Redundancy support for network address translation (NAT)
Stateful failover redundancy support is provided for network address translation (NAT). A master NAT device is backed-up with at least one back-up NAT device. Existing sessions are synchronized between the two NAT devices, such as via a dedicated link between them. In the event of a failover where the master NAT device is unable to perform its NAT functions, ownership of Internet protocol (IP) addresses is transferred from the master NAT device to the back-up NAT device. The back-up NAT device, which is now owner of the IP addresses, assumes the NAT functionality associated with these IP addresses and continues the existing sessions, as well as processing new sessions.
1. A method performed by a first network device comprising:
receiving session synchronization information, by a first network device and from a second network device, on a virtual local area network (VLAN) connection different from a VLAN connection used to carry network traffic, the session synchronization information being for sessions created on the second network device related to addresses in a second pool of addresses corresponding to a base address, and the session synchronization information includes destination addresses pertaining to the sessions created on the second network device that are useable by the first network device in connection with translating forward and reply traffic pertaining to the sessions created on the second network device;
detecting a failure of the second network device that owns the second pool of addresses corresponding to the base address;
asserting ownership of the second pool of addresses corresponding to the base address in response to detection by the first network device of the failure; and
in response to the asserting ownership, the first network device using information from the received session synchronization information to perform translation for at least one address in the second pool of addresses.
2. The method of claim 1 , wherein asserting ownership of the second pool of addresses comprises asserting ownership of all addresses in the second pool of addresses.
3. The method of claim 1 , wherein translating at least one address in a first pool of addresses comprises translating an address from an inside network address to a global network address.
4. The method of claim 1 , further comprising receiving heartbeat messages on the VLAN connection that does not carry network traffic.
5. The method of claim 1 , further comprising sending a notification message to at least one peer device to indicate that the first network device owns the second pool of addresses.
6. The method of claim 5 , wherein the notification message is a gratuitous address resolution protocol (ARP) message.
7. The method of claim 1 , wherein the first network device is a switch or a router.
8. The method of claim 1 , wherein the translating is network address translation (NAT).
9. The method of claim 1 , wherein the session synchronization information includes an identification of a session, and a destination address for network traffic associated with the identified session.
10. An apparatus comprising a first network device adapted to:
receive session synchronization information, by a first network device and from a second network device, on a virtual local area network (VLAN) connection different from a VLAN connection used to carry network traffic, the session synchronization information being for sessions created on the second network device related to addresses in a second pool of addresses corresponding to a base address, and the session synchronization information includes destination addresses pertaining to the sessions created on the second network device that are useable by the first network device in connection with translating forward and reply traffic pertaining to the sessions created on the second network device;
detect a failure of the second network device that owns the second pool of addresses corresponding to the base address; and
assert ownership of a plurality of addresses in the second pool of addresses corresponding to the base address in response to detection by the first network device of the failure; and
in response to the asserting ownership, the first network device using information from the received session synchronization information to perform translation for at least one address in the second pool of addresses.
11. The apparatus of claim 10 , wherein the first network device is further adapted to assert ownership of all addresses in the second pool of addresses.
12. The apparatus of claim 10 , wherein the first network device is further adapted to translate an address in the first pool of addresses from an inside network address to a global network address.
13. The apparatus of claim 10 , wherein the first network device is further adapted to receive heartbeat messages on the VLAN connection that does not carry network traffic.
14. The apparatus of claim 10 , wherein the first network device is further adapted to send a notification message to at least one peer device to indicate that the first network device owns the second pool of addresses.
15. The apparatus of claim 14 , wherein the notification message is a gratuitous address resolution protocol (ARP) message.
16. The apparatus of claim 10 , wherein the first network device is a switch or a router.
17. An apparatus comprising a first network device adapted to:
send session synchronization information, from a first network device and to a second network device, on a virtual local area network (VLAN) connection different from a VLAN connection used to carry network traffic, the session synchronization information being for sessions created on the first network device related to addresses in a first pool of addresses corresponding to a base address, and the session synchronization information includes destination addresses pertaining to the sessions created on the first network device that are useable by the second network device in connection with translating forward and reply traffic pertaining to the sessions created on the first network device; and
relinquish ownership of a plurality of addresses in the first pool of addresses corresponding to the base address in response to failure of the first network device.
18. The apparatus of claim 17 , wherein the first network device is further adapted to translate an address in the first pool of addresses from an inside network address to a global network address.
19. The apparatus of claim 17 , wherein the first network device is further adapted to send heartbeat messages, to the second network device, on the VLAN connection that does not carry network traffic.
20. The apparatus of claim 17 , wherein the first network device is a switch or a router.