Systems and methods for software defined hybrid private and public networking
Disclosed is a system comprised of different points-of-presence (“PoPs”) that provide software defined hybrid private and public networking for different entity sites. A system PoP may establish and/or maintain different network circuits for accessing different destinations or services. The system PoP may receive a tunnel creation request from a particular site, may obtain entity-defined policies that are specified for the particular site, and may establish a particular network tunnel to the particular site. The system PoP may then route egress traffic with a first classification through a first network circuit with a different quality of service (“QoS”) than egress traffic with a second classification according to the policies. Similarly, the system PoP may route ingress traffic arriving over the first network circuit through the particular network tunnel with a different QoS than ingress traffic arriving over the second network circuit according to the policies.
1. A first device, comprising:
one or more processors configured to:
establish a first network circuit that includes a first set of network devices;
establish a second network circuit that includes a different second set of network devices;
establish a particular network tunnel with a second device, wherein establishing the particular network tunnel includes receiving a set of policies indicating whether to route egress traffic, received from the second device, to the first circuit or to the second circuit, wherein the set of policies include a particular policy indicating that traffic, that is received from the second device and is associated with a particular signature, should be routed via the first network circuit;
receive first egress traffic from the second device via the particular network tunnel;
identify that the first egress traffic includes the particular signature that is associated with the first network circuit;
select, based on the set of policies associated with the second device and further based on identifying that the first egress traffic includes the particular signature, the first network circuit for routing the first egress traffic;
route the first egress traffic via the first network circuit;
receive second egress traffic from the second device via the particular network tunnel;
identify that the second egress traffic does not include the particular signature;
select, based on the set of policies associated with the second device and further based on identifying that the second egress traffic does not include the particular signature, the second network circuit for routing the second egress traffic; and
route the second egress traffic via the second network circuit.
2. The first device of claim 1 , wherein the one or more processors are further configured to:
identify that the first egress traffic includes a header parameter with a first set of values associated with the particular signature; and
identify that the second egress traffic does not include a header parameter with the first second set of values associated with the particular signature.
3. The first device of claim 1 , wherein the one or more processors are further configured to:
identify that the first egress traffic is directed to a first destination, wherein selecting the first network circuit for routing the first egress traffic is further based on identifying that the first egress traffic is directed to the first destination; and
identify that the second egress traffic is directed to a second destination, wherein selecting the second network circuit for routing the second egress traffic further based on identifying that the second egress traffic is directed to the second destination.
4. The first device of claim 1 ,
wherein the first network circuit is a private network circuit, and
wherein the second network circuit is a public network circuit.
5. The first device of claim 1 , wherein the one or more processors are further configured to:
prioritize distribution of first ingress traffic, sent to the second device via the first network circuit, over second ingress traffic, sent to the second device via the second network circuit, by allocating a greater amount of bandwidth of the particular network tunnel to the first ingress traffic than to the second ingress traffic.
6. The first device of claim 5 , wherein allocating the greater amount of bandwidth comprises:
identifying that the first ingress traffic includes the particular signature;
allocating, based on identifying that the first ingress traffic includes the particular signature and further based on the set of policies associated with the second device, a first amount of bandwidth to the first ingress traffic; and
identifying that the second ingress traffic does not include the particular signature;
allocating, based on identifying that the second ingress traffic does not include the particular signature and further based on the set of policies associated with the second device, a second amount of bandwidth to the second class ingress traffic.
7. The first device of claim 1 , wherein the particular network tunnel is a first network tunnel, and wherein the one or more processors are further configured to:
establish a second network tunnel to a third device;
determine that the second device and the third device are associated with a common entity; and
route egress traffic, received from the third device via the second network tunnel, to the first network circuit or the second network circuit according to the same set of policies as used for routing the egress traffic from the second device.
8. The first device of claim 1 , wherein the particular network tunnel is a first network tunnel, wherein the set of policies is a first set of policies, and wherein the one or more processors are further configured to:
establish a second network tunnel to a third device;
determine that the second device and the third device are associated with different entities;
select a second set of policies that are specified for the second site, wherein the second set of policies are different than the first set of policies; and
route egress traffic, received from the third device via the second network tunnel, to the first network circuit or the second network circuit according to the second set of policies.
9. The first device of claim 1 ,
wherein the set of policies associated with the second device site are defined by a first entity controlling the second device and are different than another set of policies associated with a third device controlled by a second entity.
10. The first device of claim 1 , wherein identifying that the first egress traffic includes the particular signature comprises:
performing deep packet inspection (“DPI”) on the first egress traffic; and
determining, based on performing the DPI on the first egress traffic, that the first egress traffic includes the particular signature.
11. A non-transitory computer-readable medium, storing a plurality of processor-executable instructions to:
establish, by a first device, a first network circuit that includes a first set of network devices;
establish a second network circuit that includes a different second set of network devices;
establish a particular network tunnel with a second device, wherein establishing the particular network tunnel includes receiving a set of policies indicating whether to route egress traffic, received from the second device, to the first circuit or to the second circuit, wherein the set of policies include a particular policy indicating that traffic, that is received from the second device and is associated with a particular signature, should be routed via the first network circuit;
receive first egress traffic from the second device via the particular network tunnel;
identify that the first egress traffic includes the particular signature that is associated with the first network circuit;
select, based on the set of policies associated with the second device and further based on identifying that the first egress traffic includes the particular signature, the first network circuit for routing the first egress traffic;
route the first egress traffic via the first network circuit;
receive second egress traffic from the second device via the particular network tunnel;
identify that the second egress traffic does not include the particular signature;
select, based on the set of policies associated with the second device and further based on identifying that the second egress traffic does not include the particular signature, the second network circuit for routing the second egress traffic; and
route the second egress traffic via the second network circuit.
12. The non-transitory computer-readable medium of claim 11 , wherein the plurality of processor-executable instructions further include instructions to:
identify that the first egress traffic includes a header parameter with a first set of values associated with the particular signature; and
identify that the second egress traffic does not include a header parameter with the first second set of values associated with the particular signature.
13. The non-transitory computer-readable medium of claim 11 , wherein the plurality of processor-executable instructions further include instructions to:
identify that the first egress traffic is directed to a first destination, wherein selecting the first network circuit for routing the first egress traffic is further based on identifying that the first egress traffic is directed to the first destination; and
identify that the second egress traffic is directed to a second destination, wherein selecting the second network circuit for routing the second egress traffic further based on identifying that the second egress traffic is directed to the second destination.
14. The non-transitory computer-readable medium of claim 11 , wherein the plurality of processor-executable instructions further include instructions to:
prioritize distribution of first ingress traffic, sent to the second device via the first network circuit, over second ingress traffic, sent to the second device via the second network circuit by allocating a greater amount of bandwidth of the particular network tunnel to the first ingress traffic than to the second ingress traffic.
15. The non-transitory computer-readable medium of claim 14 , wherein allocating the greater amount of bandwidth comprises:
identifying that the first ingress traffic includes the particular signature;
allocating, based on identifying that the first ingress traffic includes the particular signature and further based on the set of policies associated with the second device, a first amount of bandwidth to the first ingress traffic; and
identifying that the second ingress traffic does not include the particular signature;
allocating, based on identifying that the second ingress traffic does not include the particular signature and further based on the set of policies associated with the second device, a second amount of bandwidth to the second class ingress traffic.
16. The non-transitory computer-readable medium of claim 11 , wherein identifying that the first egress traffic includes the particular signature comprises:
performing deep packet inspection (“DPI”) on the first egress traffic; and
determining, based on performing the DPI on the first egress traffic, that the first egress traffic includes the particular signature.
17. A method, comprising:
establishing, by a first device, a first network circuit that includes a first set of network devices;
establishing a second network circuit that includes a different second set of network devices;
establishing a particular network tunnel with a second device, wherein establishing the particular network tunnel includes receiving a set of policies indicating whether to route egress traffic, received from the second device, to the first circuit or to the second circuit, wherein the set of policies include a particular policy indicating that traffic, that is received from the second device and is associated with a particular signature, should be routed via the first network circuit;
receiving first egress traffic from the second device via the particular network tunnel;
identifying that the first egress traffic includes the particular signature that is associated with the first network circuit;
selecting, based on the set of policies associated with the second device and further based on identifying that the first egress traffic includes the particular signature, the first network circuit for routing the first egress traffic;
routing the first egress traffic via the first network circuit;
receiving second egress traffic from the second device via the particular network tunnel;
identifying that the second egress traffic does not include the particular signature;
selecting, based on the set of policies associated with the second device and further based on identifying that the second egress traffic does not include the particular signature, the second network circuit for routing the second egress traffic; and
routing the second egress traffic via the second network circuit.
18. The method of claim 17 , wherein the particular network tunnel is a first network tunnel, the method further comprising:
establishing a second network tunnel to a third device;
determining that the second device and the third device are associated with a common entity; and
routing egress traffic, received from the third device via the second network tunnel, to the first network circuit or the second network circuit according to the same set of policies as used for routing the egress traffic from the second device.
19. The method of claim 17 , wherein the particular network tunnel is a first network tunnel, wherein the set of policies is a first set of policies for the first site, and the method further comprising:
establishing a second network tunnel to a third device;
determining that the second device and the third device are associated with different entities;
selecting a second set of policies that are specified for the second site, wherein the second set of policies are different than the first set of policies; and
routing egress traffic, received from the third device via the second network tunnel, to the first network circuit or the second network circuit according to the second set of policies.
20. The method of claim 17 , wherein identifying that the first egress traffic includes the particular signature comprises:
performing deep packet inspection (“DPI”) on the first egress traffic; and
determining, based on performing the DPI on the first egress traffic, that the first egress traffic includes the particular signature.