Systems and methods for sharing a control connection
In one embodiment, a method includes onboarding, by an edge router, a first tenant from a network management system and determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller. The method also includes reserving, by the edge router, a port number in a kernel for the first tenant and inserting, by the edge router, the tenant identifier into a first control packet. The method further includes communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session. The first peering session shares the encrypted control connection with a second peering session.
1. An edge router comprising one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and including instructions that, when executed by the one or more processors, cause the router to perform operations comprising:
onboarding a first tenant from a network management system;
determining a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller;
reserving a port number in a kernel for the first tenant;
inserting the tenant identifier into a first control packet;
communicating the first control packet to the controller via an encrypted control connection during a first peering session, wherein the first peering session shares the encrypted control connection with a second peering session; and
establishing, by a daemon installed on the edge router, the encrypted control connection with the controller,
wherein the tenant identifier is a global, 16-bit identifier that uniquely identifies the first tenant.
2. The edge router of claim 1 , the operations further comprising onboarding a second tenant from the network management system, wherein:
the first tenant is associated with the first peering session and a first virtual routing and forwarding (VRF) instance;
and the second tenant is associated with the second peering session and a second VRF instance.
3. The edge router of claim 2 , wherein the controller uses the tenant identifier to determine the first VRF instance.
4. The edge router of claim 1 , the operations further comprising:
notifying, by the daemon, an Overlay Management Protocol (OMP) of the encrypted control connection;
and communicating, by the OMP, an association between the port number and the tenant identifier to the daemon.
5. The edge router of claim 1 , the operations further comprising:
receiving a second control packet from the controller via the encrypted control connection;
decrypting the second control packet;
identifying a destination port associated with the second control packet;
writing the second control packet to the kernel, and determining, by the kernel, to place the second control packet on a socket based on the destination port.
6. The edge router of claim 1 , wherein:
the encrypted control connection is a Datagram Transport Layer Security (DTLS) control connection;
the router is a multi-tenant software-defined wide area network (SD-WAN) edge router;
and the port is a Transmission Control Protocol (TCP) port.
7. A method, comprising:
onboarding, by an edge router, a first tenant from a network management system;
determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller;
reserving, by the edge router, a port number in a kernel for the first tenant;
inserting, by the edge router, the tenant identifier into a first control packet;
and communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session, wherein the first peering session shares the encrypted control connection with a second peering session; and
establishing, by a daemon installed on the edge router, the encrypted control connection with the controller,
wherein the tenant identifier is a global, 16-bit identifier that uniquely identifies the first tenant.
8. The method of claim 7 , further comprising onboarding a second tenant from the network management system, wherein:
the first tenant is associated with the first peering session and a first virtual routing and forwarding (VRF) instance;
and the second tenant is associated with the second peering session and a second VRF instance.
9. The method of claim 8 , wherein the controller uses the tenant identifier to determine the first VRF instance.
10. The method of claim 7 , further comprising:
notifying, by the daemon, an Overlay Management Protocol (OMP) of the encrypted control connection;
and communicating, by the OMP, an association between the port number and the tenant identifier to the daemon.
11. The method of claim 7 , further comprising:
receiving a second control packet from the controller via the encrypted control connection;
decrypting the second control packet;
identifying a destination port associated with the second control packet;
writing the second control packet to the kernel, and determining, by the kernel, to place the second control packet on a socket based on the destination port.
12. The method of claim 7 , wherein:
the encrypted control connection is a Datagram Transport Layer Security (DTLS) control connection;
the router is a multi-tenant software-defined wide area network (SD-WAN) edge router;
and the port is a Transmission Control Protocol (TCP) port.
13. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
onboarding a first tenant from a network management system;
determining a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller;
reserving a port number in a kernel for the first tenant;
inserting the tenant identifier into a first control packet;
communicating the first control packet to the controller via an encrypted control connection during a first peering session, wherein the first peering session shares the encrypted control connection with a second peering session; and
establishing, by a daemon installed on an edge router, the encrypted control connection with the controller,
wherein the tenant identifier is a global, 16-bit identifier that uniquely identifies the first tenant.
14. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising onboarding a second tenant from the network management system, wherein:
the first tenant is associated with the first peering session and a first virtual routing and forwarding (VRF) instance;
and the second tenant is associated with the second peering session and a second VRF instance.
15. The one or more computer-readable non-transitory storage media of claim 14 , wherein the controller uses the tenant identifier to determine the first VRF instance.
16. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising:
notifying, by the daemon, an Overlay Management Protocol (OMP) of the encrypted control connection;
and communicating, by the OMP, an association between the port number and the tenant identifier to the daemon.
17. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising:
receiving a second control packet from the controller via the encrypted control connection;
decrypting the second control packet;
identifying a destination port associated with the second control packet;
writing the second control packet to the kernel, and determining, by the kernel, to place the second control packet on a socket based on the destination port.