Fallback-aware policy-based routing
Methods, systems, and computer program products for computer networking. Legacy policy-based routing is advanced by adding fallback-aware policy actions that are enabled within a policy-based routing regime. Upon determining that a destination specified in a subject policy is compromised, or down, or unreachable then, a fallback-aware policy action is invoked. Destinations specified in policies may refer to inserted services, wherein an inserted service can be any one of, a service process, a service virtual machine, a hardware network component, or a virtual network interface. Such inserted services might implement a logging service, or a firewall service, or other services that can process a network packet. Fallback-aware policy actions include, a PASSTHROUGH fallback action, an ALLOW fallback action, a FORWARD fallback action, and a DROP fallback action. Various techniques serve to determine whether or not a particular destination of a subject policy is deemed to be compromised, or down or unreachable.
1. A non-transitory computer readable medium having stored thereon a sequence of instructions which, when stored in memory and executed by a processor cause the processor to perform acts comprising:
adding respective fallback-aware policy actions to policies defined in a policy-based routing regime; and
observing fallback-aware policy action in a first policy matching a first packet when a first destination specified in the first policy is deemed to be compromised, down, or unreachable, wherein the fallback-aware policy action comprising temporarily disabling the first policy; and
observing, after temporarily disabling the first policy, an action in a second policy matching the first packet when a second destination specified in the second policy is not deemed to be compromised, down, or unreachable, wherein the action comprise routing to a destination identified in the action of the second policy and the first policy is observed before the second policy is observed based on at least the first policy having a higher priority than the second policy.
2. The non-transitory computer readable medium of claim 1 , wherein the destination specified in the second policy is an inserted service, and wherein the inserted service is at least one of, a service process, a service virtual machine, a hardware network component, or a virtual network interface.
3. The non-transitory computer readable medium of claim 2 , wherein the inserted service implements at least one of, a logging service, a telemetry service, or a firewall service.
4. The non-transitory computer readable medium of claim 1 , the policy specifies a policy-based reroute destination and wherein the fallback-aware policy action is one of, a PASSTHROUGH fallback action, an ALLOW fallback action, a FORWARD fallback action, or a DROP fallback action.
5. The non-transitory computer readable medium of claim 4 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the PASSTHROUGH fallback action routes a packet to the destination specified in the packet rather than to the policy-based reroute destination.
6. The non-transitory computer readable medium of claim 4 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the ALLOW fallback action routes a packet to the policy-based reroute destination rather than to the destination specified in the packet.
7. The non-transitory computer readable medium of claim 4 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the DROP fallback action drops a packet rather than routing the packet to the policy-based reroute destination.
8. The non-transitory computer readable medium of claim 4 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the FORWARD fallback action routes a packet to a destination address in the packet, rather than routing the packet to the policy-based reroute destination.
9. A method comprising:
adding respective fallback-aware policy actions to policies defined in a policy-based routing regime; and
observing fallback-aware policy action in a first policy matching a first packet when a first destination specified in the first policy is deemed to be compromised, down, or unreachable, wherein the fallback-aware policy action comprising temporarily disabling the first policy; and
observing, after temporarily disabling the first policy, an action in a second policy matching the first packet when a second destination specified in the second policy is not deemed to be compromised, down, or unreachable, wherein the action comprise routing to a destination identified in the action of the second policy and the first policy is observed before the second policy is observed based on at least the first policy having a higher priority than the second policy.
10. The method of claim 9 , wherein the destination specified in the second policy is an inserted service, and wherein the inserted service is at least one of, a service process, a service virtual machine, a hardware network component, or a virtual network interface.
11. The method of claim 10 , wherein the inserted service implements at least one of, a logging service, a telemetry service, or a firewall service.
12. The method of claim 9 , the policy specifies a policy-based reroute destination and wherein the fallback-aware policy action is one of, a PASSTHROUGH fallback action, an ALLOW fallback action, a FORWARD fallback action, or a DROP fallback action.
13. The method of claim 12 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the PASSTHROUGH fallback action routes a packet to the destination specified in the packet rather than to the policy-based reroute destination.
14. The method of claim 12 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the ALLOW fallback action routes a packet to the policy-based reroute destination rather than to the destination specified in the packet.
15. The method of claim 12 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the DROP fallback action drops a packet rather than routing the packet to the policy-based reroute destination.
16. The method of claim 12 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the FORWARD fallback action routes a packet to a destination address in the packet, rather than routing the packet to the policy-based reroute destination.
17. A system comprising:
a storage medium having stored thereon a sequence of instructions; and
a processor that executes the sequence of instructions to cause the processor to perform acts comprising,
adding respective fallback-aware policy actions to policies defined in a policy-based routing regime; and
observing fallback-aware policy action in a first policy matching a first packet when a first destination specified in the first policy is deemed to be compromised, down, or unreachable, wherein the fallback-aware policy action comprising temporarily disabling the first policy; and
observing, after temporarily disabling the first policy, an action in a second policy matching the first packet when a second destination specified in the second policy is not deemed to be compromised, down, or unreachable, wherein the action comprise routing to a destination identified in the action of the second policy and the first policy is observed before the second policy is observed based on at least the first policy having a higher priority than the second policy.
18. The system of claim 17 , wherein the destination specified in the second policy is an inserted service, and wherein the inserted service is at least one of, a service process, a service virtual machine, a hardware network component, or a virtual network interface.
19. The system of claim 18 , wherein the inserted service implements at least one of, a logging service, a telemetry service, or a firewall service.
20. The system of claim 17 , the policy specifies a policy-based reroute destination and wherein the fallback-aware policy action is one of, a PASSTHROUGH fallback action, an ALLOW fallback action, a FORWARD fallback action, or a DROP fallback action.
21. The system of claim 20 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the PASSTHROUGH fallback action routes a packet to the destination specified in the packet rather than to the policy-based reroute destination.
22. The system of claim 20 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the ALLOW fallback action routes a packet to the policy-based reroute destination rather than to the destination specified in the packet.
23. The system of claim 20 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the DROP fallback action drops a packet rather than routing the packet to the policy-based reroute destination.
24. The system of claim 20 , wherein, when the policy-based reroute destination is deemed to be down or unreachable, the FORWARD fallback action routes a packet to a destination address in the packet, rather than routing the packet to the policy-based reroute destination.