Transparent multiplexing of IP endpoints
Allowing a network function (such as a router, firewall or SD-WAN endpoint) or service chain of network functions to transparently access a network uplink, while also allowing a set of management entities to access the same link without interference or configuration. To the extent that a conflict arises between ports allocated to the management functions and to the network functions, the relevant port is automatically removed from use by management functions and allocated to network functions to end the conflict.
1. An IP multiplexer adapted to allow packets for use by a network endpoint to use a first IP address and to concurrently allow packets for a management endpoint within the same device as network endpoint to also use the first IP address to reduce a need to purchase more than one IPv4 address without using NAT to remap IP addresses, the IP multiplexer configured to automatically:
receive incoming packets on a first interface from a gateway device with a first MAC address, the gateway device connected to an IP network;
process incoming packets from the first interface before:
sending management packets out a second interface connected to the management endpoint, the management packets adjusted to use a second MAC address associated with the management endpoint;
sending network packets out a third interface connected to the network endpoint; the network packets adjusted to use a third MAC address associated with the network endpoint;
wherein the processing of incoming packets from the first interface comprises:
performing a flow table lookup to determine whether the incoming packet is a management packet or a network packet, wherein the flow table lookup uses multiple key matching that does not use a MAC address;
if the flow table lookup fails, then perform a rule table lookup and create a flow table entry for addition to the flow table, wherein the rule table lookup uses multiple key matching that does not use a MAC address;
maintaining a list of port values in a set of ports reserved for management packets;
actively changing the list of port values in the set of ports reserved for management packets by responding to a receipt of a network packet using a specific port value within the set of ports reserved for management packets by:
A) removing that specific port value from the set of ports reserved for management packets; and
B) adjusting a flow table to reflect a change in the set of ports reserved for management function.
2. The IP multiplexer of claim 1 wherein the IP multiplexer, the network endpoint, and the management endpoint share a single IPv4 address.
3. The IP multiplexer of claim 1 wherein the IP multiplexer reacts to management endpoint port conflicts by changing the port values within the set of ports reserved for management packets.
4. The IP multiplexer of claim 1 wherein the IP multiplexer alerts the network endpoint when the IP multiplexer is down to allow the network endpoint to reroute traffic around the IP multiplexer in an alternative interface is available.
5. The IP multiplexer of claim 1 wherein the IP multiplexer alerts the management endpoint when the IP multiplexer is down to allow network endpoint to reroute traffic around the IP multiplexer in an alternative interface is available.
6. The IP multiplexer of claim 1 wherein the IP multiplexer is a virtual device.
7. The IP multiplexer of claim 1 wherein the IP multiplexer is a physical device.
8. The IP multiplexer of claim 1 wherein at least some packets originating at the network endpoint are changed by the IP multiplexer so that the at least some packets leave the IP multiplexer heading to the gateway device with a MAC address other than the MAC address of the network endpoint.
9. The IP multiplexer of claim 8 wherein the at least some packets are ARP packets.
10. The IP multiplexer of claim 8 wherein the at least some packets are ICMP packets.
11. The IP multiplexer of claim 8 wherein the at least some packets are DHCP packets.
12. The IP multiplexer of claim 1 wherein at least some packets originating at the management endpoint are changed by the IP multiplexer so that the at least some packets leave the IP multiplexer heading to the gateway device with a MAC address other than the MAC address of the management endpoint.
13. The IP multiplexer of claim 12 wherein the at least some packets are ARP packets.
14. The IP multiplexer of claim 12 wherein the at least some packets are ICMP packets.
15. The IP multiplexer of claim 12 wherein the at least some packets are DHCP packets.
16. The IP multiplexer of claim 1 wherein the flow table uses a 7-tuple value comprising:
Ingress endpoint;
ethType;
IP Protocol;
Source IP Address;
Destination IP Address;
Source IP Port; and
Destination IP Port.