Network policy application based on session state
Techniques are disclosed for the detection of different states of a session comprising a bidirectional flow of network traffic between client devices so as to enable a network device to apply different network policies to different states of the session. In one example, a computing device identifies multiple states of a session and defines a plurality of network policies. Each network policy defines performance requirements for network traffic during each state of the session. A network device receives the plurality of network policies and determines a state of the session. The network device selects a path based on the performance requirements of the network policy associated with the determined state of the session. The network device forwards traffic associated with the session along the selected path while the session is in the determined state.
1. A method comprising:
receiving, by a network device of a plurality of network devices forming a network, a first network policy defining one or more first performance requirements for network traffic during a session establishment state of a session and a second network policy defining one or more second performance requirements for network traffic during a data communication state of the session, wherein the session comprises a bidirectional flow of network traffic between a first client device and a second client device;
based at least in part on determining that the session is in the session establishment state, selecting, by the network device and based on the one or more first performance requirements defined by the first network policy corresponding to the session establishment state of the session, a first path of a plurality of different paths through the network;
forwarding, by the network device, network traffic associated with the session establishment state of the session along the first path;
based at least in part on determining a change in the session from the session establishment state to the data communication state, selecting, by the network device and based on the one or more second performance requirements defined by the second network policy corresponding to the data communication state of the session, a second path of the plurality of different paths, the second path different from the first path; and
forwarding, by the network device, network traffic associated with the data communication state of the session along the second path.
2. The method of claim 1 , further comprising:
based at least in part on determining a change in the session from the data communication state to a teardown state, selecting, by the network device and based on one or more third performance requirements defined by a third network policy corresponding to the teardown state, a third path of the plurality of different paths, the third path different from the second path; and
forwarding, by the network device, network traffic associated with the teardown state of the session along the third path.
3. The method of claim 1 , wherein the one or more first performance requirements comprise one or more of jitter, latency, packet loss, bandwidth, or cost.
4. The method of claim 1 , wherein determining the change in the session from the session establishment state to the data communication state is based on at least one of:
a number of packets associated with the session received by the network device;
an elapsed time of the session; or
a type of packet received by the network device.
5. The method of claim 1 , wherein a plurality of different states of the session includes the session establishment state, the data communication state, and a teardown state.
6. The method of claim 1 ,
wherein determining the session is in the session establishment state is based at least in part on receiving a packet comprising a Transmission Control Protocol (TCP) “SYN” message from the first client device; and
wherein determining the change in the session from the session establishment state to the data communication state based at least in part on receiving a packet comprising a TCP “ACK” message from the first client device.
7. The method of claim 1 ,
wherein determining the session is in the session establishment state is based at least in part on receiving a packet comprising a Transport Layer Security (TLS) “ClientHello” message from the first client device; and
wherein determining the change in the session from the session establishment state to the data communication state is based at least in part on receiving a packet comprising a TLS “Finished” message from the first client device.
8. The method of claim 1 , wherein a plurality of different states of the session includes:
the session establishment state;
the data communication state, and
at least one of a real-time state, a time-sensitive state, or a time-insensitive state.
9. A network device of a plurality of network devices forming a network, the network device comprising:
storage media; and
processing circuitry configured to:
receive a first network policy defining one or more first performance requirements for network traffic during a session establishment state of a session and a second network policy defining one or more second performance requirements for network traffic during a data communication state of the session, wherein the session comprises a bidirectional flow of network traffic between a first client device and a second client device;
based at least in part on determining that the session is in the session establishment state, select, based on the one or more first performance requirements defined by the first network policy corresponding to the session establishment state of the session, a first path of a plurality of different paths through the network;
forward network traffic associated with the session establishment state of the session along the first path;
based at least in part on determining a change in the session from the session establishment state to the data communication state, select, based on the one or more second performance requirements defined by the second network policy corresponding to the data communication state of the session, a second path of the plurality of different paths, the second path different from the first path; and
forward network traffic associated with the data communication state of the session along the second path.
10. The network device of claim 9 , wherein the processing circuitry is further configured to:
based at least in part on determining a change in the session from the data communication state to a teardown state, select, based on one or more third performance requirements defined by a third network policy corresponding to the teardown state, a third path of the plurality of different paths, the third path different from the second path; and
forward network traffic associated with the teardown state of the session along the third path.
11. The network device of claim 9 , wherein the one or more first performance requirements comprise one or more of jitter, latency, packet loss, bandwidth, or cost.
12. The network device of claim 9 , wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the data communication state based on a number of packets associated with the session received by the network device.
13. The network device of claim 9 , wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the data communication state based on an elapsed time of the session.
14. The network device of claim 9 , wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the data communication state based on a type of packet received by the network device.
15. The network device of claim 9 , wherein a plurality of different states of the session includes the session establishment state, the data communication state, and a teardown state.
16. The network device of claim 9 ,
wherein the processing circuitry is configured to determine the session is in the session establishment state based at least in part on receiving a packet comprising a Transport Layer Security (TLS) “ClientHello” message from the first client device; and
wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the data communication state to based at least in part on receiving a packet comprising a TLS “Finished” message from the first client device.
17. The network device of claim 9 , wherein a plurality of different states of the session includes:
the session establishment state;
the data communication state, and
at least one of a real-time state, a time-sensitive state, or a time-insensitive state.
18. The network device of claim 10 , wherein the processing circuitry is configured to determine the change in the session from the data communication state to the teardown state based on receiving at least one of:
a packet comprising a TLS “Close Notify” message from the first client device or the second client device; or
a packet comprising a TCP “FIN” message from the first client device or the second client device.
19. The network device of claim 9 ,
wherein, to determine the change in the session from the session establishment state to the data communication state, the processing circuitry is configured to determine an impending change in the session from the session establishment state to the data communication state; and
wherein the processing circuitry is configured to proactively forward network traffic associated with session along the second path prior to the change in the session from the session establishment state to the data communication state.
20. Non-transitory, computer-readable media comprising instructions that, when executed, are configured to cause processing circuitry to:
receive a first network policy defining one or more first performance requirements for network traffic during a session establishment state of a session and a second network policy defining one or more second performance requirements for network traffic during a data communication state of the session, wherein the session comprises a bidirectional flow of network traffic between a first client device and a second client device;
based at least in part on determining that the session is in the session establishment state, select, based on the one or more first performance requirements defined by the first network policy corresponding to the session establishment state of the session, a first path of a plurality of different paths through a network formed by a plurality of network devices;
forward network traffic associated with the session establishment state of the session along the first path;
based at least in part on determining a change in the session from the session establishment state to the data communication state, select, based on the one or more second performance requirements defined by the second network policy corresponding to the data communication state of the session, a second path of the plurality of different paths, the second path different from the first path; and
forward network traffic associated with the data communication state of the session along the second path.