Preserving policy with path selection
View Patent ↗Systems and techniques are described for ensuring that policies are consistently applied to traffic across an overlay network. An application identifier associated with a forward traffic flow and a corresponding reverse traffic flow can be determined by a device that routes packets of both the forward traffic flow and the corresponding reverse traffic flow. Next, an overlay header can be added to each packet in the forward traffic flow and to each packet in the corresponding reverse traffic flow, wherein the overlay header comprises the application identifier, a policy identifier, and a policy action. Each device in the overlay network can then apply the policy action specified in the overlay header of each packet that it routes.
1. A method for ensuring that policies are consistently applied to traffic across an overlay network, the method comprising:
receiving, at a first device in the overlay network, a first packet in a forward traffic flow;
extracting, by the first device, a first overlay header of the first packet;
sending, by the first device, information contained in the first overlay header to a second device in the overlay network that routes packets of a corresponding reverse traffic flow; and
adding, by the second device, a second overlay header to each packet in the corresponding reverse traffic flow, wherein the second overlay header includes the information contained in the first overlay header.
2. The method of claim 1 , wherein each device in the overlay network applies the policy action specified in the overlay header of each packet.
3. The method of claim 1 , wherein a set of policies in the overlay network includes a first policy that directs reverse traffic flows associated with an unidentified application identifier to a default device.
4. The method of claim 3 , wherein the set of policies in the overlay network includes a second policy that directs forward traffic flows associated with the unidentified application identifier to the default device.
5. A non-transitory computer-readable storage medium storing instructions that, when executed by a first device in an overlay network, cause the first device to perform a method for ensuring that policies are consistently applied to traffic across the overlay network, the method comprising:
receiving, at the first device, a first packet in a forward traffic flow;
extracting, by the first device, a first overlay header of the first packet; and
sending, by the first device, information contained in the first overlay header to a second device in the overlay network that routes packets of a corresponding reverse traffic flow, thereby causing the second device to add a second overlay header to each packet in the corresponding reverse traffic flow, wherein the second overlay header includes the information contained in the first overlay header.
6. The non-transitory computer-readable storage medium of claim 5 , wherein each device in the overlay network applies the policy action specified in the overlay header of each packet.
7. The non-transitory computer-readable storage medium of claim 5 , wherein a set of policies in the overlay network includes a first policy that directs reverse traffic flows associated with an unidentified application identifier to a default device.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the set of policies in the overlay network includes a second policy that directs forward traffic flows associated with the unidentified application identifier to the default device.
9. A first device in an overlay network, comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the first device to perform a method for ensuring that policies are consistently applied to traffic across the overlay network, the method comprising:
receiving, at the first device, a first packet in a forward traffic flow;
extracting, by the first device, a first overlay header of the first packet; and
sending, by the first device, information contained in the first overlay header to a second device in the overlay network that routes packets of a corresponding reverse traffic flow, thereby causing the second device to add a second overlay header to each packet in the corresponding reverse traffic flow, wherein the second overlay header includes the information contained in the first overlay header.
10. The first device of claim 9 , wherein each device in the overlay network applies the policy action specified in the overlay header of each packet.
11. The first device of claim 9 , wherein a set of policies in the overlay network includes a first policy that directs reverse traffic flows associated with an unidentified application identifier to a default device.
12. The first device of claim 11 , wherein the set of policies in the overlay network includes a second policy that directs forward traffic flows associated with the unidentified application identifier to the default device.