Method and system of resiliency in cloud-delivered SD-WAN
In one aspect, a computerized method includes the step of providing process monitor in a Gateway. The method includes the step of, with the process monitor, launching a Gateway Daemon (GWD). The GWD runs a GWD process that implements a Network Address Translation (NAT) process. The NAT process includes receiving a set of data packets from one or more Edge devices and forwarding the set of data packets to a public Internet. The method includes the step of receiving another set of data packets from the public Internet and forwarding the other set of data packets to the one or more Edge devices. The method includes the step of launching a Network Address Translation daemon (NATD). The method includes the step of detecting that the GWD process is interrupted; moving the NAT process to the NATD.
1. A method of providing gateway operating in a software-defined wide area network (SD-WAN) connecting to at least one site of an enterprise, the method comprising:
deploying a cloud gateway in a first physical site;
configuring, at a second physical site of the enterprise, an edge device to forward packets from computers at the second physical site to the cloud gateway for the cloud gateway to forward the packets to computing devices outside of the second physical site;
configuring the cloud gateway to perform network address translation (NAT) operations, to allow a network address translation daemon (NATD) to provide session continuity by detecting a failover event and transferring an active NAT session state to the NATD, on the packets received from the edge device before forwarding the packets to the computing devices outside of the second physical site.
2. The method of claim 1 , wherein configuring the edge device comprises configuring the edge device to forward packets to the cloud gateway through the Internet.
3. The method of claim 1 further comprising configuring the cloud gateway to use an associated cloud web security (CWS) service to perform security scanning for packets from the edge device prior to forwarding the packets to the computing devices outside of the second physical site.
4. The method of claim 3 , wherein the cloud web security service further performs service insertion on the packets before the cloud gateway forwards the packets to the computing devices outside of the second physical site.
5. The method of claim 3 , wherein the cloud gateway forwards packets to the CWS service along a tunnel for the CWS to perform the security scanning on the packets.
6. The method of claim 5 , wherein the tunnel is an IPsec tunnel.
7. The method of claim 5 , wherein the tunnel is a first tunnel, and configuring the edge device to forward packets to the cloud gateway comprises configuring the edge device to forward packets along a second tunnel.
8. The method of claim 5 , wherein the tunnel is a first tunnel, the method further comprising configuring the edge device to forward other packets directly to the CWS service along a second tunnel.
9. The method of claim 1 , wherein the second physical site is a branch site of the enterprise.
10. A method of performing security services in a software-defined wide area network (SD-WAN) connecting to at least one sites of an enterprise, the method comprising:
deploying, in a first physical site, a cloud gateway with an associated cloud web security (CWS) service;
configuring, at a second physical site of the enterprise, an edge device to forward packets from computers at the second physical site to the first site for the CWS service to perform security scanning for packets from the edge device prior to the packets are forwarded to the destination of the packets;
wherein configuring the edge device comprises configuring the edge device to forward packets along first and second links of first and second Internet Service Providers (ISPs), the first link and the second link being selected based on a state to maintain continuous network connectivity by a network address translation daemon (NATD) detecting a failover event and transferring an active NAT session state to the NATD.
11. The method of claim 10 , wherein configuring the edge device further comprises configuring the edge device to forward packets along first and second tunnels that are established on the first and second links.
12. The method of claim 11 , wherein configuring the edge device further comprises configuring the edge device to dynamically select between the first and second tunnels based on measurement metrics repeatedly taken regarding a state of each tunnel.
13. A non-transitory machine readable medium storing a program for configuring a software-defined wide area network (SD-WAN) to perform gateway operating at a cloud gateway operating at a first physical site for at least one site of an enterprise, the program for execution by at least one processing unit, the program comprising sets of instructions for:
configuring, at a second physical site of the enterprise, an edge device to forward packets from computers at the second physical site to the cloud gateway for the cloud gateway to forward the packets to computing devices outside of the second physical site;
configuring the cloud gateway to perform network address translation (NAT) operations, to allow a network address translation daemon (NATD) to provide session continuity by detecting a failover event and transferring an active NAT session state to the NATD, on the packets received from the edge device before forwarding the packets to the computing devices outside of the second physical site.
14. The non-transitory machine readable medium of claim 13 , wherein the set of instructions for configuring the edge device comprises a set of instructions for configuring the edge device to forward packets to the cloud gateway through the Internet.
15. The non-transitory machine readable medium of claim 13 , wherein the program further comprises a set of instructions configuring the cloud gateway to use an associated cloud web security (CWS) service to perform security scanning for packets from the edge device prior to forwarding the packets to the computing devices outside of the second physical site.
16. The non-transitory machine readable medium of claim 15 , wherein the cloud web security service further performs service insertion on the packets before the cloud gateway forwards the packets to the computing devices outside of the second physical site.
17. The non-transitory machine readable medium of claim 15 , wherein the cloud gateway forwards packets to the CWS service along a tunnel for the CWS to perform the security scanning on the packets.
18. The non-transitory machine readable medium of claim 17 , wherein the tunnel is an IPsec tunnel.
19. The non-transitory machine readable medium of claim 17 , wherein the tunnel is a first tunnel, and configuring the edge device to forward packets to the cloud gateway comprises configuring the edge device to forward packets along a second tunnel.
20. The non-transitory machine readable medium of claim 17 , wherein the tunnel is a first tunnel, the method further comprising configuring the edge device to forward other packets directly to the CWS service along a second tunnel.