Virtual links for network appliances

• US 9,967,140 B2
• Filed: 05/12/2016
• Issued: 05/08/2018
• Est. Priority Date: 01/15/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Di Benedetto, Marco, Rolando, Pierluigi Vincent, Flynn, Thomas Vincent
• Primary Examiner(s): Nguyen, Phuoc
• Application Number:
  US15/152,614
• Publication Number:
  US 20160254951A1
• Time in Patent Office: 726 Days
• Field of Search: 709228
• CPC Class Codes: H04L 12/46 Interconnection of networks
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 45/64 using an overlay routing layer

Abstract

Creating virtual links including: determining a first network appliance to configure to communicate with a second network appliance using a virtual link, wherein the virtual link comprises a layer three overlay point-to-point data link; and determining the second network appliance to configure to communicate with the first network appliance using the virtual link.

Claims

1. A method comprising:

provisioning a first network appliance to perform a first network service, wherein the first network appliance is provisioned on a first device;

associating an inner interface of the first network appliance with a first Internet Protocol (IP) address;

associating an outer interface of the first network appliance with a second IP address;

receiving a data packet on the inner interface from the first network appliance, the received data packet including a first header using a first communication protocol;

encapsulating the received data packet by adding a tunnel header to the received data packet to generate an encapsulated packet, the tunnel header using a second communication protocol independent of the first communication protocol and including the second IP address as a source address for the encapsulated packet;

transmitting the encapsulated packet via the outer interface using a virtue link to a second network appliance; and

migrating the first network appliance to a second device, wherein the virtual link is maintained between the first network appliance and the second network appliance after the migration.

2. The method of claim 1, wherein the second network appliance is configured to perform a second network service, and associated with an inner interface and an outer interface of the second network appliance.

3. The method of claim 2, further comprising:

receiving the encapsulated packet on the outer interface of the second network appliance, wherein the outer interface of the first network appliance and the outer interface of the second network appliance form a virtual link;

decapsulating the received encapsulated packet by removing the tunnel header to generate a decapsulated packet; and

transmitting the decapsulated packet via the inner interface of the second network appliance to the second network appliance.

4. The method of claim 3, wherein the virtual link is provisioned for the first network appliance and the second network appliance by a managing entity.

5. The method of claim 3, wherein the inner interface of the first network appliance and the inner interface of the second network appliance are provisioned by an administrator associated with the first network appliance and the second network appliance.

6. The method of claim 3, wherein the virtual link comprises a point-to-point data link between the outer interface of the first network appliance and the outer interface of the second network appliance.

7. A system comprising:

a processor configured to;

provision a first network appliance to perform a first network service, wherein the first network appliance is provisioned on a first device;

associate an inner interface of the first network appliance with a first Internet Protocol (IP) address;

associate an outer interface of the first network appliance with a second IP address;

obtain a data packet received on the inner interface from the first network appliance, the received data packet including a first header using a first communication protocol;

encapsulate the received data by adding a tunnel header to the received data packet to generate an encapsulated packet, the tunnel header using a second communication protocol independent of the first communication protocol and including the second IP address as a source address for the encapsulated packet;

transmit the encapsulated packet via the outer interface using a virtue link to a second network appliance; and

migrate the first network appliance to a second device, wherein the virtual link is maintained between the first network appliance and the second network appliance after the migration.

8. The system of claim 7, wherein the second network appliance is configured to perform a second network service, and associated with an inner interface and an outer interface of the second network appliance.

9. The system of claim 8, wherein the processor is further configured to:

configure the second network appliance to receive the encapsulated packet on the outer interface of the second network appliance, wherein the outer interface of the first network appliance and the outer interface of the second network appliance form a virtual link;

configure the second network appliance to decapsulate the received encapsulated packet by removing the tunnel header to generate a decapsulated packet; and

configure the second network appliance to transmit the decapsulated packet via the inner interface of the second network appliance to the second network appliance.

10. The system of claim 9, wherein the virtual link is provisioned for the first network appliance and the second network appliance by a managing entity.

11. The system of claim 9, wherein the inner interface of the first network appliance and the inner interface of the second network appliance are provisioned by an administrator associated with the first network appliance and the second network appliance.

12. The system of claim 9, wherein the virtual link comprises a point-to-point data link between the outer interface of the first network appliance and the outer interface of the second network appliance.

13. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

provisioning a first network appliance to perform a first network service, wherein the first network appliance is provisioned on a first device;

associating an inner interface of the first network appliance with a first Internet Protocol (IP) address;

associating an outer interface of the first network appliance with a second IP address;

receiving a data packet on the inner interface from the first network appliance, the received data packet including a first header using a first communication protocol;

encapsulating the received data packet by adding a tunnel header to the received data packet to generate an encapsulated packet, the tunnel header using a second communication protocol independent of the first communication protocol and including the second IP address as a source address for the encapsulated packet;

transmitting the encapsulated packet via the outer interface using a virtue link to a second network appliance; and

migrating the first network appliance to a second device, wherein the virtual link is maintained between the first network appliance and the second network appliance after the migration.

14. The computer program product of claim 13, wherein the second network appliance is configured to perform a second network service, and associated with an inner interface and an outer interface of the second network appliance.

15. The computer program product of claim 13, further comprising computer instructions for:

receiving the encapsulated packet on the outer interface of the second network appliance, wherein the outer interface of the first network appliance and the outer interface of the second network appliance form a virtual link;

decapsulating the received encapsulated packet by removing the tunnel header to generate a decapsulated packet; and

transmitting the decapsulated packet via the inner interface of the second network appliance to the second network appliance.

16. The computer program product of claim 15, wherein the virtual link is provisioned for the first network appliance and the second network appliance by a managing entity.

17. The computer program product of claim 15, wherein the inner interface of the first network appliance and the inner interface of the second network appliance are provisioned by an administrator associated with the first network appliance and the second network appliance.

18. The computer program product of claim 15, wherein the virtual link comprises a point-to-point data link between the outer interface of the first network appliance and the outer interface of the second network appliance.