Overlay network ingress edge region selection
This disclosure relates to enhanced overlay network-based transport of traffic to and from customer branch office locations, facilitated through the use of the Internet-based overlay routing. A method of selecting an ingress edge region of the overlay network begins by mapping a service hostname to an IKEv2 destination of an outer IPsec tunnel associated with a first overlay network edge. An IKEv2 session is established from the first overlay network edge to the customer router. Upon tunnel establishment, a secondary lookup is performed to determine whether the first overlay network edge is an appropriate ingress region. Based on a response to the secondary lookup, a IKEv2 redirect is issued to a second overlay network edge. A new tunnel is then established from the second overlay network edge to the customer router. Thereafter, an additional lookup may also be performed to determine whether the second overlay network edge remains an appropriate ingress region.
1. A method of selecting an ingress edge region of an Internet-based overlay network, the overlay network having an authoritative domain name service (DNS), comprising:
mapping, using the authoritative DNS, a service hostname to a first overlay network edge;
establishing a first destination tunnel from the first overlay network edge to a customer router;
upon establishment of the first destination tunnel, receiving one or more connectivity-related messages from the customer router;
re-mapping the service hostname to determine whether the first overlay network edge remains an appropriate ingress region for the first destination tunnel, wherein re-mapping includes intentionally dropping a response to at least one connectivity-related message from the customer router, thereby triggering the customer router to initiate a new lookup of the service hostname at the authoritative DNS;
when a result of the re-mapping determines that the first overlay network edge is not an appropriate ingress edge region for the first destination tunnel but a second overlay network edge is an appropriate ingress edge region, redirecting from the first overlay network edge to the second overlay network edge; and
establishing a second destination tunnel from the second overlay network edge to the customer router.
2. The method as described in claim 1 , wherein re-mapping includes performing one or more lookups to the authoritative DNS to determine whether the first overlay network edge remains an appropriate ingress region for the first destination tunnel.
3. The method as described in claim 1 , wherein the one or more connectivity-related messages are one or more liveness probes.
4. The method as described in claim 1 , wherein the first destination tunnel is an IKEv2 destination of an outer IPsec tunnel associated with the first overlay network edge.
5. The method as described in claim 1 , wherein redirecting to the second overlay edge network uses an IKEv2 redirect notify message.
6. The method as described in claim 1 , wherein the first and second overlay network edges are associated with distinct geographic regions.
7. The method as described in claim 1 , wherein the Internet-based overlay network is a content delivery network (CDN) and the first and second overlay network edge are collections of CDN edge servers.
8. The method as described in claim 3 , wherein the liveness probes are IP-SLA probes.