Tunneling STUN Packets in the Presence of Endpoint-Dependent NAT
AssigneeArista Networks, Inc.
InventorAnand Narayanan RAO
Life of this patent
Estimating the term…
Abstract
Techniques are provided for tunneling Session Traversal Utilities for NAT (STUN) packets between an edge device and a route reflector in a scenario where the edge device is behind an endpoint-dependent NAT (i.e., a NAT that performs different translations on network packets based on the destination of each packet). In certain embodiments, these techniques ensure that the route reflector learns/discovers “correct” public IP address/port information for the edge device in this scenario, or in other words public IP address/port information that enables the route reflector and the edge device to exchange tunneled data traffic.
Claims20
A method performed by an edge network device in a Software-Defined Wide Area Network (SD-WAN), the method comprising:
- receiving, from a Session Traversal Utilities for Network Address Translation (STUN) client running on the edge network device, a STUN binding request packet destined for a STUN server running on a route reflector of the SD-WAN;
- encapsulating the STUN binding request packet within an overlay tunnel header, an outer Internet Protocol (IP) header, and an outer User Datagram Protocol (UDP) header, the encapsulated STUN binding request packet including:
- a tunnel port in a destination port field of the outer UDP header, wherein the tunnel port is used for communication between the edge network device and the route reflector via an overlay tunnel;
- and
- a first packet type in a packet type field of the overlay tunnel header, the first packet type indicating that the encapsulated STUN binding request packet is a STUN protocol packet;
- and
- transmitting the encapsulated STUN binding request packet to the route reflector via a service provider network.
An edge network device that is part of a Software-Defined Wide Area Network (SD-WAN), the edge network device comprising:
- a processor;
- and
- a memory having stored thereon program code that, when executed by the processor, causes the processor to:
- receive, from a Session Traversal Utilities for Network Address Translation (STUN) client running on the edge network device, a STUN binding request packet destined for a STUN server running on a route reflector of the SD-WAN;
- encapsulate the STUN binding request packet within an overlay tunnel header, an outer Internet Protocol (IP) header, and an outer User Datagram Protocol (UDP) header, the encapsulated STUN binding request packet including:
- a tunnel port in a destination port field of the outer UDP header, wherein the tunnel port is used for communication between the edge network device and the route reflector via an overlay tunnel;
- and
- a first packet type in a packet type field of the overlay tunnel header, the first packet type indicating that the encapsulated STUN binding request packet is a STUN protocol packet;
- and
- transmit the encapsulated STUN binding request packet to the route reflector via a service provider network.
A method performed by a route reflector in a Software-Defined Wide Area Network (SD-WAN), the method comprising:
- receiving a Network Address Translation (NAT)-ed encapsulated Session Traversal Utilities for NAT (STUN) binding request packet;
- determining that the received packet is an encapsulated STUN protocol packet by checking a packet type field in an overlay tunnel header in the received packet;
- extracting, from the received packet, a STUN binding request packet originally sent by a STUN client running on an edge network device by:
- removing an outer Internet Protocol (IP) header;
- removing an outer User Datagram Protocol (UDP) header;
- and
- removing the overlay tunnel header;
- modifying a source IP address of the extracted STUN binding request packet to a public IP address included in a source IP address field of the removed outer IP header;
- modifying a source port of the extracted STUN binding request packet to a public port included in a source port field of the removed outer UDP header;
- and
- passing the modified STUN binding request packet to a STUN server running on the route reflector for processing.
Dependencies are inferred from the claim text.