System and method for flow classification in multitenant VPN networks
A cloud exchange platform includes policy-based routing. Labeling (or tagging) on a multi-tenant virtual private network (VPN) facilitates recognition of active routes for a flow. The tags can be implemented such that flows are treated as having active routes across a multi-tenant VPN to enable a customer to treat flows as having an identifiable active route through the multi-tenant VPN. Thus, for example, BGP can be used as a generalized signaling protocol to carry information about flows through a multi-tenant VPN.
1 . A system comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the system to perform:
computing a symmetric hash value based on packet header fields including source IP address, destination IP address, source port, destination port, and protocol field, wherein the symmetric hash is computed by sorting at least the IP addresses and port numbers of the packet header fields prior to hashing, such that both forward and reverse packets associated with a flow are mapped to a common service point attachment node (S-node);
selecting the S-node based on the symmetric hash;
configuring a branch node (B-node) router as a first exterior Border Gateway Protocol (eBGP) peer for a virtual private network (VPN) tunnel through a multitenant VPN network;
configuring a service node (S-node) router as a second eBGP peer for the VPN tunnel through the multitenant VPN network, wherein the S-node router is configured to preserve information carried in tags applied at the B-node router such that the tag information is not forgotten across the VPN tunnel, thereby enabling enforcement of policy associated with the flow across the multitenant VPN network;
tagging a first packet of the flow, bound for the selected S-node through the VPN tunnel of the multitenant VPN network via the B-node router, with a first tag;
associating the first tag with the flow through the multitenant VPN network, wherein the association enables maintaining flow identity during scaling of S-nodes by employing a consistent hashing function;
determining whether a second packet, received from a service provider via the S-node and bound for the B-node through the VPN tunnel, has the first tag;
when the second packet has the first tag, identifying the second packet as belonging to the flow, and responsive to identifying the second packet as belonging to the flow based on the first tag, running eBGP pairing within the VPN tunnel between the first eBGP peer and the second eBGP peer; and
when the second packet does not have the first tag, identifying the second packet as belonging to a different flow.
2 . The system of claim 1 , wherein the instructions further cause the system to perform: configuring a multitenant VPN spanning branch-side exterior Border Gateway Protocol (eBGP) peer at the edge of an autonomous branch network.
3 . The system of claim 1 , wherein the instructions further cause the system to perform: configuring the multitenant VPN spanning service-side exterior Border Gateway Protocol (eBGP) peer at the edge of a service provider network.
4 . A system comprising:
a multitenant virtual private network (VPN) gateway protocol labeling engine coupled to a multitenant VPN, wherein the multitenant VPN gateway protocol labeling engine is coupled to a branch node (B-node) router and a service node (S-node) router;
a flow characteristics datastore coupled to the multitenant VPN gateway protocol labeling engine;
a multitenant VPN gateway protocol routing engine coupled to the multitenant VPN;
a routing datastore coupled to the multitenant VPN gateway protocol routing engine;
a consistent hashing engine configured to compute a symmetric hash value based on packet header fields including source IP address, destination IP address, source port, destination port, and protocol field;
a first exterior Border Gateway Protocol (eBGP) peer, coupled to the multitenant VPN gateway protocol labeling engine, that is configured to run through a VPN tunnel of the multitenant VPN; and
a second eBGP peer, coupled to the multitenant VPN gateway protocol routing engine, that is configured to run through the VPN tunnel of the multitenant VPN;
wherein, in operation:
the consistent hashing engine computes the symmetric hash by sorting at least the IP addresses and port numbers of the packet header fields prior to hashing, such that both forward and reverse packets associated with a flow are mapped to a common service point attachment node (S-node);
the consistent hashing engine selects the S-node using the symmetric hash;
the multitenant VPN gateway protocol labeling engine tags a first packet of the flow, bound for the selected S-node through the VPN tunnel of the multitenant VPN via the B-node router, with a first tag that is identifiable using the flow characteristics datastore, wherein the S-node router is configured to preserve information carried in tags applied at the B-node router such that the tag information is not forgotten across the VPN tunnel, thereby enabling enforcement of policy associated with the flow across the multitenant VPN network;
the multitenant VPN gateway protocol routing engine identifies the first packet as part of the flow by reading the first tag and enforces gateway protocol rules applicable to the flow when using the routing datastore to route the first packet, wherein association enables maintaining flow identity during scaling of S-nodes by employing a consistent hashing function;
the multitenant VPN gateway protocol routing engine determines whether a second packet, received from a service provider via the S-node and bound for the B-node through the VPN tunnel, has the first tag;
when the second packet has the first tag, the multitenant VPN gateway protocol routing engine identifies the second packet as belonging to the flow and enforces the gateway protocol rules applicable to the first flow when using the routing datastore to route the second packet, and responsive to the identification of the second packet as belonging to the flow based on the first tag, running eBGP pairing within the VPN tunnel between the first eBGP peer and the second eBGP peer; and
when the second packet does not have the first tag, the multitenant VPN gateway protocol routing engine identifies the second packet as belonging to a different flow.
5 . The system of claim 4 , further comprising:
an autonomous branch network multitenant VPN user interface engine coupled to the multitenant VPN, wherein one or more of the gateway protocol rules are provided via an autonomous branch network multitenant VPN user interface of the autonomous branch network multitenant VPN user interface engine.
6 . The system of claim 4 , wherein the multitenant VPN gateway protocol labeling engine includes a Border Gateway Protocol (BGP) labeling engine.
7 . The system of claim 4 , wherein the multitenant VPN gateway protocol routing engine includes a Border Gateway Protocol (BGP) routing engine.
8 . The system of claim 4 , wherein the multitenant VPN gateway protocol labeling engine is coupled to a virtual network facing node (V-node) router.
9 . A method comprising:
computing a symmetric hash value based on packet header fields including source IP address, destination IP address, source port, destination port, and protocol field, wherein the symmetric hash is computed by sorting at least the IP addresses and port numbers of the packet header fields prior to hashing, such that both forward and reverse packets associated with a flow are mapped to a common service point attachment node (S-node);
selecting the S-node based on the symmetric hash;
configuring a branch node (B-node) router as a first exterior Border Gateway Protocol (eBGP) peer for a virtual private network (VPN) tunnel through a multitenant VPN network;
configuring a service node (S-node) router as a second eBGP peer for the VPN tunnel through the multitenant VPN network, wherein the S-node router is configured to preserve information carried in tags applied at the B-node router such that the tag information is not forgotten across the VPN tunnel, thereby enabling enforcement of policy associated with the flow across the multitenant VPN network;
tagging a first packet of the flow, bound for the selected S-node through the VPN tunnel of the multitenant VPN network via the B-node router, with a first tag;
associating the first tag with the flow through the multitenant VPN network, wherein the association enables maintaining flow identity during scaling of S-nodes by employing a consistent hashing function;
determining whether a second packet, received from a service provider via the S-node and bound for the B-node through the VPN tunnel, has the first tag;
when the second packet has the first tag, identifying the second packet as belonging to the flow, and responsive to identifying the second packet as belonging to the flow based on the first tag, running eBGP pairing within the VPN tunnel between the first eBGP peer and the second eBGP peer; and
when the second packet does not have the first tag, identifying the second packet as belonging to a different flow.
10 . The method of claim 9 , further comprising:
configuring a multitenant VPN spanning branch-side exterior Border Gateway Protocol (eBGP) peer at the edge of an autonomous branch network.
11 . The method of claim 9 , further comprising:
configuring the multitenant VPN spanning service-side exterior Border Gateway Protocol (eBGP) peer at the edge of a service provider network.