NAT route distribution based on tag information in an SDWAN overlay network
A process can include determining a plurality of Network Address Translation (NAT) routes associated with respective edge routers included in a same virtual private network (VPN) for communicating with a software-defined wide area network (SDWAN). A process can include identifying a first subset of the plurality of NAT routes as mapped to a first public NAT address included in a NAT pool associated with the VPN. A process can include tagging each NAT route of the first subset with a tag value indicative of a preferred router for receiving return traffic of the respective NAT route. A process can include routing traffic on a respective NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a corresponding control policy matching the tag value of the respective NAT route.
1 . A method comprising:
determining a plurality of Network Address Translation (NAT) routes associated with one or more edge routers included in a virtual private network (VPN) for communicating with a software-defined wide area network (SDWAN);
identifying a first NAT route and a second NAT route mapped to a first public NAT address associated with the VPN;
tagging the first NAT route with a first tag value and the second NAT route with a second tag value, each tag value indicative of a preferred router for receiving return traffic of the respective NAT route; and
routing traffic on the first NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a control policy matching the first tag value of the first NAT route.
2 . The method of claim 1 , wherein the first tag value and second tag value uniquely correspond to an identity of the respective edge router configured as a source of the respective NAT route.
3 . The method of claim 1 , further comprising routing traffic on the second NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a control policy matching the second tag value of the second NAT route.
4 . The method of claim 1 , wherein NAT route tag values are not reused within a local site of the VPN or SDWAN.
5 . The method of claim 1 , wherein tagging the first NAT route includes:
appending the first tag value that is locally unique within a local site of a source edge router corresponding to the first NAT route; and
distributing overlay management protocol (OMP) information indicative of aggregate NAT route prefix information and tag value information.
6 . The method of claim 1 , wherein the first NAT route and the second NAT route are associated with respective edge routers included in a local site of the VPN or SDWAN.
7 . The method of claim 1 , wherein a corresponding tag value is appended to each aggregate prefix of one or more aggregate prefixes, and wherein the one or more aggregate prefixes are determined based on shared tag values.
8 . A system comprising:
one or more processors; and
one or more computer-readable storage media having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by the one or more processors, cause the one or more processors to:
determine a plurality of Network Address Translation (NAT) routes associated with one or more edge routers included in a virtual private network (VPN) for communicating with a software-defined wide area network (SDWAN);
identify a first NAT route and a second NAT route mapped to a first public NAT address associated with the VPN;
tag the first NAT route with a first tag value and the second NAT route with a second tag value, each tag value indicative of a preferred router for receiving return traffic of the respective NAT route; and
route traffic on the first NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a control policy matching the first tag value of the first NAT route.
9 . The system of claim 8 , wherein the first tag value and the second tag value uniquely correspond to an identity of the respective edge router configured as a source of the respective NAT route.
10 . The system of claim 8 , further comprising routing traffic on the second NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a control policy matching the second tag value of the second NAT route.
11 . The system of claim 8 , wherein NAT route tag values are not reused within a local site of the VPN or SDWAN.
12 . The system of claim 8 , wherein tagging the first NAT route includes:
appending the first tag value that is locally unique within a local site of a source edge router corresponding to the first NAT route; and
distributing overlay management protocol (OMP) information indicative of aggregate NAT route prefix information and tag value information.
13 . The system of claim 8 , wherein the first NAT route and the second NAT route are associated with respective edge routers included in a local site of the VPN or SDWAN.
14 . The system of claim 8 , wherein a corresponding tag value is appended to each aggregate prefix of one or more aggregate prefixes, and wherein the one or more aggregate prefixes are determined based on shared tag values.
15 . One or more non-transitory computer-readable media comprising computer-readable instructions, which when executed by one or more processors, cause the one or more processors to:
determine a plurality of Network Address Translation (NAT) routes associated with one or more edge routers included in a virtual private network (VPN) for communicating with a software-defined wide area network (SDWAN);
identify a first NAT route and a second NAT route mapped to a first public NAT address associated with the VPN;
tag the first NAT route with a first tag value and the second NAT route with a second tag value, each tag value indicative of a preferred router for receiving return traffic of the respective NAT route; and
route traffic on the first NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a control policy matching the first tag value of the first NAT route.
16 . The one or more non-transitory computer-readable media of claim 15 , wherein the first tag value and second tag value uniquely correspond to an identity of the respective edge router configured as a source of the respective NAT route.
17 . The one or more non-transitory computer-readable media of claim 15 , further comprising routing traffic on the second NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a control policy matching the second tag value of the second NAT route.
18 . The one or more non-transitory computer-readable media of claim 15 , wherein NAT route tag values are not reused within a local site of the VPN or SDWAN.
19 . The one or more non-transitory computer-readable media of claim 15 , wherein tagging the first NAT route includes:
appending the first tag value that is locally unique within a local site of a source edge router corresponding to the first NAT route; and
distributing overlay management protocol (OMP) information indicative of aggregate NAT route prefix information and tag value information.
20 . The one or more non-transitory computer-readable media of claim 15 , wherein the first NAT route and the second NAT route are associated with respective edge routers included in a local site of the VPN or SDWAN.