Systems and methods for sharing a control connection
In one embodiment, a method includes onboarding, by an edge router, a first tenant from a network management system and determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller. The method also includes reserving, by the edge router, a port number in a kernel for the first tenant and inserting, by the edge router, the tenant identifier into a first control packet. The method further includes communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session. The first peering session shares the encrypted control connection with a second peering session.
1. A network component comprising one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and including instructions that, when executed by the one or more processors, cause the network component to perform operations comprising:
determining a mapping of a tenant identifier associated with a tenant to a controller identifier associated with a controller, wherein the tenant identifier is a global identifier that uniquely identifies the tenant;
establishing, by a daemon installed on the network component, an encrypted control connection with the controller;
inserting the tenant identifier into a control packet; and
communicating the control packet to the controller via the encrypted control connection during a peering session.
2. The network component of claim 1 , the operations further comprising notifying, by the daemon, an Overlay Management Protocol (OMP) of the encrypted control connection.
3. The network component of claim 1 , the operations further comprising:
reserving a port number for the tenant; and
communicating, by the OMP, an association between the port number and the tenant identifier to the daemon.
4. The network component of claim 1 , wherein the tenant is associated with a virtual routing and forwarding (VRF) instance.
5. The network component of claim 1 , the operations further comprising initiating a plurality of peering sessions with the controller via the encrypted control connection.
6. The network component of claim 1 , wherein the encrypted control connection is a Datagram Transport Layer Security (DTLS) control connection.
7. The network component of claim 1 , wherein the network component is a multi-tenant software-defined wide area network (SD-WAN) network component.
8. A method, comprising:
determining a mapping of a tenant identifier associated with a tenant to a controller identifier associated with a controller, wherein the tenant identifier is a global identifier that uniquely identifies the tenant;
establishing, by a daemon installed on a network component, an encrypted control connection with the controller;
inserting the tenant identifier into a control packet; and
communicating the control packet to the controller via the encrypted control connection during a peering session.
9. The method of claim 8 , further comprising notifying, by the daemon, an Overlay Management Protocol (OMP) of the encrypted control connection.
10. The method of claim 8 , further comprising:
reserving a port number for the tenant; and
communicating, by the OMP, an association between the port number and the tenant identifier to the daemon.
11. The method of claim 8 , wherein the tenant is associated with a virtual routing and forwarding (VRF) instance.
12. The method of claim 8 , further comprising initiating a plurality of peering sessions with the controller via the encrypted control connection.
13. The method of claim 8 , wherein the encrypted control connection is a Datagram Transport Layer Security (DTLS) control connection.
14. The method of claim 8 , wherein the network component is a multi-tenant software-defined wide area network (SD-WAN) network component.
15. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
determining a mapping of a tenant identifier associated with a tenant to a controller identifier associated with a controller, wherein the tenant identifier is a global identifier that uniquely identifies the tenant;
establishing, by a daemon installed on a network component, an encrypted control connection with the controller;
inserting the tenant identifier into a control packet; and
communicating the control packet to the controller via the encrypted control connection during a peering session.
16. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising notifying, by the daemon, an Overlay Management Protocol (OMP) of the encrypted control connection.
17. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:
reserving a port number for the tenant; and
communicating, by the OMP, an association between the port number and the tenant identifier to the daemon.
18. The one or more computer-readable non-transitory storage media of claim 15 , wherein the tenant is associated with a virtual routing and forwarding (VRF) instance.
19. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising initiating a plurality of peering sessions with the controller via the encrypted control connection.
20. The one or more computer-readable non-transitory storage media of claim 15 , wherein the encrypted control connection is a Datagram Transport Layer Security (DTLS) control connection.