Dynamic on-demand virtual private network (VPN) session distribution for gateways

1. A method of processing inter-network communications, comprising:

configuring, by a management component of a data center, a first virtual private network (VPN) session between a first endpoint outside of the data center and a first gateway of the data center;

configuring, by the management component, a second VPN session between a second endpoint outside of the data center and a second gateway of the data center; and

programming, by the management component, one or more network address translation (NAT) tables of the data center such that, for the first VPN session and the second VPN session, a single public network address of the data center is exposed to the first endpoint and the second endpoint.

2. The method of claim 1 , wherein programming the one or more NAT tables comprises:

programming a source NAT (SNAT) table such that:

source addresses of packets sent from the first gateway to the first endpoint are translated to the single public network address of the data center; and

source addresses of packets sent from the second gateway to the second endpoint are translated to the single public network address of the data center; and

programming a destination NAT (DNAT) table such that:

destination addresses of packets sent from the first endpoint to the single public network address of the data center are translated to a network address of the first gateway; and

destination addresses of packets sent from the second endpoint to the single public network address of the data center are translated to a network address of the second gateway.

3. The method of claim 1 , further comprising:

configuring, by the management component, a first shadow VPN session between the first endpoint and the second gateway that corresponds to the first VPN session; and

configuring, by the management component, a second shadow VPN session between the second endpoint and the first gateway that corresponds to the second VPN session.

4. The method of claim 3 , further comprising:

determining, by the management component, an occurrence of a condition related to computing resource utilization information for the first gateway or the second gateway; and

reconfiguring, by the management component, the first shadow VPN session or the second shadow VPN session to become a real VPN session based on the occurrence of the condition.

5. The method of claim 4 , further comprising reconfiguring, by the management component, the first VPN session or the second VPN session to become a shadow VPN session based on the occurrence of the condition.

6. The method of claim 1 , further comprising determining, by the management component, computing resource utilization information for the first gateway and the second gateway, wherein the management component selects the first gateway for the first VPN session and the second gateway for the second VPN session based on the computing resource utilization information.

7. The method of claim 6 , further comprising:

determining, by the management component, based on the computing resource utilization information, to create a third gateway of the data center for a third VPN session; and

configuring, by the management component, the third VPN session between a third endpoint outside of the data center and the third gateway.

8. The method of claim 6 , wherein the computing resource utilization information comprises information relating to one or more of:

processor utilization;

memory utilization;

network resource utilization;

uplink traffic; or

downlink traffic.

9. A system for processing inter-network communications, the system comprising:

at least one memory; and

at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to:

configure, by a management component of a data center, a first virtual private network (VPN) session between a first endpoint outside of the data center and a first gateway of the data center;

configure, by the management component, a second VPN session between a second endpoint outside of the data center and a second gateway of the data center; and

program, by the management component, one or more network address translation (NAT) tables of the data center such that, for the first VPN session and the second VPN session, a single public network address of the data center is exposed to the first endpoint and the second endpoint.

10. The system of claim 9 , wherein programming the one or more NAT tables comprises:

programming a source NAT (SNAT) table such that:

source addresses of packets sent from the first gateway to the first endpoint are translated to the single public network address of the data center; and

source addresses of packets sent from the second gateway to the second endpoint are translated to the single public network address of the data center; and

programming a destination NAT (DNAT) table such that:

destination addresses of packets sent from the first endpoint to the single public network address of the data center are translated to a network address of the first gateway; and

destination addresses of packets sent from the second endpoint to the single public network address of the data center are translated to a network address of the second gateway.

11. The system of claim 9 , wherein the at least one processor and the at least one memory are further configured to:

configure, by the management component, a first shadow VPN session between the first endpoint and the second gateway that corresponds to the first VPN session; and

configure, by the management component, a second shadow VPN session between the second endpoint and the first gateway that corresponds to the second VPN session.

12. The system of claim 11 , wherein the at least one processor and the at least one memory are further configured to:

determine, by the management component, an occurrence of a condition related to computing resource utilization information for the first gateway or the second gateway; and

reconfigure, by the management component, the first shadow VPN session or the second shadow VPN session to become a real VPN session based on the occurrence of the condition.

13. The system of claim 12 , wherein the at least one processor and the at least one memory are further configured to reconfigure, by the management component, the first VPN session or the second VPN session to become a shadow VPN session based on the occurrence of the condition.

14. The system of claim 9 , wherein the at least one processor and the at least one memory are further configured to determine, by the management component, computing resource utilization information for the first gateway and the second gateway, wherein the management component selects the first gateway for the first VPN session and the second gateway for the second VPN session based on the computing resource utilization information.

15. The system of claim 14 , wherein the at least one processor and the at least one memory are further configured to:

determine, by the management component, based on the computing resource utilization information, to create a third gateway of the data center for a third VPN session; and

configure, by the management component, the third VPN session between a third endpoint outside of the data center and the third gateway.

16. The system of claim 14 , wherein the computing resource utilization information comprises information relating to one or more of:

processor utilization;

memory utilization;

network resource utilization;

uplink traffic; or

downlink traffic.

17. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

configure, by a management component of a data center, a first virtual private network (VPN) session between a first endpoint outside of the data center and a first gateway of the data center;

configure, by the management component, a second VPN session between a second endpoint outside of the data center and a second gateway of the data center; and

program, by the management component, one or more network address translation (NAT) tables of the data center such that, for the first VPN session and the second VPN session, a single public network address of the data center is exposed to the first endpoint and the second endpoint.

18. The non-transitory computer-readable medium of claim 17 , wherein programming the one or more NAT tables comprises:

programming a source NAT (SNAT) table such that:

source addresses of packets sent from the first gateway to the first endpoint are translated to the single public network address of the data center; and

source addresses of packets sent from the second gateway to the second endpoint are translated to the single public network address of the data center; and

programming a destination NAT (DNAT) table such that:

destination addresses of packets sent from the first endpoint to the single public network address of the data center are translated to a network address of the first gateway; and

destination addresses of packets sent from the second endpoint to the single public network address of the data center are translated to a network address of the second gateway.

19. The non-transitory computer-readable medium of claim 17 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

configure, by the management component, a first shadow VPN session between the first endpoint and the second gateway that corresponds to the first VPN session; and

configure, by the management component, a second shadow VPN session between the second endpoint and the first gateway that corresponds to the second VPN session.

20. The non-transitory computer-readable medium of claim 19 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

determine, by the management component, an occurrence of a condition related to computing resource utilization information for the first gateway or the second gateway; and

reconfigure, by the management component, the first shadow VPN session or the second shadow VPN session to become a real VPN session based on the occurrence of the condition.