Method and apparatus for connecting a gateway router to a set of scalable virtual IP network appliances in overlay networks

• US 9,736,278 B1
• Filed: 04/21/2017
• Issued: 08/15/2017
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Hammam, Tarik, Franzen, Anders, Beste, Fredrick, Abdallah, Shukri
• Primary Examiner(s): Jaroenchonwanit, Bunjob
• Application Number:
  US15/494,184
• Publication Number:
  US 20170223154A1
• Time in Patent Office: 116 Days
• Field of Search: None
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 45/741 Routing in networks with a plurality of addressing schemes, e.g. with both IPv4 and IPv6
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/31 by tagging of packets, e.g. using discard eligibility [DE] bits
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method in a gateway router is described. The method includes receiving traffic with a destination of a virtual internet protocol (VIP) address corresponding to a scalable VIP appliance; selecting a point-to-point VIP tunnel associated with the VIP address, wherein the point-to-point VIP tunnel encapsulates a point-to-point link between the gateway router and the scalable VIP appliance; separating one or more packets within the traffic; classifying each of the one or more separated packets based on one or more indicators of the one or more separated packets; and forwarding each of the one or more separated packets to one of one or more IP tunnels based on the classification of each of the separated packets, wherein the one or more IP tunnels are connected to the scalable VIP appliance and wherein the one or more IP tunnels comprise a forwarding tunnel group associated with the point-to-point VIP tunnel.

Claims

1. A method in a gateway router implemented by an electronic device, comprising:

establishing, by the gateway router, a Virtual Internet Protocol (VIP) tunnel with a scalable virtual IP appliance, wherein the VIP tunnel comprises a point-to-point link that is configured as a non-broadcast IP tunnel with a virtual IP address as a remote neighbor address of the point-to-point link;

establishing, by the gateway router, a plurality of forwarding tunnels that terminate at a corresponding plurality of scaling units of the scalable virtual IP appliance;

announcing, by the gateway router, information to an external network indicating that the gateway router has a direct link to an endpoint having the virtual IP address;

receiving, at the gateway router, traffic comprising one or more packets having a destination address comprising the virtual IP address associated with the scalable virtual IP appliance; and

forwarding, by the gateway router, each of the one or more packets via one of the plurality of forwarding tunnels to one of the plurality of scaling units, wherein the one or more packets are not transmitted via the VIP tunnel despite the one or more packets having the destination address comprising the virtual IP address.

2. The method of claim 1, wherein each of the plurality of scaling units processes those of the one or more packets that arrive at that scaling unit by performing operations, wherein said operations include either load balancing operations or firewall operations.

3. The method of claim 1, wherein the one or more packets are received at the gateway router over a Virtual Private Network (VPN) connection.

4. The method of claim 3, further comprising:

selecting one of the plurality of forwarding tunnels for the one or more packets to be forwarded over based upon an identifier of the VPN connection upon which the traffic was received.

5. The method of claim 4, further comprising:

receiving, at the gateway router, additional traffic over a second VPN connection, wherein the additional traffic comprises an additional one or more packets having the destination address comprising the virtual IP address associated with the scalable virtual IP appliance; and

selecting a second of the plurality of forwarding tunnels for the additional one or more packets to be forwarded over based upon an identifier of the second VPN connection.

6. The method of claim 1, further comprising:

responsive to another scaling unit being made active for use by the scalable virtual IP appliance, establishing, by the gateway router, another forwarding tunnel that terminates at the another scaling unit of the scalable virtual IP appliance; and

forwarding, by the gateway router, an additional one or more received packets via the another forwarding tunnel, wherein the additional one or more received packets have, as their destination address, the virtual IP address associated with the scalable virtual IP appliance.

7. The method of claim 1, further comprising:

receiving, at the gateway router, a message from the scalable virtual IP appliance indicating that a packet classification should be associated with a different one of the plurality of forwarding tunnels, wherein prior to the receiving of the message, the packet classification was associated with an initial one of the plurality of forwarding tunnels; and

after said receiving of the message;

receiving another one or more packets that have, as their destination address, the virtual IP address associated with the scalable virtual IP appliance, and

forwarding, by the gateway router due to the another one or more packets having the packet classification, the another one or more packets via the different one of the plurality of forwarding tunnels.

8. The method of claim 7, further comprising:

transmitting, by the gateway router prior to said receiving of the message, another message to the scalable virtual IP appliance indicating that the initial one of the plurality of forwarding tunnels has failed.

9. A non-transitory computer-readable storage medium comprising instructions which, when executed by one or more processors of an electronic device, cause the electronic device to implement a gateway router to:

establish a Virtual Internet Protocol (VIP) tunnel with a scalable virtual IP appliance, wherein the VIP tunnel comprises a point-to-point link that is configured as a non-broadcast IP tunnel with a virtual IP address as a remote neighbor address of the point-to-point link;

establish a plurality of forwarding tunnels that terminate at a corresponding plurality of scaling units of the scalable virtual IP appliance;

announce information to an external network indicating that the gateway router has a direct link to an endpoint having the virtual IP address;

receive traffic comprising one or more packets having a destination address comprising the virtual IP address associated with the scalable virtual IP appliance; and

forward each of the one or more packets via one of the plurality of forwarding tunnels to one of the plurality of scaling units, wherein the one or more packets are not transmitted via the VIP tunnel despite the one or more packets having the destination address comprising the virtual IP address.

10. The non-transitory computer-readable storage medium of claim 9, wherein each of the plurality of scaling units processes those of the one or more packets that arrive at that scaling unit by performing operations, wherein said operations include either load balancing operations or firewall operations.

11. The non-transitory computer-readable storage medium of claim 9, wherein the one or more packets are received at the gateway router over a Virtual Private Network (VPN) connection.

12. The non-transitory computer-readable storage medium of claim 11, wherein the gateway router is further to:

select one of the plurality of forwarding tunnels for the one or more packets to be forwarded over based upon an identifier of the VPN connection upon which the traffic was received.

13. The non-transitory computer-readable storage medium of claim 12, wherein the gateway router is further to:

receive additional traffic over a second VPN connection, wherein the additional traffic comprises an additional one or more packets having the destination address comprising the virtual IP address associated with the scalable virtual IP appliance; and

select a second of the plurality of forwarding tunnels for the additional one or more packets to be forwarded over based upon an identifier of the second VPN connection.

14. The non-transitory computer-readable storage medium of claim 9, wherein the gateway router is further to:

responsive to another scaling unit being made active for use by the scalable virtual IP appliance, establish another forwarding tunnel that terminates at the another scaling unit of the scalable virtual IP appliance; and

forward an additional one or more received packets via the another forwarding tunnel, wherein the additional one or more received packets have, as their destination address, the virtual IP address associated with the scalable virtual IP appliance.

15. The non-transitory computer-readable storage medium of claim 9, wherein the gateway router is further to:

receive a message from the scalable virtual IP appliance indicating that a packet classification should be associated with a different one of the plurality of forwarding tunnels, wherein prior to the receiving of the message, the packet classification was associated with an initial one of the plurality of forwarding tunnels; and

after said receipt of the message;

receive another one or more packets that have, as their destination address, the virtual IP address associated with the scalable virtual IP appliance, and

forward, due to the another one or more packets having the packet classification, the another one or more packets via the different one of the plurality of forwarding tunnels.

16. The non-transitory computer-readable storage medium of claim 15, wherein the gateway router is further to:

transmit, prior to said receiving of the message, another message to the scalable virtual IP appliance indicating that the initial one of the plurality of forwarding tunnels has failed.

17. An electronic device, comprising:

one or more processors; and

a non-transitory computer-readable storage medium comprising instructions which, when executed by the one or more processors, cause the electronic device to implement a gateway router to;

establish a Virtual Internet Protocol (VIP) tunnel with a scalable virtual IP appliance, wherein the VIP tunnel comprises a point-to-point link that is configured as a non-broadcast IP tunnel with a virtual IP address as a remote neighbor address of the point-to-point link;

establish a plurality of forwarding tunnels that terminate at a corresponding plurality of scaling units of the scalable virtual IP appliance;

announce information to an external network indicating that the gateway router has a direct link to an endpoint having the virtual IP address;

receive traffic comprising one or more packets having a destination address comprising the virtual IP address associated with the scalable virtual IP appliance; and

forward each of the one or more packets via one of the plurality of forwarding tunnels to one of the plurality of scaling units, wherein the one or more packets are not transmitted via the VIP tunnel despite the one or more packets having the destination address comprising the virtual IP address.

18. The electronic device of claim 17, wherein the one or more packets are received at the gateway router over a Virtual Private Network (VPN) connection, and wherein the gateway router is further to select one of the plurality of forwarding tunnels for the one or more packets to be forwarded over based upon an identifier of the VPN connection upon which the traffic was received.

19. The electronic device of claim 17, wherein the gateway router is further to:

responsive to another scaling unit being made active for use by the scalable virtual IP appliance, establish another forwarding tunnel that terminates at the another scaling unit of the scalable virtual IP appliance; and

forward an additional one or more received packets via the another forwarding tunnel, wherein the additional one or more received packets have, as their destination address, the virtual IP address associated with the scalable virtual IP appliance.

20. The electronic device of claim 17, wherein the gateway router is further to:

receive a message from the scalable virtual IP appliance indicating that a packet classification should be associated with a different one of the plurality of forwarding tunnels, wherein prior to the receipt of the message, the packet classification was associated with an initial one of the plurality of forwarding tunnels; and

after said receipt of the message;

receive another one or more packets that have, as their destination address, the virtual IP address associated with the scalable virtual IP appliance, and

forward, due to the another one or more packets having the packet classification, the another one or more packets via the different one of the plurality of forwarding tunnels.