Method and system of a cloud-based multipath routing protocol
In one aspect, a computerized system useful for implementing a cloud-based multipath routing protocol to an Internet endpoint includes an edge device that provides an entry point into an entity's core network. The entity's core network includes a set of resources to be reliably accessed. The computerized system includes a cloud-edge device instantiated in a public-cloud computing platform. The cloud-edge device joins a same virtual routing and forwarding table as the edge device. The cloud-edge device receives a set of sources and destinations of network traffic that are permitted to access the edge device and the set of resources.
1. A system for implementing a wide area network for an entity, the system comprising:
a client device operating outside of a branch office of the entity;
in the branch office of the entity:
a local area network (LAN);
a set of computers connected to the LAN; and
a first edge device connected to the LAN to serve as entry/exit device for data message traffic exchanged between a particular computer and the client device; and
outside of the branch office:
a gateway to connect to the first edge device; and
a second edge device deployed in a public cloud datacenter to connect to the client device and the gateway,
wherein the first and second edge devices implement a same virtual routing and forwarding table.
2. The system of claim 1 , wherein the client device securely connects to the particular computer through virtual private network (VPN) connection established between the particular computer and the client device.
3. The system of claim 2 , wherein the VPN connection comprises a VPN connection between the client device and the second edge device.
4. The system of claim 2 , wherein the VPN connection comprises a VPN connection between the first edge device and the gateway.
5. The system of claim 2 , wherein through the secure VPN connection data message traffic is exchanged between the client device and the particular computer.
6. The system of claim 1 , wherein the second edge device is a virtual machine instantiated in the public-cloud datacenter.
7. A system for implementing a wide area network for an entity, the system comprising:
a client device operating outside of a branch office of the entity;
in the branch office of the entity:
a local area network (LAN);
a set of computers connected to the LAN; and
a first edge device connected to the LAN to serve as entry/exit device for data message traffic exchanged between a particular computer and the client device; and
outside of the branch office:
a gateway to connect to the first edge device; and
a second edge device deployed in a public cloud datacenter to connect to the client device and the gateway;
wherein the second edge device receives a set of network traffic that is permitted to access the set of computers through the first edge device and the LAN.
8. The system of claim 7 , wherein the second edge device is set to deny any inbound network traffic that is not in the received set of permitted access.
9. A system for implementing a wide area network for an entity, the system comprising:
a client device operating outside of a branch office of the entity;
in the branch office of the entity:
a local area network (LAN);
a set of computers connected to the LAN; and
a first edge device connected to the LAN to serve as entry/exit device for data message traffic exchanged between a particular computer and the client device; and
outside of the branch office:
a gateway to connect to the first edge device; and
a second edge device deployed in a public cloud datacenter to connect to the client device and the gateway,
wherein a rule is implemented that allows a public Internet protocol (IP) address of the client device to reach the particular computer via another public IP address assigned to the second edge device.
10. The system of claim 9 , wherein the other public IP address assigned to the second edge device is assigned to LAN side of the first edge device.
11. The system of claim 9 , wherein the other public IP address assigned to the second edge device is not assigned to LAN.
12. A method for implementing a wide area network for an entity to allow a client device operating outside of a branch office of the entity to access at least one particular computer at the branch office that is connected to a local area network (LAN) of the branch office,
the method comprising:
deploying a first edge device connected to the LAN to serve as entry/exit device for data message traffic exchanged between the particular computer and the client device;
deploying, outside of the branch office, a gateway to connect to the first edge device;
deploying a second edge device in a public cloud datacenter outside of the branch office to connect to the client device and the gateway; and
implementing a same virtual routing and forwarding table at the first and second edge device.
13. The method of claim 12 further comprising establishing a virtual private network (VPN) connection established between the particular computer and the client device.
14. The method of claim 13 , wherein the establishing the VPN connection comprises establishing a VPN connection between the client device and the second edge device.
15. The method of claim 13 , wherein establishing the VPN connection comprises establishing a VPN connection between the first edge device and the gateway.
16. The method of claim 13 , wherein the second edge device is a virtual machine instantiated in the public-cloud datacenter.
17. A system for implementing a wide area network for an entity, the system comprising:
a client device operating outside of a branch office of the entity;
in the branch office of the entity:
a local area network (LAN);
a set of computers connected to the LAN; and
a first edge device connected to the LAN to serve as entry/exit device for data message traffic exchanged between a particular computer and the client device; and
outside of the branch office:
a gateway to connect to the first edge device; and
a second edge device deployed in a public cloud datacenter to connect to the client device and the gateway,
wherein the second edge device is configured to permit data message traffic from a set of network traffic to access the particular computer through the first edge device and the LAN, and
wherein the second edge device is configured to deny any inbound network traffic that is not in the set of network traffic that is permitted to access the particular computer.