IP address and routing schemes for overlay network
A communication system includes multiple Point-of-Presence (POP) interfaces distributed in a Wide-Area Network (WAN), and one or more processors coupled to the POP interfaces. The processors are configured to assign to an initiator in the communication system a client Internet Protocol (IP) address, including embedding in the client IP address an affiliation of the initiator with a group of initiators, to assign to a responder in the communication system a service IP address, including embedding in the service IP address an affiliation of the service with a group of responders, and to route traffic between the initiator and the responder, over the WAN via one or more of the POP interfaces, in a stateless manner, based on the affiliation of the initiator and the affiliation of the service, as embedded in the client and service IP addresses.
1. A system, comprising:
multiple Point-of-Presence (POP) interfaces, which are distributed in a Wide-Area Network (WAN);
and one or more processors, which are coupled to the POP interfaces and are configured to:
assign, to an initiator in the system, a client Internet Protocol (IP) address having a first plurality of bits, including embedding in one or more of the bits of the client IP address;
an affiliation of the initiator with a group of initiators, wherein the affiliation of the initiator with the group of initiators comprises an Initiator Meta-Group ID (MGI) value indicative of the affiliation of the initiator, and
a Tenant ID (TIP) comprising a 20-bit value, different than the MGI value or a Responder Meta-Group ID (MGR) value, indicating an affiliation of each client with one or more organizations served by the system;
assign, to a responder in the system, a service IP address having a second plurality of bits, including embedding in one or more of the bits of the service IP address an affiliation of a service with a group of responders, wherein the affiliation of the service with the group of responders comprises the MGR value indicative of the affiliation of the responder;
route traffic between the initiator and the responder, over the WAN via one or more of the POP interfaces, in a stateless manner, based on the affiliation of the initiator and the affiliation of the service, as embedded in the bits of the client and service IP addresses, wherein the routing is performed based on the affiliation of the initiator and the affiliation of the service, as embedded in the bits of the client and service IP addresses;
receive a packet, which is exchanged between the initiator and the responder and which comprises the client IP address and the service IP address;
and enforce a security policy on the packet depending on the affiliation of the initiator and the affiliation of the service, as embedded in the client and service IP addresses, wherein enforcing the security policy comprises applying one or more stateless logical operations to the MGI of the initiator and to the MGR of the service, as embedded in the packet.
2. The system of claim 1 , wherein:
routing of the traffic at the POP interfaces is performed by a plurality of access servers,
and the one or more processors are configured to assign the traffic of each of the one or more organizations to a subset of the plurality of access servers.
3. The system of claim 2 , wherein:
a first POP interface corresponds to a first geographical location, and routing for the first POP interface is performed by a first subset of the plurality of access servers;
a second POP interface corresponds to a second geographical location, and routing for the second POP interface is performed by a second subset of the plurality of access servers;
and the one or more processors are configured to provision a set of inter-POP connections that is sparser than a full mesh between pairs of the access servers in the first subset of the plurality of access servers and the second subset of the plurality of access servers.
4. The system of claim 3 , wherein assigning the client IP address comprises embedding, in the one or more bits of the client IP address, an Access Server ID (AS ID), and wherein the ASID comprises an 18-bit value, different than the MGI value, the MGR value, and the TID, that identifies one or more access servers associated with the initiator.
5. The system of claim 4 , wherein the one or more processors are configured to receive a packet at the first POP interface of the POP interfaces, and to route the packet to the second POP interface of the POP interfaces by selecting an inter-POP connection for the packet based on the ASID.
6. The system of claim 5 , wherein the one or more processors are configured to embed, in the one or more of the bits of the client IP address and the service IP address:
an Overlay prefix comprising a 28-bit prefix identifying an overlay network
a Network ID (NETID) comprising a 7-bit value specifying a network portion of an Overlay Participant ID (OPID), and
the OPID comprising a 24-bit value that is a fixed value unique across the system.
7. The system of claim 6 , wherein the Overlay prefix, the ASID, the TID, the MGI, the MGR, the NETID, and the OPID are embedded into the bits of the client IP address and the service IP address in the following order: the Overlay prefix, the ASID, the TID, the MGI, the MGR, the NETID, and the OPID.
8. A method, comprising:
using one or more processors that are coupled to multiple Point-of-Presence (POP) interfaces distributed in a Wide-Area Network (WAN), assigning, to an initiator, a client Internet Protocol (IP) address having a first plurality of bits, including embedding in one or more of the bits of the client IP address;
an affiliation of the initiator with a group of initiators, wherein the affiliation of the initiator with the group of initiators comprises an Initiator Meta-Group ID (MGI) value indicative of the affiliation of the initiator, and
a Tenant ID (TIP) comprising a 20-bit value, different than the MGI value or a Responder Meta-Group ID (MGR) value, indicating an affiliation of each client with one or more organizations served;
assigning, to a responder, a service IP address having a second plurality of bits, including embedding in one or more of the bits of the service IP address an affiliation of a service with a group of responders, wherein the affiliation of the service with the group of responders comprises the MGR value indicative of the affiliation of the responder;
routing traffic between the initiator and the responder, over the WAN via one or more of the POP interfaces, in a stateless manner, based on the affiliation of the initiator and the affiliation of the service, as embedded in the bits of the client and service IP addresses, wherein the routing is performed based on the affiliation of the initiator and the affiliation of the service, as embedded in the bits of the client and service IP addresses;
receiving a packet, which is exchanged between the initiator and the responder and which comprises the client IP address and the service IP address;
and enforcing a security policy on the packet depending on the affiliation of the initiator and the affiliation of the service, as embedded in the client and service IP addresses, wherein enforcing the security policy comprises applying one or more stateless logical operations to the MGI of the initiator and to the MGR of the service, as embedded in the packet.
9. The method of claim 8 , wherein:
routing of the traffic at the POP interfaces is performed by a plurality of access servers,
and the processors are configured to assign the traffic of each of the one or more organizations to a subset of the plurality of access servers.
10. The method of claim 9 , wherein:
a first POP interface corresponds to a first geographical location, and routing for the first POP interface is performed by a first subset of the plurality of access servers;
a second POP interface corresponds to a second geographical location, and routing for the second POP interface is performed by a second subset of the plurality of access servers;
and the processors are configured to provision a set of inter-POP connections that is sparser than a full mesh between pairs of the access servers in the first subset of the plurality of access servers and the second subset of the plurality of access servers.
11. The method of claim 10 , wherein assigning the client IP address comprising embedding, in the one or more bits of the client IP address, an Access Server ID (AS ID), and wherein the ASID comprises an 18-bit value, different than the MGI value, the MGR value, and the TID, that identifies one or more access servers associated with the initiator.
12. The method of claim 11 , wherein the processors are configured to receive a packet at the first POP interface of the POP interfaces, and to route the packet to the second POP interface of the POP interfaces by selecting an inter-POP connection for the packet based on the AS ID.
13. The method of claim 12 , wherein the processors are configured to embed, in the one or more of the bits of the client IP address and the service IP address:
an Overlay prefix comprising a 28-bit prefix identifying an overlay network
a Network ID (NETID) comprising a 7-bit value specifying a network portion of an Overlay Participant ID (OPID),
and OPID comprising a 24-bit value that is a fixed unique value.
14. The method of claim 13 , wherein the Overlay prefix, the ASID, the TID, the MGI, the MGR, the NETID, and the OPID are embedded into the bits of the client IP address and the service IP address in the following order: the Overlay prefix, the ASID, the TID, the MGI, the MGR, the NETID, and the OPID.