Network services across multiple network devices

Abstract

Embodiments of the present disclosure relate to network services across multiple network devices. In certain examples, a method includes receiving, at a non-owner network device of a set of network devices that implement a network service, a first network data unit of a network flow; identifying, by the non-owner network device, an identifying characteristic of the first network data unit, wherein the identifying characteristic is related to the network service; transmitting, by the non-owner network device, the first network data unit to a network service management owner of the set of network devices using a network tunnel based on the identifying of the identifying characteristic; identifying, by the network service management owner, the first network data unit as corresponding to the network service; and processing, by the network service management owner, the first network data unit to perform the network service.

Description

Background Technology

[0001] Computing devices frequently access networks (e.g., the Internet). This access is often facilitated using network devices. In some scenarios, such network devices can implement various network services (e.g., Network Address Translation (NAT) services). Attached Figure Description

[0002] Certain examples discussed in this disclosure will be described with reference to the accompanying drawings listed below. However, the drawings are merely illustrative of certain aspects or implementations of the examples described in this disclosure and are not intended to limit the scope of the claims. Figure 1 To better understand various aspects of this disclosure, please refer to the following detailed description. For a more complete understanding of this disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0003] Figure 1 A block diagram of a system for implementing network services across multiple network devices, according to one or more examples of this disclosure, is shown.

[0004] Figure 2 A flowchart illustrating an example interaction between network devices implementing network services according to one or more examples of this disclosure is shown.

[0005] Figure 3 An overview of an example method 300 for implementing network services across multiple network devices, according to one or more examples of this disclosure, is shown;

[0006] Figure 4 A block diagram of a computing device according to one or more examples of this disclosure is shown; and

[0007] Figure 5 A block diagram of a computing device according to one or more examples of this disclosure is shown. Detailed Implementation

[0008] The following disclosure provides many different examples for implementing various features. Specific examples of components and arrangements are described below to simplify this disclosure. Of course, these are merely examples and are not intended to be limiting.

[0009] Computing devices typically connect to networks (e.g., the Internet). This access is often facilitated using network devices. Sometimes, network devices are deployed in ways that provide redundancy, such as redundant connections from one network device to another, to provide such connectivity more robustly.

[0010] As an example, a client computing device can be operatively connected to an access network device, which can, for example, provide Layer 2 (L2) bridging functionality for the connected computing device. To facilitate access to other networks, a particular access network device can be connected to two or more aggregation network devices, which can, for example, collectively act as gateways to connect to other networks (e.g., the Internet). In such a deployment, the access network device can have a connection to each of the two or more aggregation network devices (thus providing redundancy), and the connections to individual aggregation network devices (e.g., links) can form aggregation groups (e.g., Link Aggregation Groups (LAGs)), sometimes also referred to as Multi-Chassis (MC) LAGs (MC-LAGs)).

[0011] Each aggregation group can be associated with an identifier for the aggregation group (e.g., an Ethernet segment identifier (ESI)). As an example, a specific LAG (e.g., a set of redundant links from an access network device to multiple aggregation network devices) can be associated with a specific ESI (e.g., ESI 100, ESI 200, etc.). Various links from the access network device to the aggregation network device can be used to provide redundancy for access, for example, if one of the links in the aggregation group stops functioning properly for any reason (e.g., cable break, transceiver failure, aggregation network device failure, etc.). While any number of techniques may exist for grouping redundant connections from a specific access switch to aggregation layer devices, and any of them can be used without departing from the scope of the examples in this disclosure, for ease of explanation, such aggregation groups are collectively referred to herein as LAGs. This deployment configuration can be used, for example, in an Ethernet Virtual Private Network (EVPN) Multihomed (MH) (EVPN-MH) deployment scenario.

[0012] Aggregator network devices can be configured to communicate with each other to share identifiers (e.g., EVIs) of the LAGs they share with at least one link. Thus, each aggregater network device with a link having a specific LAG can be aware of other aggregater network devices with links having the same LAG. Aggregator network devices serving a common LAG with a specific identifier can form a group of network devices, which, as an example, collectively act as a gateway from the aggregation group to an external network.

[0013] Therefore, outbound network traffic transmitted from a client computing device and received at one of the aggregated network devices from an access network device to which the client computing device is connected can be transmitted from any of the aggregated network devices (e.g., any of the aggregated network devices receiving the network traffic). Similarly, inbound traffic destined for a client computing device can be received at any of the aggregated network devices serving the LAG, and the aggregated network device receiving the inbound network traffic can provide the network traffic to an access network device to which the client computing device is connected, which in turn transmits the network traffic to the client computing device. Any suitable strategy for distributing network traffic among redundant aggregated network devices (e.g., various load balancing strategies) (e.g., based on each network data unit) can be used to determine which aggregated network device is used for inbound and / or outbound network data units (e.g., packets) of network traffic.

[0014] In this scenario, the aggregated network devices serving a given LAG can be configured to implement any number of network services for the LAG, such as, for example, a Network Address Translation (NAT) service. As an example, a NAT service can allow any number of underlying devices in a private network to access external networks using a pool of public Internet Protocol (IP) addresses and port numbers (which may be referred to as a NAT pool).

[0015] Specifically, network devices implementing NAT services can maintain a pool of IP addresses and port numbers. When a network flow (e.g., network traffic transmitted between two endpoint devices) is initiated (e.g., via a network data unit received from an underlying client computing device destined for another device in another network), the NAT service can perform a lookup in the NAT table to determine if a NAT IP address and port number from the NAT pool have already been assigned to the client computing device for that network flow. Because the network flow is being initiated (e.g., the first network data unit in the network flow), a NAT lookup can result in a NAT lookup miss.

[0016] In the event of a NAT lookup failure, the NAT service can select a NAT IP address and port number from the NAT pool, assign that NAT IP address and port number to the IP address and port number corresponding to the client computing device and used for network flow (this can be referred to as NAT assignment), and update its NAT table to reflect the NAT assignment. From then on, during network flow, network data units from the client computing device are updated (e.g., translated) to include the NAT IP address and port number, instead of the client computing device's source IP address and port number. A similar process can occur in reverse for network data units of network flow destined for the client computing device.

[0017] Therefore, NAT services can be used to: translate source IP addresses and port numbers to NAT IP addresses and port numbers for outbound network traffic from client computing devices, and similarly, translate NAT IP addresses and port numbers back to source IP addresses and port numbers for inbound network traffic to client computing devices.

[0018] As an example, a computing device seeking to communicate with another device via the Internet may send network data units (e.g., packets) to an access network device to which the computing device is connected. The network data unit may include (and other information items) the IP address of the device seeking communication (as the destination IP address), the IP address of the sending computing device (as the source IP address), and the source port number. The access network device may (e.g., based on a load balancing strategy) transmit the network data units to an aggregated network device that the access network device is connected to via a set of links forming a LAG.

[0019] After receiving a network data unit from an underlying computing device (e.g., via an access network device), the aggregation network device implementing NAT services can perform a NAT lookup to determine if its NAT table includes an entry that matches the source IP address and port number. When such an entry exists, the source IP address and port number of the network data unit may be replaced with the NAT IP address and port number from a pool of NAT IP addresses and corresponding port numbers allocated to the computing device (e.g., the initial source IP address of the network data unit), which had previously been allocated as part of the NAT allocation. The updated network data unit can then proceed to its destination.

[0020] For incoming network traffic, a similar process occurs in reverse. When the aggregating network device receives a network data unit, the destination IP address can be a NAT IP address assigned to the source IP address of the computing device. The NAT IP address is used to look up the computing device's IP address and port number, and the network data unit is updated to include that IP address and port number, instead of the NAT IP address and port number, as the destination IP address and port number. The aggregating network device can then transmit the network data unit to the access network device, which can then forward the network data unit to the appropriate computing device corresponding to the destination IP address and port number.

[0021] In a scenario where a group of aggregated network devices serves a specific LAG, NAT services can be implemented. Therefore, NAT services can be implemented across this group of aggregated network devices serving the LAG. Since any of the aggregated network devices implementing the NAT service can be transmitting to or receiving from a remote device in the network flow, one of the aggregated network devices can be elected as the NAT pool management owner for that NAT service. This election can be performed using any suitable election technique (e.g., minimum switch virtual interface (SVI) IP address).

[0022] The NAT pool management owner is responsible for allocating NAT IP addresses and port numbers from a pool (e.g., a NAT pool) that assigns NAT IP addresses and port numbers for NAT services. As discussed above, such allocations typically occur when a computing device initiates a network flow (e.g., sending the first network data unit in a network flow using its own IP address as the source IP address and a specific port number as the source port number). The NAT pool management owner can make the allocation and then pass it on to other aggregation network devices serving the LAG. Each aggregation network device (e.g., the NAT pool management owner and non-owner devices) can update their respective NAT tables, and subsequent network data units in the network flow can use that NAT IP address and port number, regardless of which aggregation layer device receives the subsequent network data unit. For a set of aggregation network devices implementing NAT services for the LAG, any aggregation network device that is not elected as the NAT pool management owner can be referred to as a non-owner network device. Therefore, a non-owner network device for NAT services can be any aggregation network device serving the LAG and implementing NAT services, but it is not the elected NAT pool management owner.

[0023] However, to facilitate the use of NAT services on LAG as described above, when any non-owner aggregation network device receives the initial network data unit of a network flow and attempts to perform a NAT lookup using its NAT table, the result may be a NAT lookup miss (e.g., instead of a NAT lookup hit for subsequent network data units when the NAT table has been updated). In the event of a NAT lookup miss on a non-owner network device, that non-owner network device must communicate with the NAT pool management owner of the NAT service to obtain a NAT assignment that utilizes its updated NAT table. Such communication between the non-owner network device and the NAT pool management owner is typically achieved, for example, by the non-owner network device intercepting network data units and obtaining a portion of the information (e.g., source IP address and port number) from the network data units. The obtained information can then be provided to software executing on one or more processors of the non-owner network device. Such software can be configured to communicate with corresponding software running on one or more processors of the NAT pool management owner. To perform a NAT assignment, it then selects an available NAT IP address and port number from the NAT pool, programs the NAT assignment into its own NAT table, and forwards the assignment back to the non-owner device that received the request (as well as any other non-owner network devices serving the LAG). The non-owner network device then updates its own NAT table and is ultimately able to update the network data unit and send the updated network data unit to its destination.

[0024] Implementing network services for a LAG across multiple aggregated network devices can introduce several performance issues. For example, receiving network traffic from different network devices serving the LAG and requesting network services for it can cause such problems. As an example, if a NAT lookup is successful on a given aggregated network device, that lookup (along with other related lookups and actions) is typically performed in the network device's hardware along the data path (e.g., network data units can be processed and transmitted without invoking the software of non-owner network devices and the NAT pool management owner to obtain a NAT assignment before sending the network data unit). Therefore, the latency introduced by the NAT lookup is relatively low.

[0025] When a NAT lookup miss occurs on the NAT pool manager owner, the NAT pool manager owner must perform a NAT assignment, introducing a small amount of additional latency. However, latency and other metrics, such as NAT connections per second (CPS), still represent an acceptable level of performance.

[0026] On the other hand, when a non-owner network device experiences a NAT lookup miss, higher latency and lower CPS metrics result from the fact that additional software-based communication must occur between the non-owner aggregating network device and the NAT pool manager owner before network data units can be transmitted to the destination. Specifically, the non-owner network device must send a request for a NAT assignment to the NAT pool manager owner and receive the NAT assignment from the NAT pool manager owner before it can transmit network data units. This action increases the latency of transmitting network data units from the non-owner network device and reduces the CPS metric of the NAT service.

[0027] The examples disclosed herein address at least the aforementioned performance issues arising from implementing network services on multiple separate network devices. Specifically, in one or more examples, a set of network devices can be configured such that when a non-owner device of a network service receives a network data unit associated with a particular network service, the non-owner device can transmit the network data unit (e.g., via a network tunnel) to the owner device of the network service (e.g., a NAT pool management owner) for further processing related to the service. Thus, the owner network device can process the network data unit received via the network tunnel to facilitate the implementation of the network service, and then transmit information about the processing back to the non-owner network device from which it received the network data unit, as well as to other non-owner network devices in the set of network devices implementing the network service.

[0028] As an example, a non-owner network device implementing a LAG that performs NAT services can be configured to cause network data units that result in a NAT lookup miss to be sent directly to the NAT pool management owner (e.g., instead of sending a request for NAT assignment).

[0029] As an example, LAG's aggregation network devices can be configured with Virtual Tunnel Endpoint (VTEP) functionality (e.g., in a Virtual Extensible Local Area Network (VXLAN) environment). VTEP can encapsulate network data units using various information items (e.g., including but not limited to VXLAN Network Identifier (VNI)). The encapsulated network data units can then be transmitted directly to the NAT pool management owner (e.g., to a designated recirculation port of the NAT pool management owner) (e.g., using a dedicated VXLAN tunnel).

[0030] The NAT pool management owner can then (e.g., using VNI and / or encapsulating any other relevant items in the network data unit) identify the network traffic unit as requiring NAT services (e.g., NAT assignment). In response, the network data unit can be decapsulated (e.g., by VTEP performed on the NAT pool management owner) and provided to the NAT pool management owner's data path, for example, as if it had originally been received by the NAT pool management owner.

[0031] The NAT pool owner can then perform a NAT lookup, which results in a NAT lookup miss. In response to the NAT lookup miss, the NAT pool owner can assign a NAT to the network data unit and update its NAT table to reflect the assignment. The network data unit can then be updated based on the NAT assignment and transmitted from the NAT pool owner to its destination. Alternatively, the NAT pool owner can transmit the NAT assignment to non-owner network devices in the LAG, allowing the non-owner network devices to update their corresponding NAT tables and use the information therein for future network data units in the network flow.

[0032] The aforementioned process for NAT allocation can reduce latency and increase the CPS value of communication from computing devices through the aggregated network devices in the LAG, where this group of aggregated network devices is implementing NAT services. For example, this improvement can result from eliminating bidirectional software-based communication between non-owner aggregated network devices and the NAT pool management owner, facilitating NAT allocation from the NAT pool management owner to non-owner network devices before network data units can be transmitted.

[0033] Conversely, using the examples of this disclosure, a NAT lookup miss for a network data unit on a non-owner network device may result in the encapsulated network data unit being transmitted to the NAT pool management owner via a network tunnel (e.g., a VXLAN tunnel), which can decapsulate the encapsulated network data unit to obtain the original network data unit, perform a NAT allocation, transmit the network data unit to its destination, and send the NAT allocation to the non-owner aggregation network device of the LAG.

[0034] Therefore, the transmission of network data units does not need to wait for the return transmission of NAT assignment from the NAT pool management owner. Additionally, the transmission of network data units to the NAT pool management owner via VXLAN tunnels uses a faster hardware data path between the non-owner aggregation network device and the NAT pool management owner, rather than using slower software interactions between the two devices executed on their processors to facilitate NAT assignment.

[0035] While the above description uses examples of implementing this technical solution in an environment where multiple aggregated network devices serve a specific LAG that implements NAT services, the examples of this disclosure can be applied to any relevant scenario where the NAT service is implemented across multiple network devices serving the underlying computing devices within a private network. As an example, a client computing device can connect to an access network device to achieve network connectivity, where the access network device is configured to provide access redundancy (e.g., when the client computing device moves between access network devices). In this scenario, the access network device can, for example, act as an anycast gateway for accessing other networks. Similar to the aggregated network devices discussed above, these anycast gateway access network devices can be configured to implement NAT services and use techniques similar to those discussed above, such that when a NAT lookup miss occurs on a non-owner network device, the network data unit causing the NAT lookup miss is directly transmitted to the NAT pool management owner for NAT allocation and transmission. The NAT pool management owner then transmits the NAT allocation to other access network devices for use in future communications within a given network flow.

[0036] Additionally, while the above description anticipates examples of implementing NAT services, the techniques disclosed herein can be implemented in other scenarios where network services are implemented across two or more network devices. For example, a Transmission Control Protocol (TCP) connection can be established using a handshake process. Typically, the client computing device seeking to establish a TCP connection sends TCPSyn packets to the destination device. In response, the destination device returns TCP Syn-Ack packets to acknowledge the Syn packets from the client. Finally, the client acknowledges the Syn-Ack packets by sending TCP Ack packets to the destination device.

[0037] However, this handshake process may fail to function correctly when the client computing device can communicate with the destination device through two or more network devices (e.g., two or more aggregated network devices serving a LAG). For example, a TCP Syn packet from the client computing device might be transmitted through one network device, but a TCP Syn-Ack packet might be returned to another network device, which would then discard the packet, causing the handshake process to fail.

[0038] The example disclosed herein can address such problems by establishing a specific network device from a group of network devices (e.g., a group of aggregated network devices serving a particular LAG) as the TCP session establishment owner. In this case, TCP handshake packets destined for the non-owner network device can be recognized by the non-owner device, encapsulated using the non-owner device's VTEP, and transmitted to the TCP session establishment owner. The TCP session establishment owner can then recognize the encapsulated packet as a TCP handshake packet (e.g., based on the VNI included in the encapsulation), decapsulate the handshake packet, and process the packet (e.g., send it to the destination device or client depending on which stage of the handshake the packet corresponds to). Thus, the TCP session establishment owner ultimately manages the TCP session establishment process and then transmits the relevant details of the TCP session to the non-owner device.

[0039] Figure 1 A block diagram of a system for implementing network services across multiple network devices, according to one or more examples of this disclosure, is shown. Figure 1 As shown, system 100 includes computing device 102, access network device 104, network device A 106, network device B 108, network 138, and destination device 140. Network device A 106 may include port A 110, data path component A 112, network service A 114, recirculation port 118, VTEP A 120, and port B 122. Network device B 108 may include port C 128, data path component B 126, network service B 130, VTEP B 132, port E 134, and port D 136. Network device A 106 and network device B may be connected, for example, via tunnel connection 124. Each of these components is discussed below.

[0040] In one or more examples, computing device 102 is any device that may from time to time seek to communicate with other devices via a network (e.g., network 138). Computing device 102 may also be referred to herein as a client computing device.

[0041] As used herein, a network (e.g., network 138) can refer to the entire network or any part thereof (e.g., a logical portion of a device within the topology of a device). A network (e.g., network 138) can include a data center network, a wide area network, a local area network, a wireless network, a cellular telephone network, an InfiniBand network, and / or any other suitable network that facilitates the exchange of information from one part of a network to another (e.g., within a device and / or between devices connected to the network). A network can be any combination of the network types described above. A network can be located at a single physical location or distributed across any number of physical locations. In one or more examples, a network can be coupled to or at least partially overlap with the Internet.

[0042] In one or more examples, as used herein, a computing device (e.g., computing device 102) can be any single computing device, a group of computing devices, a portion of one or more computing devices, or any other physical, virtual, and / or logical grouping of computing resources. Figure 4 and Figure 5 The diagram illustrates a non-limiting example of a computing device, which is described below. In one or more examples, the computing device can be any type of device configured to host all or any part of one or more operating systems, applications, microservices, cluster environment services, storage services, network services, and / or any other computing functionality, which may include executing instructions, performing operations, executing functions, performing computations, etc.

[0043] In one or more examples, the computing device (e.g., computing device 102) can be any device, part of a device, or any set of devices capable of electronically processing instructions, and can include, but is not limited to, any of the following: one or more processors (e.g., components including circuitry), memory (e.g., random access memory (RAM)), input and output devices (multiple) of inputs and outputs, non-volatile storage hardware (e.g., solid-state drives (SSDs), persistent memory (Pmem) devices, hard disk drives (HDDs)), one or more physical interfaces (e.g., network ports, storage ports), any number of other hardware components, and / or any combination thereof.

[0044] Examples of computing devices (e.g., computing device 102) include, but are not limited to, servers (e.g., blade servers in a blade server chassis, rack servers in a rack, desktop servers, any other type of server equipment), desktop computers, mobile devices (e.g., laptops, smartphones, personal digital assistants, tablet computers, automotive computing systems, and / or any other mobile computing devices), storage devices (e.g., disk drive arrays, Fibre Channel storage devices, Internet Small Computer System Interface (iSCSI) storage devices, tape storage devices, flash storage arrays, network-attached storage devices, any other type of storage devices), network devices, virtual machines, virtualized computing environments, logical containers (e.g., for one or more applications), container cabins, Internet of Things (IoT) devices, arrays of nodes of computing resources, supercomputing devices, data centers or any part thereof, any combination of the foregoing and / or any other type of computing device. As will be appreciated by those skilled in the art, any of the above examples of computing devices necessarily requires at least some hardware components.

[0045] In one or more examples, the storage devices and / or memory of a computing device or system of computing devices can be and / or include one or more data repositories of any number of data structures for storing any amount of data (e.g., information). In one or more examples, a data repository is any type of storage unit and / or device for storing data (e.g., file system, database, collection of tables, RAM, hard disk drive, solid-state drive, and / or any other storage mechanism or medium). Furthermore, a data repository can include multiple different storage units and / or devices. These multiple different storage units and / or devices may or may not be of the same type, or located in the same physical location.

[0046] Any storage device and / or memory of a computing device or a system of computing devices may be regarded, in whole or in part, as a non-transitory computer-readable medium storing software and / or firmware that, when executed by one or more processors, causes one or more processors to perform operations according to one or more examples of this disclosure (e.g., execute one or more computer programs).

[0047] In one or more examples, computing device 102 may be operatively connected to an access network device (e.g., access network device A 104). In one or more examples, the network device is an example of a type of computing device (discussed above). In one or more examples, network device A 106 and network device B 108 are also network devices.

[0048] In one or more examples, a network device (e.g., 104, 106, 108) is a device that includes and / or is operatively connected to a persistent storage device (not shown), a memory (e.g., random access memory (RAM)) (not shown), one or more processors (e.g., integrated circuits, ASICs, etc.) (not shown), and two or more physical network interfaces (not shown), which may also be referred to as a port or multiple ports, and which can provide connectivity (e.g., links) to other devices (e.g., computing devices, other network devices, etc.) through which information (e.g., data) can be transmitted.

[0049] In one or more examples, the network device (e.g., 104, 106, 108) also includes any number of additional components (not shown), such as, for example, a network chip (not shown), a field-programmable gate array (FPGA) (not shown), an application-specific integrated circuit (ASIC) (not shown), indicator lights (not shown), a fan (not shown), a power supply unit (not shown), a power distribution unit (not shown), etc.

[0050] As an example, at least a portion of such hardware components may be included as part of a data path component that may be referred to as a network device, such as data path component A 112 for network device A 106 and data path component B 126 for network device B 108. In one or more examples, a data path component (e.g., 112, 126) refers to a collection of hardware components (e.g., connected via a printed circuit board), including any number of hardware components (e.g., ASICs, FPGAs, Level 3 Content Addressable Memory (TCAM), processor components, other memory components, etc.) that are at least partially used to store information (e.g., forwarding information, NAT allocation, and other information) in one or more hardware tables and are configured to perform lookups using at least the stored information and to perform actions related to network data units to process network traffic based on such information.

[0051] For example, forwarding information can be stored in one or more hardware components of a network device (e.g., in various tables, not shown), such as MAC tables, routing table entries, multicast forwarding entries, etc. Such forwarding information can be used to determine what action to take when a network data unit is received by a network device (e.g., 104, 106, 108).

[0052] NAT assignments can be stored, for example, in a NAT table (not shown). In one or more examples, the NAT table includes entries that store the association between the IP address and port number of a computing device and a NAT IP address and port number assigned to the computing device by the NAT pool management owner of the NAT service via NAT assignment (discussed further below).

[0053] As discussed above, data path components (e.g., 112, 126) can include various components configured to perform operations based on lookups performed in various hardware tables of the data path components. Such operations can include, but are not limited to, performing NAT lookups in the NAT table. Such lookups may result in a NAT lookup hit, where information from the network data unit (e.g., IP address and port number) is found in the NAT table. In one or more examples, a NAT lookup hit may lead to further processing of the network data unit to update it (e.g., replacing the source or destination IP address and port number of the network data unit with the IP address and port number found in the NAT table), and then further processing of the network data unit to transport it to its destination. NAT functionality is discussed further below.

[0054] Network devices (e.g., 104, 106, 108) may also include information such as a routing information base (RIB), which includes information (e.g., obtained from various routing protocols) that can be used to program components of the network device to propagate network data units. Network devices may include any other components without departing from the scope of the examples described herein, and are therefore not limited to any arrangement of the components shown in the figures and / or described herein.

[0055] In one or more examples, as discussed above, network devices (e.g., 104, 106, 108) include at least two physical interfaces, which may be referred to as ports. As an example, Figure 1 Network device A 106 with port A 110, port B 122, and recirculation port 118 is shown, as well as network device B 108 with port C 128, port E 134, and port D 136. Although Figure 1These specific ports are shown (which are discussed further below), but network devices (e.g., access network device 104, network device A 106, network device B 108) may have any number of ports without departing from the scope of the examples in this disclosure. In one or more examples, the physical interface is any hardware, software, or combination thereof that includes the ability to receive network data units (e.g., packets, frames, etc.) or any other information from and from the network device. The physical interface may include any interface technology, such as, for example, optical, electrical, etc. The physical interface may be configured to interface with any transmission medium (e.g., optical fiber, (multiple) copper wires, etc.).

[0056] In one or more examples, the physical interface includes and / or is operatively connected to any number of components used in the processing of network traffic, all or part of which can be considered as Figure 1 This is part of data path component A112 and / or data path component B126 shown. For example, a given physical interface may include a PHY (not shown), which is circuitry connecting a physical information transmission medium (e.g., a wire, not shown) to other components (e.g., hardware components of a line card) that process network traffic. In one or more examples, the physical interface includes and / or is operatively connected to a transceiver that provides the connection between the physical information transmission medium and the PHY. The PHY may also include any number of other components, such as, for example, serializers / deserializers (SERDES), encoders / decoders, etc. The PHY may further be operatively connected to any number of other components, such as, for example, a Media Access Control (MAC) sublayer. Such sublayers may further be operatively connected to other higher-level processing components of the data path (e.g., 112, 126), all of which form a series of components used in the processing of network traffic received, transmitted, or otherwise used by network devices for any purpose.

[0057] In one or more examples, the network device (e.g., 104, 106, 108) includes any software (e.g., operating system, various daemons, state database, various services, etc.), firmware, etc., configured to perform and / or allow other components to perform various functions of the network device (e.g., processing network traffic, implementing NAT services, implementing access control, monitoring network usage, etc.). Such software may be executed, for example, using one or more processors (not shown) of the network device (e.g., 104, 106, 108) or any other hardware resource of the network device capable of executing software. Any storage devices and / or memories (not shown) of the network device (e.g., 104, 106, 108) may be considered, in whole or in part, as non-transitory computer-readable media storing software and / or firmware (e.g., computer programs) that, when executed by one or more processors (not shown) of the network device, cause the one or more processors to perform operations according to one or more examples of this disclosure (e.g., executing one or more computer programs).

[0058] Examples of network devices (e.g., 104, 106, 108) include, but are not limited to, switches, routers, multilayer switches, Fibre Channel devices, Devices, etc. Network devices are not limited to the specific examples mentioned above. For example, any computing device (discussed above) can be configured at least partially as a network device as used herein.

[0059] In one or more examples, as discussed above, the network device (e.g., 104, 106, 108) includes the functionality to receive network data units (e.g., frames, packets, tunneling protocol frames, etc.) at any port of the network device (e.g., 110, 118, 122, 128, 134, 136), and the functionality to process network data units (e.g., receive, transmit, use, update, etc.). In one or more examples, processing network traffic includes, but is not limited to, a series of one or more lookups (e.g., longest prefix match (LPM) lookup, NAT lookup, forwarding equivalence class (FEC) lookup, etc.) and corresponding actions (e.g., forwarding from an egress port, adding a tagged protocol header, rewriting the destination address, encapsulation, decapsulation, etc.). Examples of network traffic processing include, but are not limited to: (i) performing a NAT lookup as part of implementing a NAT service; (ii) determining whether to take a security action (e.g., dropping a network traffic data unit); (iii) determining whether to mirror a network traffic data unit; and / or (iv) determining how to route / forward a network traffic data unit for transmission from a port of a network device (e.g., 104, 106, 108). Network devices (e.g., 104, 106, 108) may perform other actions, operations, functions, etc., with respect to network traffic data units without departing from the scope of examples in this disclosure. Additionally, while various possible configurations, components, and functions of network devices are discussed herein, any particular network device may be configured with some, but not all, of the possible configurations, components, and functions of a network device.

[0060] As discussed above, network devices (e.g., 104, 106, 108) can be considered as a type of computing device that is at least partially configured to provide network access and functionality to any number of other devices to which they are operatively connected.

[0061] exist Figure 1 In the example shown, computing device 102 is connected to a specific network device; access network device 104. In one or more examples, access network device 104 is configured to at least implement bridging functionality, which may include processing network traffic based, for example, at least in part, on L2 header information (e.g., MAC address) of network data units. As an example, access network device 104 may be configured to receive network data units from computing device 102, perform a lookup in a forwarding table using the MAC address information of the network data unit, and forward the network data unit to its destination at least in part based on the lookup result.

[0062] In one or more examples, access network device 104 can be operatively connected to any number of other network devices. Figure 1The example shown depicts an access network device connected to two network devices (network device A 106 and network device B 108) and computing device 102. However, access network device 104 can be connected to any number of other network devices and / or computing devices without departing from the scope of the examples in this disclosure.

[0063] In one or more examples, a set of connections between access network device 104 and other network devices (e.g., 106, 108) can be configured as a LAG. In one or more examples, an LAG is a configuration that combines multiple ports of network devices into a single logical port. For example, this configuration can provide connectivity redundancy in a scenario where one of the links in the LAG fails for any reason. In one or more examples, any appropriate strategy for distributing network traffic among two or more links (e.g., a round-robin strategy, any other load balancing strategy, etc.) can be used to determine which link in the configured LAG is used to propagate network traffic. As an example, when network traffic is received from computing device 102 at access network device 104, the network data unit of the network traffic can be propagated to its destination using the link between access network device 104 and port A 110 of network device A 106, or the link between access network device 104 and port C 128 of network device B 108, based on an appropriate load balancing strategy.

[0064] In one or more examples, network traffic from computing device 102 may be destined for a specific location, such as, for example, destination device 140. For example, destination device 140 may be a computing device (discussed above). In one or more examples, network traffic to (and from) a specific destination (e.g., destination device 140) may be considered a network flow. A network flow may be network traffic with certain common characteristics, such as, for example, a common set of endpoints (e.g., source and destination) identified in a network data unit using various addresses (e.g., IP addresses) and port numbers.

[0065] In one or more examples, network device A 106 and network device B 108 can be configured as redundant network devices for connecting underlying devices (e.g., computing device 102, access network device 104) to other devices (e.g., destination device 140) via a network (e.g., network 138). At least a portion of network 138 may include an external network (e.g., the Internet). Therefore, network device A 106 and network device B 108 can be configured to perform routing functions as part of a set of actions, operations, etc., performed when network data units are received for propagation to their respective destinations. In one or more examples, because network device A 106 and network device B 108 provide connectivity between downstream devices (e.g., computing device 102, access network device 104) and upstream devices (e.g., destination device 140) via network 138, network device A 106 and network device B 108 can be considered gateway network devices.

[0066] Additionally, since both network device A 106 and network device B 108 are configured to redundantly serve a LAG including connections from access network device 104 (e.g., via port A 110 and port C 128), network device A 106 and network device B 108 can be considered as jointly forming a gateway for the LAG. Therefore, network device A 106 and network device B 108 can be considered as aggregation network devices because they are aggregated together to provide certain functionalities for underlying devices (e.g., computing device 102, access network device 104) and, in particular, for one or more LAGs. Any suitable protocols, technologies, techniques, etc., can be used to allow the aggregation of network devices (e.g., network device A 106, network device B 108) without departing from the scope of the examples disclosed herein. Examples of such suitable protocols, technologies, techniques, etc., include, but are not limited to, EVPN, Virtual Switching Extensions (VSX), etc., and may include, for example, implementations of technologies that enable network devices to communicate with each other to perform various functions. As an example, network devices can communicate with each other to share information about one or more LAGs they are serving. As another example, network devices can communicate with each other to enable public network services across network devices. An example of such a service is NAT (Network Address Translation). Other services can be implemented across network devices without departing from the scope of the examples disclosed herein.

[0067] In one or more examples, network device A 106 and network device B 108 are configured to implement NAT services. As an example, network service A 114 of network device A 106 can be a NAT service, and network service B 130 of network device B 108 can also be a NAT service, wherein the NAT service is implemented for LAGs including links from access network device 104. The NAT service (e.g., 114, 130) can be a software service implemented on the network device and executed on one or more processors of the respective network device.

[0068] In one or more examples, a NAT service (e.g., 114, 116) can allow any number of underlying devices (e.g., computing device 102, access network device 104) in a private network to access an external network (e.g., network 138) using a pool (not shown) of public Internet Protocol (IP) addresses and port numbers.

[0069] Specifically, network devices (e.g., 106, 108) implementing NAT services (e.g., 114, 130) can maintain a NAT pool (not shown) containing IP addresses and port numbers. When a network flow (e.g., network traffic transmitted between two endpoint devices) is initiated (e.g., via receiving network data units destined for destination device 140 from an underlying client computing device), the NAT service (e.g., 114, 130) can perform a lookup in the NAT table (e.g., in the hardware table of data path component A 112 or data path component B 126) to determine whether a NAT IP address and port number (e.g., via NAT allocation) from the NAT pool has been assigned to the client computing device (e.g., computing device 102) of the network flow.

[0070] Because a network flow is being initiated (e.g., the first network data unit in the network flow), a NAT lookup may result in a NAT lookup miss. In the event of a NAT lookup miss, the NAT service can select a NAT IP address and port number from the NAT pool, assign that NAT IP address and port number to the IP address and port number corresponding to the client computing device and used for the network flow, and update its NAT table to reflect the assignment.

[0071] From that point onward, during network flows, network data units from a network flow originating from a client computing device (e.g., computing device 102) are updated (e.g., translated) to include the NAT IP address and port number, instead of the source IP address and port number of the client computing device. A similar process can occur in reverse for network data units of network flows destined for the client computing device (e.g., computing device 102). Therefore, NAT services (e.g., 114, 130) can be used to: translate the source IP address and port number to the NAT IP address and port number for outbound network traffic originating from the client computing device; and similarly, translate the NAT IP address and port number back to the source IP address and port number for inbound network traffic destined for the client computing device.

[0072] As an example, a computing device (e.g., computing device 102) seeking to communicate with another device (e.g., destination device 140) via the Internet (e.g., part of network 138) may send network data units (e.g., packets) to an access network device (e.g., access network device 104) to which the computing device is connected.

[0073] The network data unit may include (and other information items) the IP address of the device seeking to communicate with it (e.g., destination device 140) as the destination IP address, the IP address of the sending computing device (e.g., computing device 102) as the source IP address, and the source port number. The access network device 104 may (e.g., based on a load balancing strategy) transmit the network data unit to an aggregated network device (e.g., network device A 106 or network device B 108) connected to it via a set of links forming a LAG.

[0074] After receiving a network data unit from the underlying computing device 102 (e.g., via access network device 104), the aggregation network devices (e.g., 106, 108) implementing NAT services (e.g., 114, 130) can perform a NAT lookup to determine whether the NAT table (e.g., the NAT table of data path component A 112 or data path component B 126) contains an entry matching the source IP address. If such an entry exists, the source IP address and port number of the network data unit can be replaced with the NAT IP address and port number of the computing device 102 (e.g., the initial source IP address of the network data unit) assigned from a pool of NAT IP addresses and corresponding port numbers (e.g., NAT pool 116). The updated network data unit can then continue to be transmitted to its destination (e.g., destination device 140).

[0075] For incoming network traffic, a similar process can occur in reverse. As an example, when an aggregating network device (e.g., 106, 108) receives a network data unit, the destination IP address can be a NAT IP address assigned to the source IP address of a computing device (e.g., computing device 102). The NAT IP address is used to look up the computing device's IP address and port number, and the network data unit is updated to include that IP address and port number instead of the NAT IP address and port number as the destination IP address and port number. The aggregating network device (e.g., 106, 108) can then transmit the network data unit to an access network device 104, which can then forward the network data unit to the appropriate computing device (e.g., computing device 102) corresponding to the destination IP address and port number.

[0076] In a scenario where a group of aggregated network devices serve a specific LAG (such as...) Figure 1 In the example configuration shown, the NAT service can be implemented across a set of aggregated network devices serving the LAG, such as those provided by... Figure 1 Examples of network services (e.g., 114, 130) are shown in the diagram. Since any of the aggregation network devices (e.g., 106, 108) implementing the NAT service (e.g., 114, 130) can be transmitting to or receiving from a destination device (e.g., destination device 140) of the network flow, one of the aggregation network devices is elected as the owner of the network service (e.g., the NAT pool management owner of the NAT service). This election can be performed using any suitable election technique (e.g., minimum switch virtual interface (SVI) IP address).

[0077] exist Figure 1In the example system 100 configuration shown, network device A 106 has been selected as the owner network device (e.g., the NAT pool management owner). Therefore, network device A 106 includes a NAT pool (not shown). As discussed above, in one or more examples, the NAT pool is a pool of IP addresses and port numbers to be used when network data units are transmitted toward a destination (e.g., destination device 140) to an external network (e.g., network 138). In one or more examples, the NAT pool management owner (e.g., network device A 106) maintains the NAT pool, including selecting IP addresses and port numbers from the NAT pool when making NAT assignments, releasing IP addresses and port numbers when NAT assignments expire or are no longer needed in other ways, etc. As discussed above, such NAT assignments typically occur when a computing device initiates a network flow (e.g., sending the first network data unit in a communication flow using its IP address as the source IP address and a specific port number as the source port number). The NAT pool management owner (e.g., network device A 106) can make allocations and then pass the allocations to other aggregated network devices (e.g., network device B 108) serving the LAG.

[0078] Each aggregation network device (e.g., NAT pool management owner and non-owner devices) can update its corresponding NAT table, and then subsequent network data units in the network flow can use the NAT IP address and port number, regardless of which aggregation layer device receives the subsequent network data units of the network flow.

[0079] For a group of aggregated network devices that implement network services (e.g., NAT services) for LAG (e.g., 106, 108), any aggregated network device that is not selected as the owner of the relevant service, such as the NAT pool management owner (e.g., network device B 108), can be referred to as a non-owner network device. Therefore, as an example, a non-owner network device for NAT services (e.g., 114, 130) can be any aggregated network device that serves LAG and implements NAT services (e.g., via NAT service 130) and is not the selected NAT pool management owner.

[0080] In one or more examples, when a network data unit arrives at port C 128 of network device B 106 from computing device 102 via access network device 104, the network data unit can be passed to data path component B 126 of network device B 108. Within this hardware data path, a NAT lookup can be performed using the NAT table (not shown) of data path component B 126. When a NAT lookup miss occurs, a VTEP (e.g., VTEP B 132) can be used to encapsulate the network data unit to obtain the encapsulated network data unit.

[0081] In one or more examples, a VTEP (e.g., VTEP A 120, VTEP B 132) is a function performed on a network device that is configured to encapsulate network data units before they are transmitted to another device via a network tunnel connection (e.g., tunnel connection 124), which, as an example, could be a VXLAN tunnel. The VTEP can also be configured to decapsulate encapsulated network data units received via the tunnel connection (e.g., tunnel connection 124). Figure 1 In the example shown, a port of network device B (e.g., port E 134) is connected to a port of network device A (e.g., recirculation port 118). As used herein, a recirculation port (e.g., recirculation port 118) can be any port of a network device configured to receive encapsulated network data units via a tunnel connection (e.g., tunnel connection 124).

[0082] In one or more examples, the encapsulation of a network data unit that has experienced a NAT lookup miss on network device B 108 by VTEP B 132 includes adding a specific VNI as part of the information encapsulating the network data unit. The encapsulated network data unit is then transmitted from port E 134 of network device B 108 to recirculation port 118 of network device A 106.

[0083] Then, the VTEP A 120 of network device A 106 can decapsulate the encapsulated network data unit. Network device A 106 can also be configured to identify that the network data unit requires network services (e.g., NAT allocation). As an example, this identification can occur by determining the VNI included in the information encapsulating the network data unit.

[0084] In one or more examples, after such identification requiring NAT allocation is required, the network data unit can be provided to the data path component A 112 of network device A 106, for example, as if the network data unit had originally been received by network device A 106 from access network device 104.

[0085] As part of traversing data path component A 112, a NAT lookup can be performed using the NAT table of data path component A 112. In one or more examples, the NAT lookup results in a NAT lookup miss, which allows network device A 106 to invoke NAT service 114 to perform NAT assignment. NAT service 114 can then find free IP addresses and port numbers in NAT pool 116.

[0086] In one or more examples, once a NAT assignment is made by NAT service 114 of the NAT pool management owner (e.g., network device A 106), the NAT table of network device A is updated to reflect the NAT assignment. Network data units can then be updated based on the NAT assignment and transmitted to their destination (e.g., destination device 140).

[0087] In one or more examples, network device A 106 individually transmits the NAT assignment to network device B 108, and more specifically, to the NAT service 130 of network device B 106. In one or more examples, the NAT service 130 then updates the NAT table of the data path component B 126 of network device B 108. Thus, as an example, future network data units in the network flow between computing device 102 and destination device 140 can be processed by the data path component B 126 of network device B 106.

[0088] In one or more examples, the use of the above-described techniques to implement network services (e.g., NAT services) for LAG across two or more network devices can be improved because the initial network data unit of the network flow can be transmitted from the network service owner (e.g., the NAT pool management owner) after the network data unit is processed by the data path component of the non-owner network device, encapsulated by the VTEP of the non-owner network device, transmitted to the recirculation port of the network service owner (e.g., the NAT pool management owner), decapsulated, and processed by the network service owner (which may include, for example, performing some aspects of the network service (e.g., NAT assignment of the network data unit)). This interaction can, for example, reduce the latency caused by the software-to-software interaction between network service B 130 and network service A 114 before the network data unit can be transmitted to its destination, and can, for example, improve various metrics associated with the network service (e.g., further improve the CPS metric of the NAT service and make the CPS metric more consistent).

[0089] In one or more examples, although Figure 1 Computing device 102 is shown as being connected to network device A 106 and network device B 108 via access network device 104, but the examples of this disclosure are also applicable to scenarios in which the network configuration includes any number of access network devices configured as anycast gateways for computing devices.

[0090] As an example, in some scenarios, computing devices can move between access network devices. Therefore, any access network device can perform the function of a network data unit (NAT) for communicating network flows with a destination device on behalf of a specific computing device. In this scenario, access network devices can be similarly configured to implement NAT services, where one access network device is configured to act as the NAT pool manager owner. Thus, in one or more examples, a non-owner access device can use VTEP to encapsulate a NAT data unit in the event of a NAT lookup miss and pass the NAT data unit to the NAT pool manager owner, who can then decapsulate the NAT data unit, perform a NAT allocation, update the NAT data unit based on the allocation, transmit the updated NAT data unit to its destination, and pass the NAT allocation to other non-owner access network devices.

[0091] Additionally, although Figure 1 The examples shown are described in the context of network devices implementing NAT services, but other services implemented across two or more network devices can use techniques similar to those described above. As an example, network device A 106 can be the TCP session establishment owner, while network device B 108 can be a non-owner network device relative to the TCP session establishment process. In this scenario, network device B 108 can be configured to recognize any TCP handshake packets received at network device B 108, encapsulate such packets using VTEP B 132 (including a specific VNI designated to identify the TCP handshake packet), and transmit the encapsulated TCP handshake packet to network device A 106 via tunnel connection 124. Network device A, as the TCP session establishment owner, can recognize the encapsulated packet (e.g., via the VNI therein), decapsulate the packet, and provide it to data path component A 112 for processing. In one or more examples, once a TCP session is established, the TCP session establishment owner can share information about the TCP session with the non-owner network device. Using this technique, the TCP session establishment process can be improved because TCP handshake packets received at different network devices will not cause the TCP session establishment process to fail or require a retry.

[0092] Although Figure 1 A specific configuration for the component is shown, but other configurations can be used without departing from the scope of the examples described herein. For example, although Figure 1Certain components may be shown as part of the same device, but any of these components can be grouped into sets of one or more components, which can exist and function as part of any number of separate, operatively connected devices. As another example, a single component can be configured to perform... Figure 1 All or any part of the components shown perform all or any part of the functionality. Therefore, the examples in this disclosure should not be limited to... Figure 1 The configuration of the components shown.

[0093] Figure 2 A flowchart illustrating an example interaction between network devices implementing NAT services according to one or more examples of this disclosure is shown. The examples shown in the figures and discussed below are highly simplified and are intended for illustrative purposes only, and are not intended to limit the scope of the examples in this disclosure. Those skilled in the art who benefit from this disclosure will appreciate that the examples of this disclosure can include any number of network devices configured to implement NAT services (e.g., more than two); computing devices can communicate directly with NAT pool management owner or non-owner network devices rather than through access network devices; services other than NAT services (e.g., TCP session establishment services) can be implemented across network devices, but using similar techniques, and so on.

[0094] refer to Figure 2 Consider a scenario where computing device 200 seeks to initiate a network flow with destination device 210. In this scenario, computing device 200 is operatively connected to access network device 204. This access network device may be operatively connected to NAT pool management owner 206 (e.g., Figure 1 Network device A) and non-owner network device 208 (e.g., Figure 1 Each of the network devices B 108 in the network pool. The links from the access network device 204 to the NAT pool management owner 206 and to the non-owner network device 208 can be configured as LAG.

[0095] like Figure 2 As shown, in this scenario, computing device 200 can transmit the initial network data unit of a network flow to non-owner network device 208 based on the load balancing policy configured for LAG. In response to receiving the initial network data unit, the non-owner network device 208 can perform a NAT lookup using its NAT table. In this example, the NAT lookup result is a NAT lookup miss because no NAT assignment has yet been made for the network flow.

[0096] In response to a NAT miss, the VTEP of the non-owner network device 208 can be invoked to perform encapsulation of the network data unit. This encapsulation may include a specific VNI designed to notify the NAT pool management owner that the network data unit requires NAT allocation. The encapsulated network data unit can then be transmitted from the non-owner network device 208 to the recirculation port of the NAT pool management owner 206 via a network tunnel (e.g., a VXLAN tunnel).

[0097] In response to receiving an encapsulated network data unit, the NAT pool management owner 206 can evaluate the encapsulated network data unit and determine, at least in part, the need for NAT allocation based on the VNI. Therefore, the encapsulated network data unit can be decapsulated by the VTEP of the NAT pool management owner 206 and provided to the data path component of the NAT pool management owner 206. The data path component can then process the network data unit, including performing a NAT lookup, which results in a NAT lookup miss.

[0098] In response to a NAT lookup failure, the NAT service of NAT pool manager 206 can perform NAT assignment for network data units from the NAT pool maintained by NAT pool manager 206. In one or more examples, the NAT table of NAT pool manager 206 is then updated to reflect the NAT assignment, the network data unit is updated to include the NAT IP address and port number of the NAT assignment, and the updated network data unit is transmitted to destination device 210.

[0099] In one or more examples, the NAT allocation is then shared from the NAT pool management owner 206 to the non-owner network device 208 using any communication protocol (e.g., EVPN, VSX, etc.) configured for software-to-software communication between NAT service instances on the two network devices.

[0100] The non-owner network device 208 can then update its NAT table to reflect this NAT assignment. At a later time, the next network data unit of the same network flow is transmitted from the computing device 200 to the access network device 204. The access network device 204 then transmits the next network data unit to the non-owner network device 208 based on a configured load balancing policy.

[0101] Then, the non-owner network device 208 performs a NAT lookup using its NAT table. Since the NAT table has been updated with NAT assignments from the NAT pool management owner as discussed above, this NAT lookup results in a NAT lookup hit. Therefore, the non-owner network device updates the network data unit to include the NAT IP and port number from the NAT assignment and transmits the updated next network data unit to the destination device 210.

[0102] Figure 3 An overview of example method 300 for implementing network services (e.g., NAT service, TCP session establishment service, etc.) across multiple network devices is shown, according to one or more examples of this disclosure.

[0103] Method 300 can be at least partially derived from Figure 1 The system shown is executed by one or more devices and / or components. Therefore, all or any part of method 300 can be performed, for example, by one or more network devices (e.g., Figure 1 Network device A 106 Figure 1 The network device B 108) executes.

[0104] Although Figure 3 The steps in the flowchart shown are presented and described sequentially, but some or all of these steps may be performed in a different order, some or all of these steps may be combined or omitted, and some or all of these steps may be combined with... Figure 3 Other steps and / or Figure 3 The steps not shown are executed in parallel.

[0105] In step 302, method 300 includes receiving a first network data unit of a network flow at a non-owner network device within a group of network devices implementing a network service. For example, step 302 may include receiving a first network data unit of a network flow at a non-owner network device within a group of network devices implementing a Network Address Translation (NAT) service. In one or more examples, the non-owner network device is a network device configured to implement a network service but not selected as the owner of that network service. For example, the non-owner network device may be a network device included in a group of network devices configured to implement a NAT service but not selected as the owner of that NAT service (e.g., Figure 1 Network device B 108). In one or more examples, from computing devices (e.g., Figure 1 The computing device 102) receives the first network data unit. In some examples, this is done via an access network device (e.g., Figure 1 The access network device 104 receives the first network data unit from the computing device. In other examples, the first network data unit is received directly from the computing device at a non-owner network device (e.g., in a scenario where a group of access network devices are configured as anycast gateways for the underlying computing device).

[0106] In step 304, method 300 includes identifying an identification feature of a first network data unit by a non-owner network device, wherein the identification feature is associated with a network service. In one or more examples, the identification feature of the first network data unit is any feature that identifies the network data unit as requiring a network service. Such features may include, but are not limited to, addresses (e.g., IP addresses), other header information, etc. As an example, the identification feature can be identified by performing a first NAT lookup using the source address of the first network data unit. In one or more examples, the NAT lookup is performed using the NAT table of the non-owner network device. For example, the NAT table may be implemented as a hardware table as a set of data path components of the non-owner network device (e.g., ...). Figure 1 This is part of the data path component B 126 in the network. In one or more examples, the source address is the IP address of the computing device from which the first network data unit is received. The lookup may also include the source port number of the first network data unit. In one or more examples, the NAT lookup determines whether a NAT assignment has been performed on the source address previously (e.g., whether an entry exists corresponding to the source IP address and port number). Therefore, in this scenario, the source IP address that causes a NAT lookup to fail can be considered an identifying feature. As another example, an identifying feature could be one aspect of the first network data unit that identifies it as part of the TCP handshake process (e.g., a SYN flag set to 1 in the message, including an initial sequence number in the packet, etc.).

[0107] In step 306, method 300 includes transmitting a first network data unit to the network service management owner of the group of network devices based on the identification of identification features and using a network tunnel. As an example, step 306 may include transmitting the first network data unit to the NAT pool management owner of the group of network devices when a NAT lookup results in a NAT lookup miss. In one or more examples, the NAT pool management owner is a network device included in a group of network devices configured to implement NAT services but selected as the NAT pool management owner using any suitable selection technique (e.g., ...). Figure 1Network device B 108 in the example. In one or more examples, a NAT lookup miss occurs when the information (e.g., source IP address and port number) used to perform the lookup from the first network data unit is not found in the corresponding entry in the NAT table. In one or more examples, transmitting the first network data unit to the NAT pool management owner includes encapsulating the first network data unit to obtain an encapsulated first network data unit. In one or more examples, the encapsulation includes various informational items that allow the NAT pool management owner to identify the first network data unit as requiring NAT allocation. As an example, the encapsulated first network data unit may include a specific VNI, and the NAT pool management owner can be configured to recognize that VNI as indicating that the first network data unit requires NAT allocation. In one or more examples, the transmission of the encapsulated first network data unit is done using a non-owner network device with a recirculating port of the NAT pool management owner (e.g., ...). Figure 1 The encapsulation of the first network data unit is performed by a network tunnel (e.g., a VXLAN tunnel) between the recirculating ports 112. In one or more examples, the encapsulation of the first network data unit is performed by VTEP performed on the non-owner network device.

[0108] In step 308, method 300 includes identifying the first network data unit as corresponding to a network service by the network service management owner. As discussed above, the network service management owner may use any suitable technique for identification (such as, for example, evaluating the VNI included in the encapsulated header of the encapsulated first network data unit) to identify the first network data unit as corresponding to a network service.

[0109] In step 310, method 300 includes processing the first network data unit by a network service management owner to perform a network service. For example, performing the network service may include NAT assignment of the source address by a NAT pool management owner using the source address of the first network data unit. In one or more examples, the first network data unit, upon being received by the NAT pool management owner, is provided to the NAT pool management owner's data path component (e.g., ...). Figure 1 The data path component A 112) is processed. In one or more examples, this processing includes performing a NAT lookup in the NAT table of the NAT pool management owner using the source address (e.g., source IP address and port number), which results in a NAT lookup miss. In one or more examples, in response to the NAT lookup miss, the NAT service of the NAT pool management owner (e.g., Figure 1The NAT service 114 can use the NAT pool of the NAT pool management owner to perform NAT assignment. In one or more examples, the NAT assignment includes a NAT IP address and port number associated with the source IP address and port number. In one or more examples, the NAT pool management owner uses a network tunnel (e.g., Figure 1 The tunnel connection 124) receives the first network data unit as an encapsulated first network data unit. Therefore, in some examples, the encapsulated first network data unit can be provided by the NAT pool management owner's VTEP (e.g., ...) before being supplied to the data path component of the NAT pool management owner. Figure 1 Unpack the VTEP A 120.

[0110] Continuing with the example above, performing a network service (where the network service is a NAT service) may include updating the NAT pool management owner's NAT table using NAT assignments. In one or more examples, the NAT pool management owner's NAT table is a hardware table included in the NAT pool management owner's data path component. In one or more examples, updating the NAT pool management owner's NAT table includes adding or updating entries in the NAT table to include NAT assignments.

[0111] Performing a network service (where the network service is a NAT service) may also include updating the first network data unit based on the NAT assignment to obtain the updated first network data unit. In one or more examples, updating the first network data unit includes replacing the source IP address and port number of the first network data unit with the NAT IP address and port number identified in the NAT table based on the NAT assignment.

[0112] Performing a network service (where the network service is a NAT service) may also include transmitting an updated first network data unit to the destination. In one or more examples, the updated first network data unit is transmitted to the destination device based on the destination information included in the first network data unit (e.g., Figure 1 The destination device 140). In one or more examples, the appropriate interface of the NAT pool management owner is used (e.g., ...). Figure 1 The updated first network data unit is transmitted from port B 122 to the destination.

[0113] Performing a network service (where the network service is a NAT service) may include passing NAT assignments to non-owner network devices and other devices in that group of network devices. In one or more examples, NAT assignments are passed from the NAT pool management owner to the non-owner network devices using any suitable communication protocol, technology, and / or connection that allows two devices to share information with each other (e.g., EVPN, VSX, etc.). In one or more examples, NAT assignments are shared from the NAT pool management owner to any number of network devices implementing the NAT service. For example, NAT assignments may be shared from the NAT pool management owner to any number of non-owner network devices that, together with the NAT pool management owner, serve a specific LAG. As another example, NAT assignments may be shared from the NAT pool management owner to any number of non-owner network devices that, together with the NAT pool management owner, are configured to act as anycast gateways for the underlying computing devices.

[0114] In one or more examples, once a non-owner network device receives a NAT assignment, it can update its NAT table to include that assignment. Following such an update, subsequent network data units received at the non-owner network device from the same network flow as the first network data unit (e.g., a second network data unit from the same network flow) will result in a NAT lookup hit during the NAT lookup process, updated based on the NAT assignment, and transmitted to the destination.

[0115] Figure 4 A block diagram of a computing device 400 according to one or more examples of this disclosure is shown. The computing device 400 may be... Figure 1 Examples of all or any part of the components shown and described above (e.g., network device A 106, network device B 108), and / or examples of computing device 500 described below. In some examples, computing device 400 may be considered as a logical representation of a computing device that may be implemented, for example, across two or more physical devices (e.g., network device A 106, network device B 108). As shown above... Figure 1 , Figure 2 and Figure 3 As discussed in the description, computing device 400 can be used to implement Figure 1 All or any part of the various components shown and described above, and / or execution Figure 3 All or any part of the methods shown and described above in method 300.

[0116] Computing device 400 may include one or more processors 402 and memory 404. Memory 404 may include a non-transitory computer-readable medium storing programming for execution by one or more of the processors 402. In this implementation, one or more modules within computing device 400 may be partially or wholly (at least partially) embodied as software for performing any of the functions described in this disclosure. For example, computing device 400 may be configured to perform by executing instructions included in memory 404 and executed by one or more processors 402. Figure 3 The method 300 shown and described above.

[0117] For example, memory 404 may include a first network data unit for receiving network streams at a non-owner network device of a set of network devices implementing network services (e.g., as referenced above). Figure 3 Instruction 406 (described in step 302).

[0118] For example, memory 404 may include an identification feature for non-owner network devices to identify the first network data unit (where the identification feature is associated with a network service) (e.g., as referenced above). Figure 3 Instruction 408 (described in step 304).

[0119] For example, memory 404 may include a network service management owner (e.g., as referenced above) for transmitting the first network data unit to the group of network devices based on the identification of identification features and using a network tunnel. Figure 3 Instruction 410 (described in step 306).

[0120] For example, memory 404 may include a means for the network service management owner to identify the first network data unit as corresponding to a network service (e.g., as referenced above). Figure 3 Instruction 412 (described in step 308).

[0121] For example, memory 404 may include a first network data unit for processing by the network service management owner to perform network services (e.g., as referenced above). Figure 3 Instruction 414 (described in step 310).

[0122] Figure 5 A block diagram of a computing device 500 according to one or more examples of this disclosure is shown. As discussed above, the examples described herein can be implemented at least in part using a computing device (e.g., a network device), and Figure 5 The computing device 500 shown can be such a computing device. For example, Figure 1All or any part of the components shown (e.g., network device A 106, network device B 108) may be implemented at least in part using a computing device such as computing device 500, and may include Figure 5 All or any part of the components shown and described below in the computing device 500.

[0123] In one or more examples, a computing device (e.g., computing device 500) is any device, part of a device, or any group of devices capable of electronically processing instructions, and may include, but is not limited to, any of the following: one or more processors (e.g., components including circuitry) (e.g., processor 502), memory (e.g., random access memory (RAM)) (not shown), (multiple) input and output devices (e.g., non-persistent storage devices 506), non-volatile storage hardware (e.g., solid-state drives (SSDs), persistent memory (Pmem) devices, hard disk drives (HDDs) (not shown)), one or more physical interfaces (e.g., network ports, storage ports) (e.g., persistent storage devices 506), any number of other hardware components (not shown), and / or any combination thereof. As used herein, a processor can be any component capable of being configured to perform operations, processes, threads, etc. In some examples, a computing device (e.g., computing device 500) may contain any number of homogeneous or heterogeneous processors of any type.

[0124] The computing device 500 may include a communication interface 512 (e.g., a Bluetooth interface, an infrared interface, a network interface, a fiber optic interface, or any other type of communication interface), an input device 510, an output device 508, and many other components (not shown) and functions. Each of these components will be described below.

[0125] In one or more examples, the computer processor(s) 502 may be an integrated circuit for processing instructions. For example, the computer processor(s) may be one or more cores or microcores of a processor. Processor 502 may be a general-purpose processor configured to execute program code included in software executed on computing device 500. Processor 502 may be a special-purpose processor in which certain instructions are incorporated into the processor design. Processor 502 may be a central processing unit (CPU), a multi-core CPU, an application-specific integrated circuit (ASIC), a graphics processing unit (GPU), a data processing unit (DPU), a tensor processing unit (TPU), an associative processing unit (APU), a vision processing unit (VPU), a quantum processing unit (QPU), and / or various other processing units using special-purpose hardware (e.g., field-programmable gate array (FPGA), system-on-a-chip (SOC), digital signal processor (DSP)). Although in Figure 5Only one processor 502 is shown, but computing device 500 may include any number of processors without departing from the scope of the examples provided herein.

[0126] The computing device 500 may also include one or more input devices 510, such as a touchscreen, keyboard, mouse, microphone, touchpad, electronic pen, motion sensor, or any other type of input device. Input devices 510 allow users to interact with the computing device 500. In one or more examples, the computing device 500 may include one or more output devices 508, such as a screen (e.g., a liquid crystal display (LCD), plasma display, touchscreen, cathode ray tube (CRT) display, projector, or other display device), printer, external storage device, or any other output device. The one or more output devices may be the same as or different from the input devices(s). The input and output devices(s) may be locally or remotely connected to the computer processor(s) 502, non-persistent storage device(s) 504, and persistent storage device(s) 506. Many different types of computing devices exist, and the aforementioned input and output devices(s) may take other forms. In some instances, a multimodal system may allow users to provide multiple types of input / output to communicate with the computing device 500.

[0127] Furthermore, communication interface 512 can facilitate the connection of computing device 500 to a network (not shown) (e.g., a local area network (LAN), a wide area network (WAN), such as the Internet, a mobile network, or any other type of network) and / or another device (such as another computing device). Communication interface 512 can use wired and / or wireless transceivers of any type and / or technology to perform or facilitate the reception and / or transmission of wired or wireless communications. Examples include, but are not limited to, utilizing audio jacks / plugs, microphone jacks / plugs, Universal Serial Bus (USB) ports / plugs, etc. Ports / plugs, Ethernet ports / plugs, fiber optic ports / plugs, proprietary wired ports / plugs Wireless signal transmission, BLE wireless signal transmission Wireless signal transmission, RFID wireless signal transmission, Near Field Communication (NFC) wireless signal transmission, Dedicated Short Range Communication (DSRC) wireless signal transmission, 802.11 WiFi wireless signal transmission, WLAN signal transmission, Visible Light Communication (VLC), Global Microwave Access Interoperability (WiMAX), IR communication wireless signal transmission, Public Switched Telephone Network (PSTN) signal transmission, Integrated Services Digital Network (ISDN) signal transmission, 3G / 4G / 5G / LTE cellular data network wireless signal transmission, ad hoc network signal transmission, radio wave signal transmission, microwave signal transmission, infrared signal transmission, visible light signal transmission, ultraviolet light signal transmission, wireless signal transmission along the electromagnetic spectrum, or some combination thereof. Communication interface 512 may also include one or more Global Navigation Satellite System (GNSS) receivers or transceivers for determining the location of computing device 500 based on one or more signals received from one or more satellites associated with one or more GNSS systems. GNSS systems include, but are not limited to, the US-based GPS, the Russian-based GLONASS, the Chinese-based BeiDou Navigation Satellite System (BDS), and the European-based Galileo GNSS. There are no restrictions on operation for any particular hardware arrangement, and therefore the basic features described herein can be easily replaced with improved hardware or firmware arrangements as they are developed.

[0128] The term computer-readable medium includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other media capable of storing, containing, or carrying instructions and / or data. Computer-readable media can include non-transitory media in which data can be stored, and which do not include transient electronic signals propagated by carrier waves and / or wirelessly or via wired connections. Examples of non-transitory media may include, but are not limited to, magnetic disks or magnetic tapes, optical storage media (such as CDs or DVDs), flash memory, memory, or memory devices. Computer-readable media may have code and / or machine-executable instructions stored thereon, which may represent procedures, functions, subroutines, programs, routines, subroutines, modules, software packages, classes, or any combination of instructions, data structures, or program statements. A code segment can be coupled to another code segment or hardware circuitry by passing and / or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc., can be passed, forwarded, or transmitted via any suitable means, including memory sharing, message passing, token passing, network transmission, etc.

[0129] All or any part of the components of computing device 500 may be implemented in circuitry. For example, components may include electronic circuitry or other electronic hardware, and / or may be implemented using electronic circuitry or other electronic hardware, which may include one or more programmable electronic circuits (e.g., microprocessors, GPUs, DSPs, FPGAs, CPUs, CAMs, and / or other suitable electronic circuits), and / or may include computer software, firmware, or any combination thereof, and / or may be implemented using computer software, firmware, or any combination thereof to perform the various operations described herein. In some aspects, computer-readable storage devices, media, and memories may include cables or wireless signals containing bit streams, etc. However, when referred to, non-transitory computer-readable storage media explicitly exclude media such as energy, carrier signals, electromagnetic waves, and the signals themselves.

[0130] In the foregoing description, many details have been set forth as examples of what is described herein. Those skilled in the art (who also benefit from this disclosure) will understand that one or more examples described herein can be practiced without these specific details, and many variations or modifications can be made without departing from the scope of the examples described herein. Certain details known to those skilled in the art may be omitted to avoid obscuring the description.

[0131] Specific details are provided in the foregoing description to provide a thorough understanding of the aspects and examples provided herein. However, those skilled in the art will understand that these aspects and examples can be practiced without these specific details. For clarity of explanation, in some instances, the technology may be presented as including functional blocks that may include devices, device components, steps or routines in methods implemented in software or a combination of hardware and software. Additional components may be used in addition to those shown in the figures and / or described herein. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form so as not to obscure these aspects with unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring aspects of the examples of this disclosure.

[0132] The various aspects can be described above as a process or method, which can be depicted as a flowchart, diagram, data flow diagram, structure diagram, or block diagram. While a flowchart or diagram can describe operations as a sequential process, many operations can be executed in parallel or concurrently. Furthermore, the order of operations can be rearranged. A process may terminate when its operations are completed, but may have additional steps not included in the diagram. A process can correspond to a method, function, procedure, subroutine, subroutine, etc. When a process corresponds to a function, its termination can correspond to the function returning to the calling function or the main function.

[0133] The processes and methods described in the examples above can be implemented using computer-executable instructions stored in or otherwise obtainable from a computer-readable medium. Such instructions may include, for example, instructions and data that cause or otherwise configure a general-purpose computer, special-purpose computer, network device, or processing device (e.g., one or more processors) to perform a particular function or group of functions. Parts of the computer resources used may be accessible via a network. The computer-executable instructions may be, for example, binary files, intermediate format instructions such as assembly language, firmware, source code, etc. Examples of computer-readable media that may be used to store instructions, information used, and / or information created during the methods according to the described examples include disks or optical discs, flash memory, USB devices provided with non-volatile memory, networked storage devices, etc.

[0134] In the above descriptions of the figures, in the various examples described herein, any component described with respect to a figure may be equivalent to one or more components with the same or similar names and / or numbers described with respect to any other figure. For the sake of brevity, descriptions of these components may not be repeated with respect to each figure. Thus, each example of a component of each figure is incorporated by reference and is assumed to optionally exist within each other figure having one or more components with the same or similar names and / or numbers. Furthermore, based on the various examples described herein, any description of a component of a figure should be interpreted as an optional example that may be implemented as a supplement, combination, or substitution to examples of corresponding one or more components with the same or similar names and / or numbers in any other figure.

[0135] Throughout this application, ordinal numbers (e.g., first, second, third) may be used as adjectives for elements (i.e., any noun in this application). The use of ordinal numbers does not imply or create any particular ordering of elements, nor does it limit any element to a single element, unless explicitly disclosed, such as through the use of the terms “before,” “after,” “single,” and other such terms. Rather, the use of ordinal numbers is intended to distinguish between elements. By way of example, the first element is distinct from the second element, and the first element may contain multiple elements and is ordered after (or before) the second element.

[0136] As used herein, the phrase operatively connected, operatively connected, and its variations mean the existence of a direct or indirect connection between elements / components / devices that allows these elements to interact in a certain way. For example, an operatively connected device can refer to any direct wireless connection (e.g., a direct wired connection between two devices or components) or an indirect wireless connection (e.g., a wired and / or wireless connection between any number of devices or components that are operatively connected). Therefore, any path of information transmission can be considered an operatively connected device.

[0137] While the examples discussed herein have been described with respect to a limited number of examples, those skilled in the art will appreciate, upon receiving this disclosure, that other examples can be devised without departing from the scope of the examples disclosed herein. Therefore, the scope of the examples described herein should be limited only by the appended claims.

Claims

1. A system comprising: Network service management owners, including: Data path component; One or more processors; Network services, which are executed on the one or more processors; and The network service management owner is configured as follows: The first network data unit received via a network tunnel, wherein: The network service management owner is part of a group of network devices that implement the network service; The group of network devices also includes non-owner network devices; The first network data unit is received from the non-owner network device; The first network data unit includes identification features related to the network service; and The first network data unit is transmitted from the non-owner network device to the network service management owner, at least in part based on the identification features identified by the non-owner network device. The first network data unit is identified as corresponding to the network service; and The first network data unit is processed to perform the network service.

2. The system according to claim 1, wherein: The network service mentioned is NAT service. The network service management owner is the NAT pool management owner. The identification feature is the source address of the first network data unit used by the non-owner network device to perform a NAT lookup, resulting in a NAT lookup miss. In order to process the first network data unit to perform the network service, the NAT pool management owner is also configured to: The source address is assigned a NAT address via the NAT service and using the source address. The NAT allocation is used to update the NAT pool manager owner's NAT table; Using the data path component, the first network data unit is updated based on the NAT allocation to obtain the updated first network data unit; The updated first network data unit is transmitted to the destination via the data path component; as well as The NAT assignment is transmitted to the non-owner network device.

3. The system of claim 2, further comprising the non-owner network device, wherein the non-owner network device is configured to: After the updated first network data unit is transmitted to the destination by the NAT pool management owner, the non-owner network device NAT table of the non-owner network device is updated based on the NAT assignment.

4. The system of claim 3, wherein the non-owner network device is further configured to: After the non-owner network device receives the NAT allocation from the NAT pool management owner, it receives the second network data unit of the network flow; A second NAT lookup is performed using the source address of the second network data unit, wherein the second NAT lookup results in a NAT lookup hit; The second network data unit is updated based on the NAT allocation to obtain the updated second network data unit; as well as The updated second network data unit is transmitted to the destination.

5. The system of claim 2, wherein the NAT allocation includes a NAT pool Internet Protocol IP address and a port number.

6. The system according to claim 2, wherein: The first network data unit is received by the NAT pool management owner using the network tunnel; The non-owner network device is configured as follows: Before the first network data unit is transmitted, the non-owner network device encapsulates the first network data unit to obtain an encapsulated first network data unit; and The NAT pool management owner is also configured as follows: The first network data unit is decapsulated after encapsulation to obtain the first network data unit.

7. The system according to claim 1, wherein the set of network devices comprises: Multiple aggregation network devices, each serving a specific link aggregation group, or Multiple access network devices are configured to jointly serve as anycast gateways.

8. The system according to claim 1, wherein: The network service mentioned is the Transmission Control Protocol (TCP) session establishment service. The network service management owner is the TCP session establishment owner. The identification feature identifies that the first network data unit is part of the TCP handshake process, and In order to process the first network data unit to perform the network service, the TCP session establishment owner is also configured to: The data path component is used to process the first network data unit to transmit the first network data unit to the destination identified in the first network data unit. as well as Managing the establishment of a TCP session, at least in part using the first network data unit to perform the TCP handshake process for the establishment; and After the establishment, information corresponding to the TCP session is provided to the non-owner network device.

9. A computer-implemented method, comprising: The first network data unit that receives the network flow at a non-owner network device of a group of network devices that implement network services; The non-owner network device identifies the identification features of the first network data unit, wherein the identification features are related to the network service; Based on the identification of the identification features, the first network data unit is transmitted to the network service management owner of the group of network devices using a network tunnel; The network service management owner identifies the first network data unit as corresponding to the network service; as well as The network service management owner processes the first network data unit to perform the network service.

10. The computer-implemented method according to claim 9, wherein: The network service mentioned is NAT service. The network service management owner is the NAT pool management owner. The identification feature is the source address of the first network data unit used by the non-owner network device to perform a NAT lookup, resulting in a NAT lookup miss. Processing the first network data unit to perform the network service includes: The NAT pool manager uses the source address to assign a NAT to the source address; The NAT allocation is used to update the NAT pool manager owner's NAT table; The first network data unit is updated based on the NAT allocation to obtain the updated first network data unit; Transmit the updated first network data unit to the destination; and The NAT assignment is transmitted to the non-owner network device and other devices in the group of network devices.

11. The computer-implemented method according to claim 10, further comprising: After the updated first network data unit is transmitted to the destination by the NAT pool management owner, the non-owner network device updates its non-owner network device NAT table based on the NAT assignment.

12. The computer-implemented method according to claim 11, further comprising: After the non-owner network device receives the NAT assignment from the NAT pool management owner, the second network data unit of the network flow is received at the non-owner network device. A second NAT lookup is performed using the source address of the second network data unit, wherein the second NAT lookup results in a NAT lookup hit; The second network data unit is updated based on the NAT allocation to obtain the updated second network data unit; as well as The updated second network data unit is transmitted to the destination.

13. The computer-implemented method of claim 10, wherein the NAT allocation includes a NAT pool Internet Protocol (IP) address and a port number.

14. The computer-implemented method according to claim 10, wherein: The first network data unit is transmitted to the NAT pool management owner using the network tunnel, and The computer-implemented method further includes: Before the first network data unit is transmitted, the non-owner network device encapsulates the first network data unit to obtain an encapsulated first network data unit; and The NAT pool manager decapsulates the encapsulated first network data unit to obtain the first network data unit.

15. The computer-implemented method according to claim 9, wherein: The group of network devices includes multiple aggregation network devices, each aggregation network device serving a specific link aggregation group, or The group of network devices includes multiple access network devices, which are configured to work together as anycast gateways.

16. The computer-implemented method according to claim 9, wherein: The network service mentioned is the Transmission Control Protocol (TCP) session establishment service. The network service management owner is the TCP session establishment owner. The identification feature identifies that the first network data unit is part of the TCP handshake process, and Processing the first network data unit to perform the network service includes: The TCP session owner processes the first network data unit to transmit it to the destination identified in the first network data unit; and The establishment of a TCP session is managed by the TCP session establishment owner, who performs the TCP handshake process for the establishment at least in part using the first network data unit; and After the establishment, the TCP session owner provides the non-owner network device with information corresponding to the TCP session.

17. A non-transitory computer-readable medium storing programming for execution by one or more processors, the programming including instructions for: The first network data unit that receives the network flow at a non-owner network device of a group of network devices that implement network services; The non-owner network device identifies the identification features of the first network data unit, wherein the identification features are related to the network service; Based on the identification of the identification features, the first network data unit is transmitted to the network service management owner of the group of network devices using a network tunnel; The network service management owner identifies the first network data unit as corresponding to the network service; as well as The network service management owner processes the first network data unit to perform the network service.

18. The non-transitory computer-readable medium according to claim 17, wherein: The network service mentioned is NAT service. The network service management owner is the NAT pool management owner. The identification feature is the source address of the first network data unit used by the non-owner network device to perform a NAT lookup, resulting in a NAT lookup miss. In order to process the first network data unit to perform the network service, the programming includes further instructions for: The NAT pool manager uses the source address to assign a NAT to the source address; Update the NAT pool management owner's NAT table using the NAT allocation; The first network data unit is updated based on the NAT allocation to obtain the updated first network data unit; Transmit the updated first network data unit to the destination; as well as The NAT assignment is transmitted to the non-owner network device and other devices in the group of network devices.

19. The non-transitory computer-readable medium of claim 18, wherein the programming includes further instructions for: After the updated first network data unit is transmitted from the NAT pool management owner to the destination, the non-owner network device updates the non-owner network device NAT table based on the NAT allocation. After the non-owner network device receives the NAT assignment from the NAT pool management owner, the second network data unit of the network flow is received at the non-owner network device. A second NAT lookup is performed using the source address of the second network data unit, wherein the second NAT lookup results in a NAT lookup hit; The second network data unit is updated based on the NAT allocation to obtain the updated second network data unit; as well as The updated second network data unit is transmitted to the destination.

20. The non-transitory computer-readable medium according to claim 17, wherein: The network service mentioned is the Transmission Control Protocol (TCP) session establishment service. The network service management owner is the TCP session establishment owner. The identification feature identifies that the first network data unit is part of the TCP handshake process, and In order to process the first network data unit to perform the network service, the programming further includes further instructions for: The TCP session owner processes the first network data unit to transmit the first network data unit to the destination identified in the first network data unit. as well as The establishment of the TCP session is managed by the TCP session establishment owner, and the TCP handshake process is performed for the establishment using at least part of the first network data unit; as well as After the establishment, the TCP session owner provides the non-owner network device with information corresponding to the TCP session.

Images