Service access awareness in a distributed architecture
Techniques are described for suppressing data plane traffic using a service monitoring policy for data plane control. If a service provided to a router becomes nonfunctional, preventing the router from being able to forward traffic to a next-hop device, data plane traffic from client devices on the data plane that requires the use of the nonfunctioning service is suppressed. Additionally, new communication pathways to the router that will use the nonfunctioning service are prevented from being established. Traffic is redirected to another router with a functioning service. Thus, traffic that may normally be directed to the router with the nonfunctioning service and not able to be forwarded (e.g., blackholing of data) can be forwarded to the other router.
1. A method performed at least partly by a router in a distributed application architecture, the method comprising:
enabling a service monitoring policy for data plane control (SMPDPC) on the router, wherein the SMPDPC comprises local policy-based routing instructions stored on the router, wherein the SMPDPC is configured to allow the router to determine if a communication pathway specific to the router is to be suppressed;
enabling, on the router, a router service provided by a service instance, wherein the router service is used by the router prior to forwarding traffic to a next-hop service provided by a next-hop device;
establishing bidirectional forwarding detection between the router and the service instance to commence monitoring of a functionality of the router service by the router;
establishing communications using a data plane session between the router and a client device on a data plane, wherein the data plane is for traffic received from the client device intended for the next-hop device;
receiving an indication that the router service provided by the service instance is nonfunctional; and
suppressing the data plane session, by the router following the SMPDPC stored on the router, to stop traffic originated from the client device and one or more second client devices on the data plane for the traffic originated from the client device and the one or more second client devices intended for the next-hop device.
2. The method of claim 1 , wherein the router is a first router and the service instance is a first service instance, further comprising:
enabling, on a second router, the router service using a second service instance; and
establishing communications between the second router and the client device on the data plane, wherein the data plane is for traffic received from the client device intended for the next-hop device.
3. The method of claim 2 , further comprising:
receiving an indication that the router service provided by the service instance is functional;
reestablishing bidirectional forwarding detection between the router and the service instance to commence monitoring of a functionality of the router service by the service instance;
reestablishing communications between the router and the client device on the data plane for traffic received from the client device intended for the next-hop device; and
disabling communications between the second router and the client device on the data plane.
4. The method of claim 1 , wherein the router service comprises a firewall, a data-loss-prevention service, a compliance-policy system, a load balancer, and an intrusion-prevention service.
5. The method of claim 1 , wherein enabling communications between the router and the client device on a data plane comprises establishing a tunnel between the router and the client device.
6. The method of claim 5 , wherein the tunnel is a first tunnel, further comprising, upon receiving the indication that the router service provided by the service instance is nonfunctional, ceasing the establishment of a second tunnel between the client device and the router for traffic on the data plane for traffic received from the client device intended for the next-hop device.
7. The method of claim 1 , wherein suppressing traffic received from the client device on the data plane for the traffic received from the client device intended for the next-hop device further comprises withdrawing a transporter locator to the router.
8. The method of claim 1 , wherein the data plane is a first data plane and the traffic is first traffic, further comprising maintaining a second data plane at the router for second traffic from the client device intended for a second service provided by the next-hop device or a second next-hop device.
9. A server configured to operate in a distributed application architecture, the server comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
enabling a service monitoring policy for data plane control (SMPDPC) on the router, wherein the SMPDPC comprises local policy-based routing instructions stored on the router, wherein the SMPDPC is configured to allow the router to determine if a communication pathway specific to the router is to be suppressed;
enabling, on the router, a router service provided by a service instance, wherein the router service is used by the router prior to forwarding traffic to a next-hop service provided by a next-hop device;
establishing bidirectional forwarding detection between the router and the service instance to commence monitoring of a functionality of the router service by the router;
establishing communications using a data plane session between the router and a client device on a data plane, wherein the data plane is for traffic received from the client device intended for the next-hop device;
receiving an indication that the router service provided by the service instance is nonfunctional; and
suppressing, by the router following the SMPDPC stored on the router, the data plane session to stop traffic originated from the client device and one or more second client devices on the data plane for the traffic originated from the client device and the one or more second client devices intended for the next-hop device.
10. The server of claim 9 , wherein the router is a first router and the service instance is a first service instance, further comprising the operations further comprising:
enabling, on a second router, the router service using a second service instance; and
establishing communications between the second router and the client device on the data plane, wherein the data plane is for traffic received from the client device intended for the next-hop device.
11. The server of claim 10 , the operations further comprising:
receiving an indication that the router service provided by the service instance is functional;
reestablishing bidirectional forwarding detection between the router and the service instance to commence monitoring of a functionality of the router service by the router;
reestablishing communications between the router and the client device on the data plane for traffic received from the client device intended for the next-hop device; and
disabling communications between the second router and the client device on the data plane.
12. The server of claim 9 , wherein the router service comprises a firewall, a data-loss-prevention service, a compliance-policy system, a load balancer, and an intrusion-prevention service.
13. The server of claim 9 , wherein the operations for enabling communications between the router and the client device on a data plane comprises operations for establishing a tunnel between the router and the client device.
14. The server of claim 13 , wherein the tunnel is a first tunnel, the operations further comprising, upon receiving the indication that the router service provided by the service instance is nonfunctional, ceasing the establishment of a second tunnel between the client device and the router for traffic on the data plane for traffic received from the client device intended for the next-hop device.
15. The server of claim 9 , wherein the operations for suppressing traffic received from the client device on the data plane for the traffic received from the client device intended for the next-hop device further comprises operations for withdrawing a transporter locator to the router.
16. The server of claim 9 , wherein the data plane is a first data plane and the traffic is first traffic, the operations further comprising maintaining a second data plane at the router for second traffic from the client device intended for a second service provided by the next-hop device or a second next-hop device.
17. A router comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
enabling a service monitoring policy for data plane control (SMPDPC) on the router, wherein the SMPDPC comprises local policy-based routing instructions stored on the router, wherein the SMPDPC is configured to allow the router to determine if a communication pathway specific to the router is to be suppressed;
enabling, on the router, a router service provided by a service instance, wherein the router service is used by the router prior to forwarding traffic to a next-hop service provided by a next-hop device;
establishing bidirectional forwarding detection between the router and the service instance to commence monitoring of a functionality of the router service by the router;
establishing communications using a data plane session between the router and a client device on a data plane, wherein the data plane is for traffic received from the client device intended for the next-hop device;
receiving an indication that the router service provided by the service instance is nonfunctional; and
suppressing, by the router following the SMPDPC stored on the router, the data plane session to stop traffic originated from the client device and one or more second client devices on the data plane for the traffic originated from the client device and the one or more second client devices intended for the next-hop device.
18. The router of claim 17 , wherein the router is a first router and the service instance is a first service instance, the operations further comprising:
enabling, on a second router, the router service using a second service instance; and
establishing communications between the second router and the client device on the data plane, wherein the data plane is for traffic received from the client device intended for the next-hop device;
receiving an indication that the router service provided by the service instance is functional;
reestablishing bidirectional forwarding detection between the router and the service instance to commence monitoring of a functionality of the router service by the router;
reestablishing communications between the router and the client device on the data plane for traffic received from the client device intended for the next-hop device; and
disabling communications between the second router and the client device on the data plane.
19. The router of claim 17 , wherein the router service comprises a firewall, a data-loss-prevention service, a compliance-policy system, a load balancer, and an intrusion-prevention service.
20. The router of claim 17 , wherein the data plane is a first data plane and the traffic is first traffic, the operations further comprising maintaining a second data plane at the router for second traffic from the client device intended for a second service provided by the next-hop device or a second next-hop device.