# US 11,909,558 B2 · Port mapping for bonded interfaces of ECMP group > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,558 B2 - Document ID: US11909558B2 - Status: Granted - Kind: B2 - Application number: 17/880,899 - Filed: 2022-08-04 - Published: 2022-11-24 - Granted: 2024-02-20 - Earliest claimed: 2020-01-14 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Dexiang Wang; Jia Yu; Jayant Jain; Mike Parsa; Haihua Luo - Web page: https://patentgrep.com/patent/US11909558B2 ## CPC - H04L 63/0254: {Stateful filtering} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 45/02: Topology update or discovery - H04L 45/24: Multipath - H04L 49/25: Routing or path finding in a switch fabric - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments of the invention provide novel methods for providing a stateful service at a network edge device (e.g., an NSX edge) that has a plurality of north-facing interfaces (e.g., interfaces to an external network) and a plurality of corresponding south-facing interfaces (e.g., interfaces to a logical network). A set of interfaces on each side of the network edge device for a set of equal cost paths, in some embodiments, are bonded together in the network edge device to correspond to a single interface on either side of a logical bridge including at least one logical switch providing a stateful service implemented by the network edge device. The bond is implemented, in some embodiments, by a bonding module executing on the network edge device that maintains a mapping between ingress and egress interfaces to allow deterministic forwarding through the network edge device in the presence of bonded interfaces. ## Claims ### Claim 1 A method for performing services for a logical first network, the method comprising: deploying a north first set of one or more routers and a south second set of one or more routers as two sets of gateway devices between the logical first network and a second network; deploying a set of services between the two sets of routers in order to perform at least one service on data messages passing through the two sets of routers as the data messages enter or exit the logical network; and defining a logical switch to connect to the first and second sets of routers, and to the set of services, said logical switch forwarding data messages received from one set of routers to one or more services and forwarding data messages received from the one or more services to the other set of routers after the one or more services have performed their operations. ### Claim 2 (depends on 1) The method of claim 1, wherein the set of services are defined in a demilitarized zone (DMZ) that is between the first and second sets of routers. ### Claim 3 (depends on 1) The method of claim 1, wherein deploying the set of services comprises configuring at least one of the first and second sets of routers to direct at least a subset of data message flows incoming to or outgoing from the logical network to one or more of the services. ### Claim 4 (depends on 1) The method of claim 1, wherein the set of services includes at least one of a firewall service, a load balancer service, a network address translation service, and a virtual private network service. ### Claim 5 (depends on 1) The method of claim 1, wherein the logical switch is implemented by a device that also implements a router from at least one of the first and second sets of routers. ### Claim 6 (depends on 1) The method of claim 1, wherein the logical switch is implemented by a device that is separate from any router in the first and second sets of routers. ### Claim 7 (depends on 1) The method of claim 1, wherein the set of services include stateful services for which connection-tracking records are created and inspected. ### Claim 8 (depends on 1) The method of claim 1, wherein at least one of the first and second sets of routers include an active router and a standby router. ### Claim 9 (depends on 1) The method of claim 1, wherein the second network is another logical network. ### Claim 10 A non-transitory machine readable medium storing a program which when executed by at least one processing unit performs services for a logical first network, the program comprising sets of instructions for: configuring a north first set of one or more routers and a south second set of one or more routers as two sets of gateway devices between the logical first network and a second network; configuring a set of services between the two sets of routers in order to perform at least one service on data messages passing through the two sets of routers as the data messages enter or exit the logical network; and configuring a logical switch to connect to the first and second sets of routers, and to the set of services, said logical switch forwarding data messages received from one set of routers to one or more services and forwarding data messages received from the one or more services to the other set of routers after the one or more services have performed their operations. ### Claim 11 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of services are configured in a demilitarized zone (DMZ) that is between the first and second sets of routers. ### Claim 12 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of instructions for configuring the set of services comprises a set of instructions for configuring at least one of the first and second sets of routers to direct at least a subset of data message flows incoming to or outgoing from the logical network to one or more of the services. ### Claim 13 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of services includes at least one of a firewall service, a load balancer service, a network address translation service, and a virtual private network service. ### Claim 14 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the logical switch is implemented by a device that also implements a router from at least one of the first and second sets of routers. ### Claim 15 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the logical switch is implemented that is separate from any router in the first and second sets of routers. ### Claim 16 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of services include stateful services for which connection-tracking records are created and inspected. ### Claim 17 (depends on 10) The non-transitory machine readable medium of claim 10, wherein at least one of the first and second sets of routers include an active router and a standby router. ### Claim 18 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the second network is another logical network.