Overlay network ingress edge region selection
This disclosure relates to enhanced overlay network-based transport of traffic to and from customer branch office locations, facilitated through the use of the Internet-based overlay routing. A method of selecting an ingress edge region of the overlay network begins by mapping a service hostname to an IKEv2 destination of an outer IPsec tunnel associated with a first overlay network edge. An IKEv2 session is established from the first overlay network edge to the customer router. Upon tunnel establishment, a secondary lookup is performed to determine whether the first overlay network edge is an appropriate ingress region. Based on a response to the secondary lookup, a IKEv2 redirect is issued to a second overlay network edge. A new tunnel is then established from the second overlay network edge to the customer router. Thereafter, an additional lookup may also be performed to determine whether the second overlay network edge remains an appropriate ingress region.
1. A method of selecting an ingress edge region of an Internet-based overlay network, the overlay network having an authoritative domain name service (DNS), comprising:
receiving and mapping a service hostname to an IKEv2 destination of an outer IPsec tunnel associated with a first overlay network edge, the service hostname received at the authoritative DNS from a DNS resolver associated with a customer router;
establishing an IKEv2 session from the first overlay network edge to the customer router;
upon tunnel establishment between the customer router and the first overlay network edge, performing a secondary lookup to determine whether the first overlay network edge is an appropriate ingress region, the secondary lookup initiated to the authoritative DNS by the first overlay network edge;
based on a response to the secondary lookup and a determination by the first overlay network edge that a second overlay network edge region should be established as the ingress edge region, issuing a redirect from the first overlay network edge to a second overlay network edge; and
establishing a new tunnel from the second overlay network edge to the customer router.
2. The method as described in claim 1 wherein the secondary lookup is based on an IP address of the customer router.
3. The method as described in claim 1 further including:
performing an additional lookup to determine whether the second overlay network edge remains an appropriate ingress region, the additional lookup being initiated to the authoritative DNS by the second overlay network edge; and
based on a response to the additional lookup, dropping responses to one or more liveness probes otherwise being received over the new tunnel from the customer router, thereby triggering the customer router to initiate another service hostname lookup.
4. The method as described in claim 1 wherein the redirect is an IKEv2 redirect notify message.
5. The method as described in claim 3 wherein the one or more liveness probes are IP-SLA probes.
6. The method as described in claim 1 wherein the secondary lookup is also performed upon an IKE re-key event.
7. The method as described in claim 1 wherein the first and second overlay network edges are associated with distinct geographic locations.
8. A method of selecting an ingress edge region of an Internet-based overlay network, the overlay network having an authoritative domain name service (DNS), comprising:
receiving and mapping a service hostname to a first destination tunnel associated with a first overlay network edge, the service hostname received at the authoritative DNS from a DNS resolver associated with a customer router;
establishing a tunnel from the first overlay network edge to the customer router;
upon tunnel establishment between the customer router and the first overlay network edge, performing a secondary lookup to determine whether the first overlay network edge is an appropriate ingress region, the secondary lookup initiated to the authoritative DNS by the first overlay network edge;
when based on a response to the secondary lookup received from the authoritative DNS the first overlay network edge determines that it is an appropriate ingress region, using the tunnel to communicate messages between the customer router and the first overlay network edge;
when based on a response to the secondary lookup received from the authoritative DNS the first overlay network edge determines that it is not an appropriate ingress region, issuing a redirect from the first overlay network edge to a second overlay network edge; and
establishing a new tunnel from the second overlay network edge to the customer router.
9. The method as described in claim 8 wherein the session is an IKEv2 session.
10. The method as described in claim 9 wherein the redirect is an IKEv2 redirect notify message.
11. The method as described in claim 8 further including:
performing an additional lookup to determine whether the second overlay network edge remains an appropriate ingress region, the additional lookup being initiated to the authoritative DNS by the second overlay network edge; and
based on a response to the additional lookup, dropping responses to one or more liveness probes otherwise being received over the new tunnel from the customer router, thereby triggering the customer router to initiate another service hostname lookup.
12. The method as described in claim 11 wherein the liveness probes are IP-SLA probes.
13. The method as described in claim 8 wherein the first destination tunnel is an IKEv2 destination of an outer IPsec tunnel associated with the first overlay network edge.