Method and system of a cloud-based multipath routing protocol
In one aspect, a computerized system useful for implementing a cloud-based multipath routing protocol to an Internet endpoint includes an edge device that provides an entry point into an entity's core network. The entity's core network includes a set of resources to be reliably accessed. The computerized system includes a cloud-edge device instantiated in a public-cloud computing platform. The cloud-edge device joins a same virtual routing and forwarding table as the edge device. The cloud-edge device receives a set of sources and destinations of network traffic that are permitted to access the edge device and the set of resources.
1. A method for providing cloud-based multipath routing between a gateway and an edge device, the method comprising:
at the edge device, which connects a set of resources of a core network to at least one external network:
receiving a set of gateway configuration data comprising a set of forwarding rules and a set of access control list (ACL) rules, the set of ACL rules identifying a set of sources and destinations of network traffic that are permitted to access the set of resources; and
transmitting the received gateway configuration data to at least a first gateway, the set of forwarding rules of the gateway configuration data for configuring first and second gateways to implement a same virtual routing and forwarding (VRF) table,
wherein (i) the first gateway receives a first data message from a first client device, determines, based on the set of ACL rules, that the first client device is permitted to access the set of resources, and forwards, using the VRF table, the first data message to the edge device, and (ii) the second gateway receives a second data message from a second client device, determines, based on the set of ACL rules, that the second client device is permitted to access the set of resources, and forwards, using the VRF table, the second data message to the edge device, wherein the first and second client devices do not belong to the core network.
2. The method of claim 1 , wherein the core network comprises one of an enterprise's core network and a service-provider's core network.
3. The method of claim 1 , wherein the edge device is a virtual machine executing on a host in one of a branch office and a customer premises.
4. The method of claim 1 , wherein the first and second gateways implement a cloud gateway, each gateway of the cloud gateway implementing the VRF table and associated with a same logical identifier.
5. The method of claim 4 , wherein the first and second messages are addressed to a same public Internet protocol (IP) address of the cloud gateway.
6. The method of claim 5 , wherein the public IP address is the IP address of a gateway load balancer of the cloud gateway.
7. The method of claim 6 , wherein the first client device accesses the set of resources by accessing the public IP address assigned to the cloud gateway and does not connect to the set of resources by directly accessing an IP address associated with the set of resources, wherein the first client device securely connects to the set of resources over a virtual private network (VPN) via the first gateway.
8. The method of claim 1 , wherein the first data message is forwarded to the edge device via a first link of a multilink bundle connecting the edge device to the first gateway, wherein if the first link of the multilink bundle fails, remaining links of the multilink bundle continue to provide access to the set of resources via the first gateway.
9. The method of claim 1 , wherein the first and second gateways are configured to deny any inbound network traffic by default.
10. The method of claim 1 , wherein the first client device and the second client device are a same client device.
11. A non-transitory machine readable medium storing a program that, when executed by a set of processing units of an edge device, provides cloud-based multipath routing, the program comprising sets of instructions for:
at the edge device, which connects a set of resources of a core network to at least one external network:
receiving a set of gateway configuration data comprising a set of forwarding rules and a set of access control list (ACL) rules, the set of ACL rules identifying a set of sources and destinations of network traffic that are permitted to access the set of resources; and
transmitting the received gateway configuration data to at least a first gateway, the set of forwarding rules of the gateway configuration data for configuring first and second gateways to implement a same virtual routing and forwarding (VRF) table,
wherein (i) the first gateway receives a first data message from a first client device, determines, based on the set of ACL rules, that the first client device is permitted to access the set of resources, and forwards, using the VRF table, the first data message to the edge device, and (ii) the second gateway receives a second data message from a second client device, determines, based on the set of ACL rules, that the second client device is permitted to access the set of resources, and forwards, using the VRF table, the second data message to the edge device, wherein the first and second client devices do not belong to the core network.
12. The non-transitory machine readable medium of claim 11 , wherein the core network comprises one of an enterprise's core network and a service-provider's core network.
13. The non-transitory machine readable medium of claim 11 , wherein the edge device is a virtual machine executing on a host in one of a branch office and a customer premises.
14. The non-transitory machine readable medium of claim 11 , wherein the first and second gateways implement a cloud gateway, each gateway of the cloud gateway implementing the VRF table and associated with a same logical identifier.
15. The non-transitory machine readable medium of claim 14 , wherein the first and second messages are addressed to a same public Internet protocol (IP) address of the cloud gateway.
16. The non-transitory machine readable medium of claim 15 , wherein the public IP address is the IP address of a gateway load balancer of the cloud gateway.
17. The non-transitory machine readable medium of claim 15 , wherein the first client device accesses the set of resources by accessing the public IP address assigned to the cloud gateway and does not connect to the set of resources by directly accessing an IP address associated with the set of resources, wherein the first client device securely connects to the set of resources over a virtual private network (VPN) via the first gateway.
18. The non-transitory machine readable medium of claim 11 , wherein the first and second gateways are configured to deny any inbound network traffic by default.
19. The non-transitory machine readable medium of claim 11 , wherein the first data message is forwarded to the edge device via a first link of a multilink bundle connecting the edge device to the first gateway, wherein if the first link of the multilink bundle fails, remaining links of the multilink bundle continue to provide access to the set of resources via the first gateway.
20. The non-transitory machine readable medium of claim 11 , wherein the first client device and the second client device are a same client device.