Distributed network address translation over network environments
This disclosure describes techniques for implementing network address translation as a distributed service over the nodes of a logical network fabric, such as a software-defined network fabric. A method includes registering, by an edge node of a network, an IP address of a client device. The method further includes forwarding, by the edge node, the registered IP address to a control plane of the network. The method further includes checking, by the control plane, a network address translation policy. The method further includes recording, by the control plane, translations between the registered IP address and an allocated IP address in a translation table, each of the translations being related to the edge node. The method further includes returning, by the control plane, the translations between the registered IP address and the allocated IP address to the edge node.
1. A physical server disposed in an underlay of physical servers that execute a virtual network overlay, the physical server comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
establish, by a first edge node of the virtual network overlay, a connection to a client device having a device address;
send, by the first edge node, a first registration message to a control plane node of the virtual network overlay;
look up, by the control plane node, a network address translation (NAT) policy;
assign, by the control plane node, a public subnet address to the client device as a NAT address, without assigning a private subnet address to the client device, based on the NAT policy specifying that NAT is applied to traffic originating from subnet addresses not registered by LISP at the control plane node;
record, by the control plane node, a first mapping and a second mapping between the device address and the assigned NAT address, each of the first mapping and the second mapping being associated with the first edge node;
send, by the control plane node, a confirmation message to the first edge node indicating the first mapping and the second mapping between the device address and the NAT address;
establish, by a second edge node of the virtual network overlay, a connection to the client device;
send, by the second edge node, a second registration message to the control plane node; and
update, by the control plane node, each of the first mapping and the second mapping to being associated with the second edge node;
wherein an association between a mapping and an edge node indicates that the client device is currently connected to that respective edge node among a plurality of edge nodes of the virtual network overlay.
2. The physical server of claim 1 , wherein each registration message is a Locator/ID Separator Protocol (LISP) registration request representing an edge node as an egress tunnel router (ETR) and the device address as an Endpoint ID (EID).
3. The physical server of claim 1 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses allocated to the virtual network overlay and hosts outside the network fabric.
4. The physical server of claim 1 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses of the network fabric and hosts outside the network fabric, and applied to traffic among hosts addressed by private subnet addresses of the network fabric.
5. The physical server of claim 1 , wherein the first mapping is a mapping from the device address as a key to the assigned NAT address, and the second mapping is a mapping from the assigned NAT address as a key to the device address.
6. The physical server of claim 1 , wherein each of the first mapping and the second mapping is associated with the edge node.
7. A method comprising:
executing a virtual network overlay on a physical server of an underlay of physical servers;
establishing, by a first edge node of the virtual network overlay, a connection to a client device having a device address;
sending, by the first edge node, a first registration message to a control plane node of the virtual network overlay;
looking up, by the control plane node, a NAT policy;
assigning, by the control plane node, a public subnet address to the client device as a NAT address, without assigning a private subnet address to the client device, based on the NAT policy specifying that NAT is applied to traffic originating from subnet addresses not registered by LISP at the control plane node;
recording, by the control plane node, a first mapping and a second mapping between the device address and the assigned NAT address, each of the first mapping and the second mapping being associated with the first edge node;
sending, by the control plane node, a confirmation message to the first edge node indicating the first mapping and the second mapping between the device address and the NAT address establishing, by a second edge node of the virtual network overlay, a connection to the client device;
sending, by the second edge node, a second registration message to the control plane node; and
updating, by the control plane node, each of the first mapping and the second mapping to being associated with the second edge node;
wherein an association between a mapping and an edge node indicates that the client device is currently connected to that respective edge node among a plurality of edge nodes of the virtual network overlay.
8. The method of claim 7 , wherein each registration message is a Locator/ID Separator Protocol (LISP) registration request representing an edge node as an egress tunnel router (ETR) and the device address as an Endpoint ID (EID).
9. The method of claim 7 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses allocated to the virtual network overlay and hosts outside the network fabric.
10. The method of claim 7 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses of the network fabric and hosts outside the network fabric, and applied to traffic among hosts addressed by private subnet addresses of the network fabric.
11. The method of claim 7 , wherein the first mapping is a mapping from the device address as a key to the assigned NAT address, and the second mapping is a mapping from the assigned NAT address as a key to the device address.
12. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
establish, by a first edge node of the virtual network overlay, a connection to a client device having a device address;
send, by the first edge node, a first registration message to a control plane node of the virtual network overlay;
look up, by the control plane node, a network address translation (NAT) policy;
assign, by the control plane node, a public subnet address to the client device as a NAT address, without assigning a private subnet address to the client device, based on the NAT policy specifying that NAT is applied to traffic originating from subnet addresses not registered by LISP at the control plane node;
record, by the control plane node, a first mapping and a second mapping between the device address and the assigned NAT address, each of the first mapping and the second mapping being associated with the first edge node;
send, by the control plane node, a confirmation message to the first edge node indicating the first mapping and the second mapping between the device address and the NAT address;
establish, by a second edge node of the virtual network overlay, a connection to the client device;
send, by the second edge node, a second registration message to the control plane node; and
update, by the control plane node, each of the first mapping and the second mapping to being associated with the second edge node;
wherein an association between a mapping and an edge node indicates that the client device is currently connected to that respective edge node among a plurality of edge nodes of the virtual network overlay.
13. The system of claim 12 , wherein each registration message is a Locator/ID Separator Protocol (LISP) registration request representing an edge node as an egress tunnel router (ETR) and the device address as an Endpoint ID (ED).
14. The system of claim 12 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses allocated to the virtual network overlay and hosts outside the network fabric.
15. The system of claim 12 , wherein the NAT policy specifies that NAT is applied to traffic between hosts addressed by private subnet addresses of the network fabric and hosts outside the network fabric, and applied to traffic among hosts addressed by private subnet addresses of the network fabric.
16. The system of claim 12 , wherein the first mapping is a mapping from the device address as a key to the assigned NAT address, and the second mapping is a mapping from the assigned NAT address as a key to the device address.
17. The system of claim 12 , wherein each of the first mapping and the second mapping is associated with the edge node.