Stateful network address translation protocol implemented over a data network

• US 8,675,650 B2
• Filed: 01/10/2011
• Issued: 03/18/2014
• Est. Priority Date: 09/12/2000
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Jayasenan, Siva S., Sullenberger, Mike, Denny, Mark, Venkateshaiah, Murali
• Primary Examiner(s): Zhao, Wei
• Application Number:
  US12/987,916
• Publication Number:
  US 20110103387A1
• Time in Patent Office: 1,163 Days
• Field of Search: 370/389, 709/230
• US Class Current: 370/389
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/2532 Clique of NAT servers

Abstract

A technique is disclosed for synchronizing NAT information stored on different network devices that have been configured to implement a network address translation protocol. Each of the network devices includes a respective NAT data structure configured to store NAT information. The NAT information includes at least one NAT entry relating to a network node engaged in a communication session with at least one other network node. At least one NAT entry in a first NAT data structure is modified. The first NAT data structure is associated with a first NAT network device. A first NAT transaction message is generated which includes information relating to the modifications performed on the first NAT data structure. The first NAT transaction message is transmitted to at least one other NAT network device to thereby cause that device to modify its respective NAT data structure using information from the first NAT transaction message. In this way, synchronization of NAT information stored on each of the network devices may be achieved.

Claims

1. A method, comprising:

receiving, at a first network device configured to perform Network Address Translation (NAT), a first NAT transaction message which includes updated NAT information, the first NAT transaction message being generated by a second network device configured to perform NAT, the updated NAT information including information relating to updates or modifications to be performed on NAT information stored at a first NAT data structure, the first NAT data structure being managed by the first network device; and

modifying by the first network device the NAT information stored at the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure, wherein modifying is performed using the updated NAT information from the first NAT transaction message to thereby achieve synchronization of the NAT information stored on the first and second network devices;

wherein modifying by the first network device NAT information stored at the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure comprises preventing the NAT information stored at the first NAT data structure from being modified when the first network device determines that the second network device that generated the first NAT transaction message is not authorized to modify the first NAT data structure.

2. The method of claim 1, wherein the first network device and the second network device are each configured as traffic handling devices that are members of a first redundancy group.

3. The method as recited in claim 1, wherein modifying by the first network device the NAT information stored at the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure comprises:

modifying the NAT information stored at the first NAT data structure when the first network device determines that the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure.

4. The method of claim 1 wherein the first network device is configured as an active traffic handling device of an active-standby redundancy group, and wherein the second network device is configured as a standby traffic handling device of the active-standby redundancy group.

5. The method of claim 1 wherein the first network device is configured as a first peer traffic handling device of a peer-peer redundancy group, and wherein the second network device is configured as a second peer traffic handling device of the peer-peer redundancy group.

6. The method of claim 1 wherein the first NAT transaction message includes instructions to add a new NAT entry to the first NAT data structure.

7. The method of claim 1 wherein the first NAT transaction message includes instructions to delete a specific NAT entry stored in the first NAT data structure.

8. The method of claim 1 wherein the first NAT transaction message includes instructions to modify an existing NAT entry in the first NAT data structure.

9. The method as recited in claim 1, wherein modifying is performed without performing NAT on the first NAT transaction message.

10. An apparatus, comprising:

a processor; and

a memory, at least one of the processor or the memory being configured to;

receive, at a first network device configured to perform Network Address Translation (NAT), a first NAT transaction message which includes instructions pertaining to a first NAT data structure managed by the first network device, the first NAT transaction message being generated by a second network device configured to perform NAT; and

modify by the first network device the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure, wherein modifying is performed in accordance with the instructions from the first NAT transaction message to thereby achieve synchronization of NAT information stored on the first and second network devices;

wherein the first network device modifies the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure by preventing the first NAT data structure from being modified when the first network device determines that the second network device that generated the first NAT transaction message is not authorized to modify the first NAT data structure.

11. The apparatus as recited in claim 10, wherein the first network device is configured as a traffic handling device that is a member of a first redundancy group of which the second network device is a member.

12. The apparatus as recited in claim 10, wherein the first network device is configured as a traffic handling device that is a member of a first redundancy group.

13. The apparatus as recited in claim 10, wherein modifying by the first network device the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure comprises:

modifying the first NAT data structure when the first network device determines that the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure.

14. The apparatus as recited in claim 10 wherein the instructions of the first NAT transaction message comprise instructions to add a new NAT entry to the first NAT data structure.

15. The apparatus as recited in claim 10, wherein the instructions of the first NAT transaction message comprise instructions to delete a specific NAT entry stored in the first NAT data structure.

16. The apparatus as recited in claim 10, wherein the instructions of the first NAT transaction message comprise instructions to modify an existing NAT entry in the first NAT data structure.

17. The apparatus as recited in claim 10, at least one of the processor or the memory being further configured to:

determine whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure.

18. The apparatus as recited in claim 10, wherein modifying is performed without performing NAT on the first NAT transaction message.

19. A non-transitory computer-readable storage medium storing thereon computer-readable instructions, comprising:

instructions for receiving, at a first network device configured to perform Network Address Translation (NAT), a first NAT transaction message which includes instructions pertaining to a first NAT data structure managed by the first network device, the first NAT transaction message being generated by a second network device configured to perform NAT; and

instructions for modifying by the first network device the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure, wherein modifying is performed in accordance with the instructions from the first NAT transaction message to thereby achieve synchronization of NAT information stored on the first and second network devices;

wherein modifying by the first network device the first NAT data structure according to whether the second network device that generated the first NAT transaction message is authorized to modify the first NAT data structure comprises preventing the first NAT data structure from being modified when the first network device determines that the second network device that generated the first NAT transaction message is not authorized to modify the first NAT data structure.

20. The non-transitory computer-readable storage medium as recited in claim 19, wherein the first network device is configured as an active traffic handling device of an active-standby redundancy group, and wherein the second network device is configured as a standby traffic handling device of the active-standby redundancy group.