ENTERPRISE NETWORK SERVICES OVER DISTRIBUTED CLOUDS

1 . A method performed by a cloud controller for providing a network service, the method comprising:

determining that a new virtual gateway location should be created;

selecting a data center of a plurality of data centers to host the new virtual gateway location; and

establishing a virtual gateway at the selected data center, wherein the virtual gateway is configured to provide at least one device with connectivity to a Virtual Private Network (VPN) and connectivity to the Internet.

2 . The method of claim 1 , further comprising establishing a virtual remote access gateway at the selected data center, wherein the virtual remote access gateway is configured to provide a device outside the VPN with access to the VPN.

3 . The method of claim 1 , further comprising establishing a virtual firewall at the selected data center, wherein the virtual firewall is configured to filter traffic associated with the virtual gateway.

4 . The method of claim 1 , wherein the step of determining that a new virtual gateway location should be created comprises receiving an instruction to create a new virtual gateway location.

5 . The method of claim 1 , wherein the step of determining that a new virtual gateway location should be created comprises:

receiving, from an enterprise server, a virtual site policy, wherein the virtual site policy includes criteria for determining when a new virtual gateway location should be created; and

determining that the criteria have been met by the current state of the Virtual Private Network.

6 . The method of claim 1 , wherein the at least one device includes customer premise equipment.

7 . The method of claim 1 , wherein the step of selecting a data center of a plurality of data centers to host the new virtual gateway location is performed based on the geographic distance between the data center and the at least one device.

8 . A method performed by at least one cloud device for providing a network service, the method comprising:

hosting a gateway virtual machine, wherein the gateway virtual machine performs the steps of:

receiving, via an interface of the at least one cloud device, a first packet to be forwarded;

extracting a destination address from the packet;

determining whether the destination address corresponds to a remote enterprise site or a device on the Internet;

transmitting the first packet to a Virtual Private Network (VPN) router based on a correspondence between the destination address and a remote enterprise site; and

transmitting the first packet to a border gateway based on a correspondence between the destination address.

9 . The method of claim 8 , wherein the gateway virtual machine receives the first packet from a customer premise equipment device.

10 . The method of claim 8 , wherein the at least one cloud device further hosts a remote access gateway virtual machine that performs the steps of:

receiving a second packet from the Border Gateway; and

forwarding the second packet to a device connected to the VPN.

11 . The method of claim 8 , wherein the at least one cloud device further hosts a firewall virtual machine that filters packets associated with the gateway virtual machine.

12 . The method of claim 8 , wherein the step of transmitting the first packet to a border gateway comprises performing network address translation (NAT).

13 . The method of claim 8 , further comprising advertising, by the gateway virtual machine to the border gateway, a route to a device from which the first packet originated.

14 . The method of claim 8 , wherein at least one of the VPN router and the border gateway are virtual machines hosted by the at least one cloud device.

15 . A cloud controller for providing a network service, the cloud controller comprising:

a memory; and

a processor communicatively connected to the memory configured to:

determine that a new virtual gateway location should be created,

select a data center of a plurality of data centers to host the new virtual gateway location, and

establish a virtual gateway at the selected data center, wherein the virtual gateway is configured to provide at least one device with connectivity to a Virtual Private Network (VPN) and connectivity to the Internet.

16 . The cloud controller of claim 15 , wherein the processor is further configured to establish a virtual remote access gateway at the selected data center, wherein the virtual remote access gateway is configured to provide a device outside the VPN with access to the VPN.

17 . The cloud controller of claim 15 , wherein the processor is further configured to establish a virtual firewall at the selected data center, wherein the virtual firewall is configured to filter traffic associated with the virtual gateway.

18 . The cloud controller of claim 15 , wherein, in determining that a new virtual gateway location should be created, the processor is configured to:

receive, from an enterprise server, a virtual site policy, wherein the virtual site policy includes criteria for determining when a new virtual gateway location should be created; and

determine that the criteria have been met by the current state of the Virtual Private Network.

19 . The cloud controller of claim 15 , wherein the at least one device includes customer premise equipment.

20 . The cloud controller of claim 15 , wherein the processor is configured to perform the selection of a data center of a plurality of data centers to host the new virtual gateway location based on the geographic distance between the data center and the at least one device.