US 11,706,196 B1Granted

Anti-spoofing techniques for overlay networks

AssigneeJuniper Networks, Inc.

InventorsSunanda L. Kommula, Nitin Kumar, Dmitry A. Shokarev

Life of this patent

Estimating the term…

Loading patent…

Abstract

A network device is configured to receive an inbound packet from a first server device via a network tunnel, the first inbound packet including an outer header, a virtual private network (VPN) label, an inner header, and a data payload, the inner header including an inner source IP address of a source virtual machine. The processors are also configured to determine a first tunnel identifier, determine, based on the inner source IP address, a second tunnel identifier associated with a second server device hosting the source virtual machine, compare the second tunnel identifier with the first tunnel identifier to determine whether the tunnel on which the first inbound packet was received is the same as a tunnel used for forwarding traffic to the source virtual machine, and drop the inbound packet when the second tunnel identifier does not match the first tunnel identifier.

Claims20

Dependent claims

A method comprising:

receiving, by at least one processor of a network device, a first inbound packet from a first server device, the first inbound packet being received via an overlay tunnel between the network device and the first server device, the first inbound packet including an outer header, a virtual private network (VPN) label, an inner header, and a data payload, the outer header including an outer source address of the first server device and an outer destination address of the network device, and the inner header including an inner source address of a source virtual machine;
determining, by the at least one processor and based on the outer source address and the outer destination address, a first tunnel identifier associated with the overlay tunnel;
determining, by the at least one processor and based on the inner source address, a second tunnel identifier associated with a second server device hosting the source virtual machine;
and
performing an action, by the at least one processor, in response to determining the second tunnel identifier does not match the first tunnel identifier.

2 more elements

A network device comprising a memory and processing circuitry configured to:

receive a first inbound packet from a first server device, the first inbound packet being received via an overlay tunnel between the network device and the first server device, the first inbound packet including an outer header, a virtual private network (VPN) label, an inner header, and a data payload, the outer header including an outer source address of the first server device and an outer destination address of the network device, and the inner header including an inner source address of a source virtual machine;
determine, based on the outer source address and the outer destination address, a first tunnel identifier associated with the overlay tunnel between the network device and the first server device;
determine, based on the inner source address, a second tunnel identifier associated with a second server device hosting the source virtual machine;
and
in response to determining the second tunnel identifier does not match the first tunnel identifier, perform an action.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/007,830Filed 31 Aug 2020 · continuation
Priority: 30 Nov 2017
Granted: 18 Jul 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 12/4633
Interconnection of networks: interconnection of networks using encapsulation techniques, e.g. tunneling
H04L 63/0245
Filtering policies: filtering by information in the payload
H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks