Tunnel-based service insertion in public cloud environments

1. A method for a network device to perform tunnel-based service insertion in a public cloud environment, the method comprising:

establishing a tunnel between the network device and a service path;

in response to receiving, from a virtualized computing instance, a first encapsulated packet that includes an inner packet and a first outer header that is addressed to the network device:

based on one or more characteristics of the inner packet, identifying the service path specified by a service insertion rule;

generating a second encapsulated packet that includes the inner packet and a second outer header that is addressed to the service path; and

sending the second encapsulated packet over the tunnel to cause the service path to process the inner packet according to one or more services;

generating and sending a route advertisement over the tunnel to the service path to cause the service path to send, to the network device via the tunnel, a third encapsulated packet that includes the inner packet processed by the service path; and

in response to receiving, from the service path via the tunnel, the third encapsulated packet that includes the inner packet processed by the service path:

sending the inner packet processed by the service path, or a fourth encapsulated packet that includes the inner packet processed by the service path, towards a destination address of the inner packet.

2. The method of claim 1 , wherein identifying the service path comprises:

matching at least one of a plurality of characteristics of the inner packet to the service insertion rule, wherein the characteristics include: a source address of the inner packet, the destination address of the inner packet, and a logical interface of the network device and via which the destination address is reachable, wherein the service insertion rule is configured to be applicable at the logical interface of the network device.

3. The method of claim 1 , further comprising:

receiving, via a tunnel interface associated with the network device, a route advertisement that specifies an address of a first service virtualized computing instance located on the service path; and

storing route information that associates the tunnel interface with the address of the first service virtualized computing instance.

4. The method of claim 3 , wherein sending the second encapsulated packet comprises:

sending, via the tunnel interface specified by the route information, the second encapsulated packet to the first service virtualized computing instance.

5. The method of claim 3 , wherein sending the second encapsulated packet comprises:

identifying that the first service virtualized computing instance is assigned with an active role, wherein the first service virtualized computing instance and a second service virtualized computing instance are configured as a high availability (HA) pair.

6. The method of claim 1 , wherein

the service path includes a first service virtualized computing instance located in a same or different virtual network as the network device in the public cloud environment.

7. The method of claim 1 , wherein

the service path includes a first service virtualized computing instance located in a private cloud environment.

8. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a network device, cause the processor to perform a method of tunnel-based service insertion in a public cloud environment, wherein the method comprises:

establishing a tunnel between the network device and a service path;

in response to receiving, from a virtualized computing instance, a first encapsulated packet that includes an inner packet and a first outer header that is addressed to the network device:

based on one or more characteristics of the inner packet, identifying the service path specified by a service insertion rule;

generating a second encapsulated packet that includes the inner packet and a second outer header that is addressed to the service path; and

sending the second encapsulated packet over the tunnel to cause the service path to process the inner packet according to one or more services;

generating and sending a route advertisement over the tunnel to the service path to cause the service path to send, to the network device via the tunnel, a third encapsulated packet that includes the inner packet processed by the service path; and

in response to receiving, from the service path via the tunnel, the third encapsulated packet that includes the inner packet processed by the service path:

sending the inner packet processed by the service path, or a fourth encapsulated packet that includes the inner packet processed by the service path, towards a destination address of the inner packet.

9. The non-transitory computer-readable storage medium of claim 8 , wherein identifying the service path comprises:

matching at least one of a plurality of characteristics of the inner packet to the service insertion rule, wherein the characteristics include: a source address of the inner packet, the destination address of the inner packet, and a logical interface of the network device and via which the destination address is reachable, wherein the service insertion rule is configured to be applicable at the logical interface of the network device.

10. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises:

receiving, via a tunnel interface associated with the network device, a route advertisement that specifies an address of a first service virtualized computing instance located on the service path; and

storing route information that associates the tunnel interface with the address of the first service virtualized computing instance.

11. The non-transitory computer-readable storage medium of claim 10 , wherein sending the second encapsulated packet comprises:

sending, via the tunnel interface specified by the route information, the second encapsulated packet to the first service virtualized computing instance.

12. The non-transitory computer-readable storage medium of claim 10 , wherein sending the second encapsulated packet comprises:

identifying that the first service virtualized computing instance is assigned with an active role, wherein the first service virtualized computing instance and a second service virtualized computing instance are configured as a high availability (HA) pair.

13. The non-transitory computer-readable storage medium of claim 8 , wherein:

the service path includes a first service virtualized computing instance located in a same or different virtual network as the network device in the public cloud environment.

14. The non-transitory computer-readable storage medium of claim 8 , wherein:

the service path includes a first service virtualized computing instance located in a private cloud environment.

15. A computer system configured to perform tunnel-based service insertion in a public cloud environment, the computer system comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, in response to execution by the processor, cause the processor to:

establish a tunnel between the computer system and a service path;

in response to receiving, from a virtualized computing instance, a first encapsulated packet that includes an inner packet and a first outer header that is addressed to the computer system:

based on one or more characteristics of the inner packet, identify the service path specified by a service insertion rule;

generate a second encapsulated packet that includes the inner packet and a second outer header that is addressed to the service path; and

send the second encapsulated packet over the tunnel to cause the service path to process the inner packet according to one or more services;

generate and send a route advertisement over the tunnel to the service path to cause the service path to send, to the computer system via the tunnel, a third encapsulated packet that includes the inner packet processed by the service path; and

in response to receiving, from the service path via the tunnel, the third encapsulated packet that includes the inner packet processed by the service path:

send the inner packet processed by the service path, or a fourth encapsulated packet that includes the inner packet processed by the service path, towards a destination address of the inner packet.

16. The computer system of claim 15 , wherein the instructions that cause the processor to identify the service path cause the processor to:

match at least one of a plurality of characteristics of the inner packet to the service insertion rule, wherein the characteristics include: a source address of the inner packet, the destination address of the inner packet, and a logical interface of the computer system and via which the destination address is reachable, wherein the service insertion rule is configured to be applicable at the logical interface of the computer system.

17. The computer system of claim 15 , wherein the instructions further cause the processor to:

receive, via a tunnel interface associated with the computer system, a route advertisement that specifies an address of a first service virtualized computing instance located on the service path; and

store route information that associates the tunnel interface with the address of the first service virtualized computing instance.

18. The computer system of claim 17 , wherein the instructions that cause the processor to send the second encapsulated packet cause the processor to:

send, via the tunnel interface specified by the route information, the second encapsulated packet to the first service virtualized computing instance.

19. The computer system of claim 17 , wherein the instructions that cause the processor to send the second encapsulated packet cause the processor to:

identify that the first service virtualized computing instance is assigned with an active role, wherein the first service virtualized computing instance and a second service virtualized computing instance are configured as a high availability (HA) pair.

20. The computer system of claim 15 , wherein:

the service path includes a first service virtualized computing instance located in a same or different virtual network as the computer system in the public cloud environment.

21. The computer system of claim 15 , wherein:

the service path includes a first service virtualized computing instance located in a private cloud environment.