Offloading network address translation and firewall rules to tier-1 routers for gateway optimization
The disclosure provides an approach for gateway optimization. Embodiments include receiving, at a first gateway associated with a first tenant within a data center, a packet directed to a first public network address of an endpoint associated with a second tenant within the data center. Embodiments include performing, by the first gateway, network address translation (NAT) to translate the first public network address to a private network address of the endpoint. Embodiments include forwarding, by the first gateway, the packet to an edge gateway of the data center. Embodiments include forwarding, by the edge gateway, the packet to a second gateway associated with the second tenant within the data center without sending the packet to a public interface of the edge gateway. Embodiments include forwarding, by the second gateway, the packet to the endpoint.
1. A method of gateway optimization, comprising:
receiving, at a first gateway associated with a first tenant within a data center, a packet directed to a first public network address of an endpoint associated with a second tenant within the data center;
performing, by the first gateway, network address translation (NAT) to translate the first public network address to a private network address of the endpoint;
forwarding, by the first gateway, the packet to an edge gateway of the data center;
forwarding, by the edge gateway, the packet to a second gateway associated with the second tenant within the data center without sending the packet to a public interface of the edge gateway; and
forwarding, by the second gateway, the packet to the endpoint.
2. The method of claim 1 , further comprising:
receiving, by the first gateway, one or more NAT table entries from the edge gateway, wherein the performing of the NAT to translate the first public network address to the private network address of the endpoint is based on the one or more NAT table entries.
3. The method of claim 1 , further comprising:
determining, by the second gateway, that the packet did not undergo firewall inspection at the edge gateway; and
applying, by the second gateway, one or more firewall rules to the packet based on the determining that the packet did not undergo firewall inspection at the edge gateway.
4. The method of claim 3 , wherein the determining, by the second gateway, that the packet did not undergo firewall inspection at the edge gateway is based on an indication in the packet.
5. The method of claim 4 , wherein the indication in the packet comprises:
a packet format associated with the data center;
a packet marker; or
absence of the packet marker.
6. The method of claim 3 , further comprising:
receiving, by the second gateway, the one or more firewall rules from the edge gateway as part of a firewall synchronization.
7. The method of claim 1 , further comprising:
maintaining, by the second gateway, state information related to the packet; receiving, by the second gateway, from the endpoint, an additional packet in response to the packet; and
performing, by the second gateway, NAT on the additional packet based on the state information related to the packet.
8. A system for gateway optimization, comprising:
at least one memory; and
at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to:
receive, at a first gateway associated with a first tenant within a data center, a packet directed to a first public network address of an endpoint associated with a second tenant within the data center;
perform, by the first gateway, network address translation (NAT) to translate the first public network address to a private network address of the endpoint;
forward, by the first gateway, the packet to an edge gateway of the data center;
forward, by the edge gateway, the packet to a second gateway associated with the second tenant within the data center without sending the packet to a public interface of the edge gateway; and
forward, by the second gateway, the packet to the endpoint.
9. The system of claim 8 , wherein the at least one processor and the at least one memory are further configured to:
receive, by the first gateway, one or more NAT table entries from the edge gateway, wherein the performing of the NAT to translate the first public network address to the private network address of the endpoint is based on the one or more NAT table entries.
10. The system of claim 8 , wherein the at least one processor and the at least one memory are further configured to:
determine, by the second gateway, that the packet did not undergo firewall inspection at the edge gateway; and
apply, by the second gateway, one or more firewall rules to the packet based on the determining that the packet did not undergo firewall inspection at the edge gateway.
11. The system of claim 10 , wherein the determining, by the second gateway, that the packet did not undergo firewall inspection at the edge gateway is based on an indication in the packet.
12. The system of claim 11 , wherein the indication in the packet comprises:
a packet format associated with the data center;
a packet marker; or
absence of the packet marker.
13. The system of claim 10 , wherein the at least one processor and the at least one memory are further configured to:
receive, by the second gateway, the one or more firewall rules from the edge gateway as part of a firewall synchronization.
14. The system of claim 8 , wherein the at least one processor and the at least one memory are further configured to:
maintain, by the second gateway, state information related to the packet;
receive, by the second gateway, from the endpoint, an additional packet in response to the packet; and
perform, by the second gateway, NAT on the additional packet based on the state information related to the packet.
15. A non-transitory computer readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
receive, at a first gateway associated with a first tenant within a data center, a packet directed to a first public network address of an endpoint associated with a second tenant within the data center;
perform, by the first gateway, network address translation (NAT) to translate the first public network address to a private network address of the endpoint;
forward, by the first gateway, the packet to an edge gateway of the data center;
forward, by the edge gateway, the packet to a second gateway associated with the second tenant within the data center without sending the packet to a public interface of the edge gateway; and
forward, by the second gateway, the packet to the endpoint.
16. The non-transitory computer readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:
receive, by the first gateway, one or more NAT table entries from the edge gateway, wherein the performing of the NAT to translate the first public network address to the private network address of the endpoint is based on the one or more NAT table entries.
17. The non-transitory computer readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:
determine, by the second gateway, that the packet did not undergo firewall inspection at the edge gateway; and
apply, by the second gateway, one or more firewall rules to the packet based on the determining that the packet did not undergo firewall inspection at the edge gateway.
18. The non-transitory computer readable medium of claim 17 , wherein the determining, by the second gateway, that the packet did not undergo firewall inspection at the edge gateway is based on an indication in the packet.
19. The non-transitory computer readable medium of claim 18 , wherein the indication in the packet comprises:
a packet format associated with the data center;
a packet marker; or
absence of the packet marker.
20. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:
receive, by the second gateway, the one or more firewall rules from the edge gateway as part of a firewall synchronization.