Virtual links for network appliances

• US 9,407,504 B1
• Filed: 01/15/2014
• Issued: 08/02/2016
• Est. Priority Date: 01/15/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Rolando, Pierluigi, Di Benedetto, Marco, Flynn, Thomas Vincent
• Primary Examiner(s): Nguyen, Phuoc
• Application Number:
  US14/156,324
• Time in Patent Office: 930 Days
• Field of Search: 709/228
• US Class Current: 1/1
• CPC Class Codes: H04L 12/46 Interconnection of networks
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 45/64 using an overlay routing layer

Abstract

Creating virtual links is disclosed, including: determining a first network appliance to configure to communicate with a second network appliance using a virtual link, wherein the virtual link comprises a layer three overlay point-to-point data link; and determining the second network appliance to configure to communicate with the first network appliance using the virtual link.

Claims

1. A system, comprising:

a processor configured to;

determine a first network appliance to configure to communicate with a second network appliance using a virtual link, wherein the virtual link comprises a layer three overlay point-to-point data link;

configure an inner interface of the first network appliance to receive data from the first network appliance to be sent via the virtual link;

encapsulate the received data by adding a virtual link-related tunnel header for each data packet;

configure an outer interface of the first network appliance to send the encapsulated data via the virtual link;

determine the second network appliance to configure to communicate with the first network appliance using the virtual link;

configure an outer interface of the second network appliance to receive the encapsulated data sent from the first network appliance via the virtual link;

decapsulate the received data by removing the virtual-link related tunnel header from each received data packet; and

configure an inner interface of the first network appliance to send the decapsulated data to the second network appliance; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1, wherein the first network appliance is configured to perform a first network service and the second network appliance is configured to perform a second network service.

3. The system of claim 1, wherein the first network appliance is provisioned on a first device, wherein the processor is further configured to migrate the first network appliance to a second device, wherein the virtual link is maintained between the first network appliance and the second network appliance after the migration.

4. The system of claim 1, wherein the virtual link is provisioned for the first network appliance and the second network appliance by a managing entity.

5. The system of claim 1, wherein a configuration associated with the virtual link is not modifiable by an administrator associated with the first network appliance and the second network appliance.

6. The system of claim 1, wherein the virtual link comprises the point-to-point data link between the outer interface of the first network appliance and the outer interface of the second network appliance.

7. The system of claim 1, wherein the inner interface on the first network appliance is associated with a first Internet Protocol (IP) address assigned by a provisioning administrator and the outer interface on the first network appliance is associated with a second IP address configured by an administrator of the first network appliance.

8. A method, comprising:

determining a first network appliance to configure to communicate with a second network appliance using a virtual link, wherein the virtual link comprises a layer three overlay point-to-point data link;

configuring an inner interface of the first network appliance to receive data from the first network appliance to be sent via the virtual link;

encapsulating the received data by adding a virtual link-related tunnel header for each data packet;

configuring an outer interface of the first network appliance to send the encapsulated data via the virtual link;

determining the second network appliance to configure to communicate with the first network appliance using the virtual link;

configuring an outer interface of the second network appliance to receive the encapsulated data sent from the first network appliance via the virtual link;

decapsulating the received data by removing the virtual-link related tunnel header from each received data packet; and

configuring an inner interface of the first network appliance to send the decapsulated data to the second network appliance.

9. The method of claim 8, wherein the first network appliance is configured to perform a first network service and the second network appliance is configured to perform a second network service.

10. The method of claim 8, wherein the first network appliance is provisioned on a first device and further comprising migrating the first network appliance to a second device, wherein the virtual link is maintained between the first network appliance and the second network appliance after the migration.

11. The method of claim 8, wherein the virtual link is provisioned for the first network appliance and the second network appliance by a managing entity.

12. The method of claim 8, wherein a configuration associated with the virtual link is not modifiable by an administrator associated with the first network appliance and the second network appliance.

13. The method of claim 8, wherein the virtual link comprises the point-to-point data link between the outer interface of the first network appliance and the outer interface of the second network appliance.

14. The method of claim 8, wherein the inner interface on the first network appliance is associated with a first Internet Protocol (IP) address assigned by a provisioning administrator and the outer interface on the first network appliance is associated with a second IP address configured by an administrator of the first network appliance.

15. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

determining a first network appliance to configure to communicate with a second network appliance using a virtual link, wherein the virtual link comprises a layer three overlay point-to-point data link;

configuring an inner interface of the first network appliance to receive data from the first network appliance to be sent via the virtual link;

encapsulating the received data by adding a virtual link-related tunnel header for each data packet;

configuring an outer interface of the first network appliance to send the encapsulated data via the virtual link;

determining the second network appliance to configure to communicate with the first network appliance using the virtual link

configuring an outer interface of the second network appliance to receive the encapsulated data sent from the first network appliance via the virtual link;

decapsulating the received data by removing the virtual-link related tunnel header from each received data packet; and

configuring an inner interface of the first network appliance to send the decapsulated data to the second network appliance.

16. The computer program product of claim 15, wherein the first network appliance is configured to perform a first network service and the second network appliance is configured to perform a second network service.

17. The computer program product of claim 15, wherein the first network appliance is provisioned on a first device and further comprising migrating the first network appliance to a second device, wherein the virtual link is maintained between the first network appliance and the second network appliance after the migration.

18. The computer program product of claim 15, wherein the virtual link is provisioned for the first network appliance and the second network appliance by a managing entity.

19. The computer program product of claim 15, wherein a configuration associated with the virtual link is not modifiable by an administrator associated with the first network appliance and the second network appliance.

20. The computer program product of claim 15, wherein the virtual link comprises the point-to-point data link between the outer interface of the first network appliance and the outer interface of the second network appliance.