varies depending on the policy type used by the
flow table. This action could be to encapsulate the packet and send to a certain address
(VNet), to apply a certain type of NAT (SLB), or even to block the packet (ACLs), as
shown in Figure 3.6. Note that although the figure shows three types of policies,
others exist, such as routing tables and port-mirroring tables.
Figure 3.6 The flow-caching hash lookup used in the VFP
The flow tables are implemented in a specific order; the virtual network rules that
govern how packets will be encapsulated and handled between the virtual network and
physical network are implemented first, then the software load-balancing rules and