Service-based traffic split on secure tunnel

A non-transitory computer-readable medium storing source code, a local access network (LAN) extension device communicatively coupled to a LAN and to a wide-area network (WAN), at least partially implemented in hardware, that when executed by a processor, performs a method for selectively splitting data traffic for exclusion from secure tunneling based on service type, the method comprising:

• establishing a virtual extendable LAN (VXLAN) over a secure tunnel from the network edge device to a remote LAN firewall;
• enabling a split traffic mode in the network edge device, wherein a default mode of the network edge device is configured to transmit WAN data traffic over a secure tunnel for traversing the remote firewall en route to the WAN, and receiving a selection of one or more types of service to be split from WAN data traffic headed to the secure tunnel for direct transmission over the WAN without traversing the remote firewall;
• responsive to enabling the split traffic mode, configuring a software-based switch to split layer-2 data traffic between an aggregation link communicatively coupled to the WAN over the secure tunnel and a layer 3 NAT communicatively coupled directly to the WAN;
• receiving, at an input port, a session of data packets directed to the WAN from a client;
• classifying a service type associated with the session;
• responsive to the service type classification matching at least one of the one or more split service types, bypassing the secure tunnel for the session with the remote destination by switching to the layer 3 NAT for direct transmission to the WAN;
• and
• responsive to the service type classification not matching at least one of the one or more split service types, continuing default mode by switching to the aggregation link for transmission to the WAN through the remote firewall.

A local access network (LAN) extension device communicatively coupled to a LAN and to a wide-area network (WAN), for selectively splitting data traffic for exclusion from secure tunneling based on service type, the LAN extension device comprising:

• a processor;
• a network interface communicatively coupled to the processor and to the WAN and to the LAN;
• and
• a memory, communicatively coupled to the processor and storing:
• a VXLAN module configured to establish a virtual extendable LAN (VXLAN) over a secure tunnel from the network edge device to a remote LAN firewall;
• a software switch module configured to enable a split traffic mode in the network edge device, wherein a default mode of the network edge device is configured to transmit WAN data traffic over a secure tunnel for traversing the remote firewall en route to the WAN, and receiving a selection of one or more types of service to be split from WAN data traffic headed to the secure tunnel for direct transmission over the WAN without traversing the remote firewall;
• wherein responsive to enabling the split traffic mode, the software switch module configures a software-based switch to split layer-2 data traffic between an aggregation link communicatively coupled to the WAN over the secure tunnel and a layer 2 switch communicatively coupled directly to the WAN;
• a classifier to receive, at an input port, a session of data packets directed to the WAN from a client;
• wherein the classifier identifies a service type associated with the session,
• wherein the software switch module, responsive to the service type classification matching at least one of the one or more split service types, bypasses the secure tunnel for the session with the remote destination by switching to the layer-2 switch for direct transmission to the WAN, and
• wherein the software switch module, responsive to the service type classification not matching at least one of the one or more split service types, continues default mode by switching to the aggregation link for transmission to the WAN through the remote firewall.