Back to results
US 11,962,498 B1Granted
Symmetric networking for orphan workloads in cloud networks
AssigneeCisco Technology, Inc.
InventorsBalaji Sundararajan, Ramakumara Kariyappa, Nithin Bangalore Raju, Bhairav Dutia, Vivek Agarwal, Satish Kumar Mahadevan, Ankur Bhargava
Life of this patent
Estimating the term…
Abstract
Symmetric networking techniques disclosed herein can be applied by gateway routers in cloud networks. The techniques can ensure that both outbound traffic received at a cloud from a branch device and return traffic directed from the cloud back to the branch device are processed by a same gateway router. The gateway router can use network address translation to insert IP addresses from an inside pool and an outside pool assigned to the router.
Claims20
A method comprising:
- receiving, by a router associated with a cloud, a first network packet via a branch device, wherein the branch device is external to the cloud and wherein the first network packet comprises a first destination internet protocol address and a first source internet protocol address;
- selecting, by the router, a second source internet protocol address from a network address translation pool, wherein the network address translation pool comprises a group of internet protocol addresses;
- inserting, by the router, the second source internet protocol address into the first network packet as an updated first network packet source internet protocol address, resulting in a modified first network packet;
- storing, by the router, a mapping data structure comprising a relation between the second source internet protocol address and the first source internet protocol address;
- forwarding, by the router, the modified first network packet via a firewall to a cloud workload associated with the cloud;
- receiving, by the router, a second network packet via the firewall and from the cloud workload, wherein the second network packet comprises a third source internet protocol address associated with the cloud workload, and a second destination internet protocol address, wherein the second destination internet protocol address matches the second source internet protocol address;
- using, by the router, the mapping data structure and the second destination internet protocol address to identify the first source internet protocol address;
- inserting, by the router, the first source internet protocol address into the second network packet as an updated second network packet destination address, resulting in a modified second network packet;
- and
- forwarding, by the router, the modified second network packet via the branch device and towards the updated second network packet destination address.
7 more elements
A router device associated with a cloud, the router device comprising:
- one or more processors;
- one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving a first network packet via a branch device, wherein the branch device is external to the cloud and wherein the first network packet comprises a first destination internet protocol address and a first source internet protocol address;
- selecting a second source internet protocol address from a network address translation pool, wherein the network address translation pool comprises a group of internet protocol addresses;
- inserting the second source internet protocol address into the first network packet as an updated first network packet source internet protocol address, resulting in a modified first network packet;
- storing a mapping data structure comprising a relation between the second source internet protocol address and the first source internet protocol address;
- forwarding the modified first network packet via a firewall to a cloud workload associated with the cloud;
- receiving a second network packet via the firewall and from the cloud workload, wherein the second network packet comprises a third source internet protocol address associated with the cloud workload, and a second destination internet protocol address, wherein the second destination internet protocol address matches the second source internet protocol address;
- using the mapping data structure and the second destination internet protocol address to identify the first source internet protocol address;
- inserting the first source internet protocol address into the second network packet as an updated second network packet destination address, resulting in a modified second network packet;
- and
- forwarding the modified second network packet via the branch device and towards the updated second network packet destination address.
9 more elements
A non-transitory computer-readable storage medium comprising computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to perform operations comprising:
- receiving a first network packet via a branch device, wherein the branch device is external to a cloud and wherein the first network packet comprises a first destination internet protocol address and a first source internet protocol address;
- selecting a second source internet protocol address from a network address translation pool, wherein the network address translation pool comprises a group of internet protocol addresses;
- inserting the second source internet protocol address into the first network packet as an updated first network packet source internet protocol address, resulting in a modified first network packet;
- storing a mapping data structure comprising a relation between the second source internet protocol address and the first source internet protocol address;
- forwarding the modified first network packet via a firewall to a cloud workload associated with the cloud;
- receiving a second network packet via the firewall and from the cloud workload, wherein the second network packet comprises a third source internet protocol address associated with the cloud workload, and a second destination internet protocol address, wherein the second destination internet protocol address matches the second source internet protocol address;
- using the mapping data structure and the second destination internet protocol address to identify the first source internet protocol address;
- inserting the first source internet protocol address into the second network packet as an updated second network packet destination address, resulting in a modified second network packet;
- and
- forwarding the modified second network packet via the branch device and towards the updated second network packet destination address.
7 more elements
Dependencies are inferred from the claim text.