Synchronizing communication channel state information for high flow availability

1. A method comprising:

for a communication channel facilitating communication between a customer on-premise network and a cloud service provider infrastructure and being terminated by a first endpoint in a customer premise equipment (CPE) in the customer on-premise network and a second endpoint on a primary host machine in the cloud service provider infrastructure, determining, by the primary host machine, a change in a state information of the communication channel, the state information including cryptographic information that is used to encrypt/decrypt data transmitted via the communication channel;

identifying, by the primary host machine, a replication chain for the communication channel, and a backup host machine within the replication chain, wherein the primary host machine is a head of the replication chain and the backup host machine is a successor host machine of the primary host machine in the replication chain;

responsive to determining by the primary host machine that the state information of the communication channel is to be replicated in a safe mode, causing by the primary host machine:

suspending processing of a packet,

communicating the change in the state information to the backup host machine,

receiving an acknowledgement indicating that the backup host machine has replicated the state information, and

responsive to receiving the acknowledgment, resuming the processing of the packet; and

responsive to detecting a failover of the communication channel, moving the second endpoint of the communication channel from the primary host machine to the backup host machine.

2. The method of claim 1 , further comprising:

upon determining that the replication of the change in the state information is not to be performed in the safe mode:

communicating, by the primary host machine, the change in the state information to the backup host machine; and

processing the packet by the primary host machine.

3. The method of claim 1 , wherein the state information of the communication channel comprises at least one of a sequence number, Internet Key Exchange (IKE) state information, and Border Gateway Protocol (BGP) state information.

4. The method of claim 1 , wherein the step of determining that the replication of the change in the state information is to be performed in the safe mode further comprises:

determining, by the primary host machine, that a downtime for the primary host machine is scheduled within a threshold time-interval.

5. The method of claim 1 , wherein determining the change in the state information of the communication channel further comprises:

detecting, by the primary host machine, an event triggering the change in the state information of the communication channel; and

analyzing, by the primary host machine, the packet associated with the event to determine the change in the state information.

6. The method of claim 5 , wherein the event triggering the change in the state information is at least one of:

receiving the packet at the primary host machine;

receiving a change in encryption or decryption information for a connection for the communication channel; and

receiving a change in Border Gateway Protocol (BGP) state information for the connection.

7. The method of claim 1 , wherein the primary host machine analyzes the packet by:

hashing, by the primary host machine, a portion of the packet to generate a hash result; and

identifying, by the primary host machine, the state information of the communication channel based on the hash result.

8. The method of claim 1 , wherein the communication channel is an Internet Protocol Security (IP Sec) tunnel.

9. A non-transitory computer-readable storage medium, storing computer-executable instructions that, when executed, cause a processor of a computer system to perform a method comprising:

for a communication channel facilitating communication between a customer on-premise network and a cloud service provider infrastructure and being terminated by a first endpoint in a customer premise equipment (CPE) in the customer on-premise network and a second endpoint on a primary host machine in the cloud service provider infrastructure, determining, by the primary host machine, a change in a state information of the communication channel, the state information including cryptographic information that is used to encrypt/decrypt data transmitted via the communication channel;

identifying, by the primary host machine, a replication chain for the communication channel, and a backup host machine within the replication chain, wherein the primary host machine is a head of the replication chain and the backup host machine is a successor host machine of the primary host machine in the replication chain;

responsive to determining by the primary host machine that the state information of the communication channel is to be replicated in a safe mode, causing by the primary host machine:

suspending processing of a packet,

communicating the change in the state information to the backup host machine,

receiving an acknowledgement indicating that the backup host machine has replicated the state information, and

responsive to receiving the acknowledgment, resuming the processing of the packet; and

responsive to detecting a failover of the communication channel, moving the second endpoint of the communication channel from the primary host machine to the backup host machine.

10. The non-transitory computer-readable storage medium of claim 9 , further comprising:

upon determining that the replication of the change in the state information is not to be performed in the safe mode:

communicating, by the primary host machine, the change in the state information to the backup host machine; and

processing the packet by the primary host machine.

11. The non-transitory computer-readable storage medium of claim 9 , wherein the state information for the communication channel comprises at least one of a sequence number, and Border Gateway Protocol (BGP) state information.

12. The non-transitory computer-readable storage medium of claim 9 , wherein the step of determining that the replication of the change in the state information is to be performed in the safe mode further comprises:

determining, by the primary host machine, that a downtime for the primary host machine is scheduled within a threshold time-interval.

13. The non-transitory computer-readable storage medium of claim 9 , wherein determining the change in the state information of the communication channel further comprises:

detecting, by the primary host machine, an event triggering the change in the state information of the communication channel; and

analyzing, by the primary host machine, the packet associated with the event to determine the change in the state information.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the event triggering the change in the state information is at least one of:

receiving the packet at the primary host machine;

receiving a change in encryption or decryption information for a connection for the communication channel; and

receiving a change in Border Gateway Protocol (BGP) state information for the connection.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the primary host machine analyzes the packet by:

hashing a portion of the packet to generate a hash result; and

identifying the state information of the communication channel based on the hash result.

16. The non-transitory computer-readable storage medium of claim 9 , wherein the communication channel is an Internet Protocol Security (IPSec) tunnel.

17. The method of claim 1 , wherein the change in the state information is identified by analyzing a packet received at the primary host machine.

18. The method of claim 1 , wherein the primary host machine queries a disk-backed storage server to identify the replication chain for the communication channel.