# US 11,122,008 B2 · Service chains for inter-cloud traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,008 B2 - Document ID: US11122008B2 - Status: Granted - Kind: B2 - Application number: 16/870,130 - Filed: 2020-05-08 - Published: 2020-08-27 - Granted: 2021-09-14 - Earliest claimed: 2018-06-06 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Balaji Sundararajan; Samar Sharma - Web page: https://patentgrep.com/patent/US11122008B2 ## CPC - H04L 45/306: {Route determination based on the nature of the carried application} - H04L 41/0894: Policy-based network configuration management - H04L 45/243: using M+N parallel active paths - H04L 45/38: {Flow based routing} - H04L 45/74: Address processing for routing - H04L 61/256: NAT traversal - H04L 61/4511: using domain name system [DNS] - H04L 63/101: {Access control lists [ACL]} - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 45/64: using an overlay routing layer - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and computer-readable media for creating service chains for inter-cloud traffic. In some examples, a system receives domain name system (DNS) queries associated with cloud domains and collects DNS information associated the cloud domains. The system spoofs DNS entries defining a subset of IPs for each cloud domain. Based on the spoofed DNS entries, the system creates IP-to-domain mappings associating each cloud domain with a respective IP from the subset of IPs. Based on the IP-to-domain mappings, the system programs different service chains for traffic between a private network and respective cloud domains. The system routes, through the respective service chain, traffic having a source associated with the private network and a destination matching the IP in the respective IP-to-domain mapping. ## Claims ### Claim 1 A method comprising: allocating, by a network device on a network site, virtual internet protocol (VIP) addresses to respective cloud domains, each respective cloud domain being allocated a reduced number of VIP addresses, the reduced number of VIP addresses associated with the respective cloud domain comprising a smaller number of addresses than a total number of addresses of the respective cloud domain; based on the respective VIP addresses, programming, on the network device, respective service chains for traffic between one or more endpoints on the network site and the respective cloud domains; in response to receiving traffic associated with the respective cloud domain, determining, based on a destination network address translation (NAT), a VIP address from the reduced number of VIP addresses associated with the respective cloud domain; and routing the traffic through the respective service chain based on the VIP address and one or more policies associated with the respective service chain. ### Claim 2 (depends on 1) The method of claim 1, wherein each respective service chain is programmed to route, using one or more respective policies, respective traffic associated with each respective cloud domain through the respective service chain. ### Claim 3 (depends on 1) The method of claim 1, wherein the reduced number of VIP addresses associated with the respective cloud domain comprises a subset of the total number of addresses associated with the respective cloud domain, and wherein the subset of the total number of addresses is determined based on one or more domain name system (DNS) requests associated with the respective cloud domain. ### Claim 4 (depends on 1) The method of claim 1, wherein the reduced number of VIP addresses is selected from DNS information associated with one or more DNS resolution results. ### Claim 5 (depends on 4) The method of claim 4, further comprising: forwarding DNS queries associated with the respective cloud domains to one or more DNS servers; receiving, by the network device, the one or more DNS resolution results from the one or more DNS servers; snooping, by the network device, the one or more DNS resolution results; and based on the snooping, identifying, by the network device, the DNS information associated with the respective cloud domains. ### Claim 6 (depends on 1) The method of claim 1, wherein the one or more policies comprise access control list (ACL) entries, the ACL entries comprising a respective ACL entry for each service in the respective service chain, wherein each respective ACL entry specifies source information associated with the one or more endpoints in the network site, traffic destination information comprising mapping the VIP address to the respective cloud domain, and an instruction to route traffic to the service when a source and destination of the traffic match the source information and the destination information in the respective ACL entry. ### Claim 7 (depends on 6) The method of claim 6, wherein programming the respective service chains comprises programming the ACL entries on a hardware storage device in the network device, and wherein routing the traffic comprises receiving the traffic at the network device and, based on a lookup of the ACL entries programmed on the hardware storage device, matching the source information and destination information of the traffic to a respective source address and destination address in at least one of the ACL entries. ### Claim 8 A network device comprising: one or more processors; and a memory storing instructions, which when executed by the one or more processors, causes the one or more processors to: allocate virtual internet protocol (VIP) addresses to respective cloud domains, each respective cloud domain being allocated a reduced number of VIP addresses, the reduced number of VIP addresses associated with the respective cloud domain comprising a smaller number of addresses than a total number of addresses of the respective cloud domain; based on the respective VIP addresses, program respective service chains for traffic between one or more endpoints on a network site and the respective cloud domains; in response to receiving traffic associated with the respective cloud domain, determining, based on a destination network address translation (NAT), a VIP address from the reduced number of VIP addresses associated with the respective cloud domain; and route the traffic through the respective service chain based on the VIP address and one or more policies associated with the respective service chain. ### Claim 9 (depends on 8) The network device of claim 8, wherein each respective service chain is programmed to route, using one or more respective policies, respective traffic associated with each respective cloud domain through the respective service chain. ### Claim 10 (depends on 8) The network device of claim 8, wherein the reduced number of VIP addresses associated with the respective cloud domain comprises a subset of the total number of addresses associated with the respective cloud domain, and wherein the subset of the total number of addresses is determined based on one or more domain name system (DNS) requests associated with the respective cloud domain. ### Claim 11 (depends on 8) The network device of claim 8, wherein the reduced number of VIP addresses is selected from DNS information associated with one or more DNS resolution results. ### Claim 12 (depends on 11) The network device of claim 11, the memory comprising instructions, which when executed by the one or more processors, cause the one or more processors to: receive one or more DNS resolution results from one or more DNS servers; snoop the one or more DNS resolution results; and based on the snooping, identify the DNS information associated with the respective cloud domains. ### Claim 13 (depends on 8) The network device of claim 8, wherein the one or more policies comprise access control list (ACL) entries, the ACL entries comprising a respective ACL entry for each service in the respective service chain, wherein each respective ACL entry specifies source information associated with the one or more endpoints in the network site, traffic destination information comprising mapping the VIP address to the respective cloud domain, and an instruction to route traffic to the service when a source and destination of the traffic match the source information and the destination information in the respective ACL entry. ### Claim 14 (depends on 13) The network device of claim 13, wherein programming the respective service chains comprises programming the ACL entries on a hardware storage device in the network device, and wherein routing the traffic comprises receiving the traffic at the network device and, based on a lookup of the ACL entries programmed on the hardware storage device, matching the source information and destination information of the traffic to a respective source address and destination address in at least one of the ACL entries. ### Claim 15 A non-transitory computer-readable medium storing instructions, which when executed by one or more processors, cause the one or more processors to: allocate virtual internet protocol (VIP) addresses to respective cloud domains, each respective cloud domain being allocated a reduced number of VIP addresses, the reduced number of VIP addresses associated with the respective cloud domain comprising a smaller number of addresses than a total number of addresses of the respective cloud domain; based on the respective VIP addresses, program respective service chains for traffic between one or more endpoints on a network site and the respective cloud domains; in response to receiving traffic associated with the respective cloud domain, determining, based on a destination network address translation (NAT), a VIP address from the reduced number of VIP addresses associated with the respective cloud domain; and route the traffic through the respective service chain based on the VIP address and one or more policies associated with the respective service chain. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein each respective service chain is programmed to route, using one or more respective policies, respective traffic associated with each respective cloud domain through the respective service chain. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the reduced number of VIP addresses associated with the respective cloud domain comprises a subset of the total number of addresses associated with the respective cloud domain, and wherein the subset of the total number of addresses is determined based on one or more domain name system (DNS) requests associated with the respective cloud domain. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the reduced number of VIP addresses is selected from DNS information associated with one or more DNS resolution results. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, comprising instructions, which when executed by the one or more processors, cause the one or more processors to: receive one or more DNS resolution results from one or more DNS servers; snoop the one or more DNS resolution results; and based on the snooping, identify the DNS information associated with the respective cloud domains. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more policies comprise access control list (ACL) entries, the ACL entries comprising a respective ACL entry for each service in the respective service chain, wherein each respective ACL entry specifies source information associated with the one or more endpoints in the network site, traffic destination information comprising mapping the VIP address to the respective cloud domain, and an instruction to route traffic to the service when a source and destination of the traffic match the source information and the destination information in the respective ACL entry.