Encrypted tunnel migration
AssigneeCisco Technology, Inc.
InventorsGrzegorz Boguslaw Duraj, Leonardo Rangel Augusto, Kyle Andrew Donald Mestery
Life of this patent
Estimating the term…
Abstract
Techniques for load balancing encrypted traffic based on security parameter index (SPI) values of packet headers and sets of 5-tuple values of the packet headers are described herein. Additionally, techniques for including quality of service (QoS)-type information in SPI value fields of packet headers are also described herein. The QoS-type information may indicate a particular traffic class according to which the packet is to be handled. Further, techniques for pre-configuring a backend host such that encrypted traffic may be migrated to the backend host from another backend host without causing temporary service disruptions are also described herein.
Claims20
A system comprising:
- one or more processors;
- and
- one or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving, at a load balancer and from a client device, first data-plane traffic having a first security parameter index (SPI) value and a set of 5-tuple values;
- sending the first data-plane traffic to a first node based at least in part on the first SPI value, the first node being associated with a first encrypted tunnel;
- receiving, at the load balancer, an indication that additional data-plane traffic received from the client device is to be sent to a second node, the second node being associated with a second encrypted tunnel;
- receiving, at the load balancer and from the client device, second data-plane traffic having a second SPI value and the set of 5-tuple values;
- and
- based at least in part on the second data-plane traffic having the set of 5-tuple values, sending the second data-plane traffic to the second node.
A method comprising:
- receiving, at a load balancer and from a client device, first data-plane traffic having a first security parameter index (SPI) value and a set of 5-tuple values;
- sending the first data-plane traffic to a first node based at least in part on the first SPI value and the set of 5-tuple values;
- receiving, at the load balancer, an indication that at least a portion of the first data-plane traffic is to be sent to a second node;
- based at least in part on the indication, prompting the second node to provision one or more interfaces such that the at least the portion of the first data-plane traffic is sent to the second node;
- receiving, at the load balancer and from the client device, second data-plane traffic having a second SPI value and the set of 5-tuple values;
- based at least in part on the second SPI value and the set of 5-tuple values, determining that the second data-plane traffic is the at least the portion of the first data-plane traffic;
- and
- sending the second data-plane traffic to the second node.
A non-transitory computer-readable media storing instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising:
- receiving, at a load balancer and from a client device, first data-plane traffic having a first security parameter index (SPI) value and a set of 5-tuple values;
- sending the first data-plane traffic to a first node based at least in part on the first SPI value and the set of 5-tuple values;
- receiving, at the load balancer, an indication that at least a portion of the first data-plane traffic is to be sent to a second node;
- based at least in part on the indication, prompting the second node to provision one or more interfaces such that the at least the portion of the first data-plane traffic is sent to the second node;
- receiving, at the load balancer and from the client device, second data-plane traffic including a second SPI value and the set of 5-tuple values;
- based at least in part on the second SPI value and the set of 5-tuple values, determining that the second data-plane traffic is the at least the portion of the first data-plane traffic;
- and
- sending the second data-plane traffic to the second node.
Dependencies are inferred from the claim text.