Network address translation in active-active edge cluster
Some embodiments provide a method for forwarding data messages at multiple edge gateways of a logical network that process data messages between the logical network and an external network. At a first edge gateway, the method receives a data message, having an external address as a destination address, from the logical network. Based on the destination address, the method applies a default route to the data message that routes the data message to a second edge gateway and specifies a first output interface of the first edge gateway for the data message. After routing the data message, the method applies a stored NAT entry that (i) modifies a source address of the data message to be a public NAT address associated with the first edge gateway and (ii) redirects the modified data message to a second output interface of the first edge gateway instead of the first output interface.
1. A method for operating an edge gateway device, the method comprising:
receiving a first data message from an external network, the first data message having an external address as a source address and a public NAT address as a destination address;
performing network address translation (NAT) on the first data message to modify the destination address to be a logical network address associated with a particular machine in a logical network; and
receiving a second data message from the logical network, the second data message having an external address as a destination address;
based on the external destination address of the second data message, applying a default route to the second data message that routes the second data message to a second one of a plurality of edge gateways and specifies a first output interface of a first edge gateway of the plurality of edge gateways for the second data message; and
after routing the second data message, applying a stored NAT entry for modifying a source address of the second data message to be a public NAT address associated with the first edge gateway.
2. The method of claim 1 , wherein:
the first output interface comprises an interface for traffic between the first edge gateway and other edge gateways; and
a second output interface, of the first edge gateway, comprises an uplink interface for connecting to external networks.
3. The method of claim 1 , wherein: the NAT entry maps the logical network address to the public NAT address for a data message flow to which the first and second data messages belong, wherein the NAT entry redirects the second data message to a second output interface of the first edge gateway instead of the first output interface of the first edge gateway.
4. The method of claim 3 , wherein the stored NAT entry identifies the data message flow based on source and destination network addresses, source and destination transport layer port numbers, and transport layer protocol.
5. The method of claim 1 , wherein the logical network is implemented in a virtual datacenter configured on a set of host computers in a public cloud, the virtual datacenter comprising (i) a set of workloads executing on the host computers and (ii) the plurality of edge gateways executing on the host computers.
6. The method of claim 5 , wherein:
the virtual datacenter workloads comprise (i) a set of network management components and (ii) a set of logical network endpoints connected by the logical network; and
the logical network is managed by the network management components of the virtual datacenter.
7. The method of claim 5 , wherein the external address corresponds to a virtual desktop client connecting to a shared resource operating on one or more workloads in the virtual datacenter.
8. The method of claim 7 , wherein the shared resource receives a plurality of connections from a plurality of virtual desktop clients via a plurality of edge gateways.
9. The method of claim 5 , wherein the default route routes the second data message to the second edge gateway because the second edge gateway provides a set of services for the virtual datacenter workloads that are not scaled to all of the edge gateways.
10. The method of claim 9 , wherein the set of services comprises at least one of domain name service (DNS) and virtual private network (VPN) service.
11. The method of claim 1 , wherein:
applying the stored NAT entry to redirect the second data message further comprises modifying a media access control (MAC) address of the second data message from a source MAC address corresponding to the first output interface to a source MAC address corresponding to a second output interface.
12. The method of claim 11 , wherein the stored NAT entry comprises a data link layer header based on a third data message previously received from the external network.
13. The method of claim 1 , wherein the edge gateways comprise at least two groups of edge gateways, each group associated with a different NAT address.
14. The method of claim 13 , wherein the first and second edge gateways belong to different groups.
15. A non-transitory machine-readable medium storing a program for execution by at least one processing unit of a host computer that implements a first edge gateway, the program comprising sets of instructions for:
receiving a first data message from an external network having an external address as a source address and a public NAT address as a destination address;
performing network address translation (NAT) on the first data message to modify the destination address to be a logical network address associated with a particular machine in a logical network; and
receiving a second data message from a logical network, the second data message having an external address as a destination address;
based on the external destination address of the second data message, applying a default route to the second data message that routes the second data message to a second one of a plurality of edge gateways and specifies a first output interface of the first edge gateway for the second data message; and
after routing the second data message, applying a stored NAT entry for modifying a source address of the second data message to be a public NAT address associated with the first edge gateway.
16. The non-transitory machine-readable medium of claim 15 , wherein:
the first output interface comprises an interface for traffic between the first edge gateway and other edge gateways; and
a second output interface, of the first edge gateway, comprises an uplink interface for connecting to external networks.
17. The non-transitory machine-readable medium of claim 15 , wherein the NAT entry maps the logical network address to the public NAT address for a data message flow to which the first and second data messages belong, wherein the NAT entry redirects the second data message to a second output interface of the first edge gateway instead of the first output interface of the first edge gateway.
18. The non-transitory machine-readable medium of claim 15 , wherein the logical network is implemented in a virtual datacenter configured on a set of host computers in a public cloud, the virtual datacenter comprising (i) a set of workloads executing on the host computers and (ii) the plurality of edge gateways executing on the host computers.
19. The non-transitory machine-readable medium of claim 18 , wherein the default route routes the second data message to the second edge gateway because the second edge gateway provides a set of services for the virtual datacenter workloads that are not scaled to all of the edge gateways.
20. The non-transitory machine-readable medium of claim 15 , wherein: the set of instructions for applying the stored NAT entry to redirect the second data message further comprises a set of instructions for modifying a media access control (MAC) address of the second data message from a source MAC address corresponding to the first output interface to a source MAC address corresponding to a second output interface.