52 results about "Private IP" patented technology

A multi-cloud overlay network for supporting communications between a first public cloud network and a second public cloud network. The overlay network features a management virtual private network, which includes a network load balancing (NLB) component and a controller registered as a target on a port of the NLB component. The overlay network further includes one or more spoke or transit gateways and a multi-cloud access virtual private cloud (VPC) operating within the first public cloud network, and a remote cloud load balancer component operating the second public cloud network. The remote cloud load balancer component is communicatively coupled between the multi-cloud access VPC and one or more remote spoke or transit gateways. The multi-cloud access VPC includes a VPC endpoint that is assigned a private IP address and communicatively coupled to the NLB component and a virtual private network (VPN) gateway communicatively coupled to a private transport.

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a network fabric of a tenant, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port / protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a DNS entry that resolves the application name to its virtual IP address and destination NAT rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

Techniques for providing, to a resource on a private network of a service provider, access to a resource on a private network of a customer. Service to customer (S2C) resources deployed on a cloud infrastructure to facilitate the access. Whereas IP address ranges may overlap between private networks and / or private IP addresses may be used in one or more of the private networks, the S2C resources enable the data exchange between the private networks. For example, the S2C resources translate between IP addresses such that data within each private network uses IP addresses that can be properly processed by the private network.

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a tenant's network fabric, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port / protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a domain name system entry that resolves the application name to its virtual Internet Protocol (IP) address and destination network address translation rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

A method for configuring a network address translation NAT gateway based on a public cloud service including: a cloud management platform obtains NAT gateway creation information that is input by a tenant; The cloud management platform creates the NAT gateway in the first VPC based on the NAT gateway creation information; The cloud management platform obtains configuration information that is input by the tenant and applied to the NAT gateway; The cloud management platform sets, based on the identifier of the second VPC, the NAT gateway to be connected to the second VPC, and sends the first NAT rule to the NAT gateway, where the first NAT rule is used to indicate the NAT gateway to: bind a first network segment in the first VPC to a first elastic IP address EIP; and bind the first network segment in the first VPC to a first transit private IP address.

In one embodiment, a system includes a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation; and a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein the public-cloud VM is configured to receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, translate, using a NAT mapping, a source address of each first packet from a private IP address of the private-cloud VM to an IP address of the public-cloud VM, and send the first packet to the IP address of the public-cloud VM.

This invention provides a method and system for configuring the management IP address of virtual security protection products, belonging to the field of virtualization protection technology. The method for configuring the management IP address of virtual security protection products includes the following steps: constructing a local area network (LAN) between a controller and multiple virtual security protection products; assigning a private IP address to each virtual security protection product; the controller establishing a connection with each virtual security protection product through the private IP address and issuing a management IP address configuration for each virtual security protection product; and the virtual security protection product configuring its management IP address according to the management IP address configuration. This method and system solve the problem of cumbersome and inefficient manual configuration of virtual security protection product management IP addresses in existing technologies that require entering a cloud environment.

A configuration of a cloud application exposed via a public IP address is duplicated with modifications to include a private IP address to expose the application internally. The original configuration is updated so that external network traffic sent to the application is redirected to and distributed across agents running on nodes of a cloud cluster by which web application firewalls (WAFs) are implemented. A set of agents for which the respective WAFs should inspect the redirected network traffic are selected based on cluster metrics, such as network and resource utilization metrics. The redirected network traffic targets a port allocated to the agents that is unique to the application, where ports are allocated on a per-application basis so each of the agents can support WAF protection for multiple applications. Network traffic which a WAF allows to pass is directed from the agent to the application via its private IP address.

The present technology provides solutions for maintaining communications within a software-defined wide area network (SDWAN) when one or more devices in the SDWAN are isolated from one or more controllers. An example method includes receiving, at a static edge device associated with a static wide area network (WAN) Internet Protocol (IP) address in a data plane of the SDWAN, data from a first device communicating through an edge device of a first Internet service provider (ISP) of the SDWAN, where the first device is associated with a private IP address, associating, by the static edge device, the first device with the private IP address, and communicating, by the static edge device, with the first device at the private IP address. Systems and computer-readable media are also provided.

The invention discloses a freeswitch cluster capacity expansion system and device based on NAT (Network Address Translation) equipment, and relates to the technical field of cluster capacity expansion. The system comprises a virtual private cloud, an NAT (Network Address Translation) device, a freeswitch cluster and a port mapping configuration module, wherein the virtual private cloud is used for carrying out network planning and security configuration on the virtual private cloud according to actual requirements; the NAT equipment is deployed at a boundary position of the virtual private cloud and an external network, and a voice communication request sent by the external network to a specific public network IP and a port is converted into a private IP and a corresponding port of an internal freeswitch cluster node by configuring a DNAT rule of the NAT equipment; the freeswitch cluster consists of a plurality of freeswitch nodes, is uniformly distributed in a second subnet in the virtual private cloud, and is used for realizing call request processing of cluster load balance based on internal communication; and the port mapping configuration module is used for carrying out corresponding port mapping setting on the NAT equipment according to a service port provided by the freeswitch cluster node.

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a tenant's network fabric, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port / protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a domain name system entry that resolves the application name to its virtual Internet Protocol (IP) address and destination network address translation rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

The embodiment of the invention relates to the technical field of DECT, and discloses a mobile terminal roaming communication method and system and a mobile terminal. The method comprises the following steps: starting a wireless local area network mode so as to send a first mode switching notification to a main base station through a wireless local area network; adjacent station information sent by the main base station through the wireless local area network is received; determining a roaming base station according to the adjacent station information so as to initiate and successfully complete a registration request to the roaming base station; when the terminal initiates or responds to a DECT voice call through the roaming base station, a cross-base-station voice communication link is established through private IP network connection established based on an IP address between the roaming base station and the main base station; wherein the mobile terminal, the main base station and the roaming base station are located in the coverage range of the same local area network. The roaming of the mobile equipment between the base stations can be realized at least under the condition that time synchronization between the DECT base stations is not needed and additional equipment is not needed.

The invention discloses an Internet of Things private network flow processing method and related equipment. The method comprises the following steps: acquiring session flow between a base station and a terminal and flow direction of the session flow; determining the flow type of the session flow based on the flow direction; when the flow type of the session flow is uplink three-layer session flow, converting a target IP of the session flow into a local private IP, executing downlink packet receiving processing on a flow message, and sending the flow message to the terminal; and when the flow type of the session flow is the downlink three-layer session flow, replacing the local private IP with the target IP of the session flow, and sending the flow data to the terminal. The method can be widely applied to the technical field of network resource scheduling.

Described herein are systems, methods, and software to manage internet protocol (IP) address allocation for tenants in a computing environment. In one implementation, a logical router associated with a tenant in the computing environment requests a public IP address for a new segment instance from a controller. In response to the request, the controller may select a public IP address from a pool of available IP addresses and update networking address translation (NAT) on the logical router to associate the public IP address with a private IP address allocated to the new segment instance.

Systems and methods for a dual-functional modular system for providing Internet Protocol (IP) phones with wireless broadband capabilities and a handoff from public cellular networks to a private business system. The method may include providing a plurality of IP phones with one or more modular Long-Term Evolution (LTE) upgrade units, wherein the plurality of IP phones gain LTE endpoint features; configuring the one or more units to connect to a private IP network; continuously monitoring signal strength of a public LTE network and the private IP network; detecting a mobile device with an active call; when the private IP network provides a more stable connection, initiating a handoff from the public LTE network to the IP network; transferring the active call data to an available LTE-equipped IP phone; monitoring the IP network; and when the IP network becomes unstable, reverting service of the active call to the public LTE network.

Route tables may be associated with ingress traffic for logically isolated networks. A routing device at the edge of a logically isolated network may receive a route to include in a route table that is associated with ingress traffic to the logically isolated network, where the ingress traffic is destined for a block of public or private IP addresses. The route instructs the edge routing device to forward such ingress traffic to a network interface of a network appliance hosted in the logically isolated network. Network packets received at the edge routing device may have a destination of one or more public or private IP addresses in the block of public / private IP addresses. The edge routing device may identify the route in the route table that forwards the ingress network traffic destined for the block of public or private IP addresses to the network interface for the network appliance.

A system may receive, at a firewall, a data packet destined to a conflicting private IP address of the first private subnetwork and the second private subnetwork within the private network, the data packet including a destination IP address identifying the firewall. The system may evaluate, at the firewall, the data packet to determine whether a source IP address of the data packet satisfies a routing condition corresponding to a routing rule. The system may apply, at the firewall, the routing rule to determine a translated destination IP address of the first private subnetwork. The system may send the data packet to the first private subnetwork.

A computer-implemented method performed at a processing server includes receiving, from a client device, a request to connect to an application server. The method further includes identifying a targeted application server from a set of application servers. The method further includes mapping a private internet protocol (IP) address for the targeted application server to a virtual IP (VIP) address associated with one or more demultiplexers. The method further includes generating a token based on a current secret key, wherein the token includes an indication of whether the token was generated using a static secret key or a particular dynamic secret key. The method further includes transmitting the VIP address, the private IP address, and the token to the client device.

A VPN service assigns a first private IP address for a VPN concentrator and a second private IP address for a user device. Packets originating from the user device are modified by translating the second private IP address to a unique private IP address managed by the VPN concentrator, and translating the unique private IP address to a public IP address of the VPN concentrator. VPN session data, including the unique private IP address and an identifier associated with the user device, is registered in a peer hashtable. Inbound packets received from an external network are modified by translating the public IP address to the unique private IP address using the stored VPN session data, and then translating the unique private IP address to the second private IP address associated with the user device. The modified inbound packets are sent to the user device.

Apparatus and methods are disclosed for geographic region-based network address translation (NAT) between a public network and a private network. In certain examples, region-based NAT may assist to reduce latency, enhance quality, enhance security, and / or improve efficiency of network communications. In response to a data packet from a first port of a private IP address, of an endpoint in the private network, a region of the private network that includes an endpoint identified by the private IP address is determined. A public IP address is selected that is mapped to the determined region in the database. An available port of the selected public IP address is assigned for NAT. NAT is performed for data communicated between the public and private networks using a mapping of the first port of the first IP address to the second port of the second IP address.

Various techniques for centralized IP address management and secure access control in SASE are disclosed. In some embodiments, a system, a process, and / or a computer program product for centralized IP address management and secure access control in SASE includes receiving, at a gateway, a request for a secure tunnel connection for a mobile user endpoint to communicate with a secure access service edge (SASE) cloud environment; assigning a private IP address from a consistent IP address pool for the secure tunnel connection to the mobile user endpoint; and monitoring a plurality of active user sessions across the SASE cloud environment for a global view of private IP address assignments.

The application relates to the technical field of data transmission, and particularly provides a data packet transmission method, device, medium, equipment and product. The method can comprise the following steps: receiving a data packet conforming to an access control policy; wherein the access control policy represents a data packet type allowed to be sent by a network security engine; determining an application protocol type in a reverse proxy policy associated with the access control policy; wherein the reverse proxy policy comprises a private IP number, a private port number, a network protocol type and the application protocol type; the application protocol type comprises a general protocol, a multicast protocol or an audio / video protocol; calling a protocol interface function corresponding to the application protocol type to detect the data packet, and obtaining a detection result; wherein the detection result represents whether to block the data packet from continuing transmission. The application embodiment can improve the reverse proxy performance and realize effective transmission of various protocol data.

Methods and apparatus that allow clients to connect resource instances to virtual networks in provider network environments via private IP. Via private IP linking methods and apparatus, a client of a provider network can establish private IP communications between the client's resource instances on the provider network and the client's resource instances provisioned in the client's virtual network via links from the private IP address space of the virtual network to the private IP address space of the provider network. The provider network client resource instances remain part of the client's provider network implementation and may thus also communicate with other resource instances on the provider network and / or with entities on external networks via public IP while communicating with the virtual network resource instances via private IP.

A method includes creating a virtual adapter at an endpoint that is configured for split tunneling of data traffic via a virtual private network (VPN) connection with an internet protocol version 6 (IPv6) only internal network. The method includes assigning only an IPv6 address to the virtual adapter, such that it does not have an internet protocol version 4 (IPv4) address or an automatic private IP address (APIPA) IPv4 address. The method includes blocking domain name server (DNS) traffic when a source internet protocol (IP) address of the DNS traffic being a physical adapter IP address of a physical adapter. The method includes accessing excluded resources configured for IPv4 and IPv6 split tunneling policies via the physical adapter, forcing access to excluded IPv4 only resources via the physical adapter in DNS64 / NAT64 environments, and forcing applications that prefer IPv4 over IPv6 to use IPv6 while accessing dual stack resources.

The invention discloses a cloud service access method, a communication device and a system, relates to the technical field of optical communication, and is used for reducing the complexity of a home network and the operation and maintenance cost of an operator. According to the invention, no additional function needs to be added on the ONT, the two-layer bridging channel is created between the terminal equipment and the cloud service gateway through the virtual IP address of the cloud service, the terminal can use the virtual IP address allocated for the cloud service and the two-layer bridging channel, the cloud service can be accessed through the ONT, the deployment of a home network is simplified, and the operation and maintenance cost is reduced. The IP addresses of the cloud services seen by all families can be the same private IP address, and the real IP address of the cloud server is not exposed to the outside (namely terminal equipment), so that the security of the cloud services is improved, and the massive ONT configuration and the operation and maintenance cost of an operator are simplified. And the IP addresses of the cloud services seen by the vCPE corresponding to different home gateways can be the same IP address, so that the deployment of the private cloud of an operator can be simplified.

A system for providing dual network address translation, comprising a Network Operations Center (NOC) which has a memory component, wherein the memory component stores logic which, when executed by a processor, causes the system to perform at least the following: Receiving data from a user workstation over a wide area network, wherein the data is received via a first Virtual Private Network (VPN) tunnel, wherein the data is encrypted using VPN encryption, and wherein the data is assigned a Unique Private Internet Protocol (UPIP) address that overlaps with a customer-defined private IP address and includes a security barrier; Removing VPN encryption from the data; Using a Twin-NAT-Network Address Translation (NAT) component to remove the UPIP address and replace it with the customer-defined private IP address from a private network at a destination; Packaging the data with the customer-defined private IP address in a privately defined protocol that includes the public source address and the public destination address; and Using a second VPN tunnel to transmit the data to the destination.

The application discloses a cloud host network migration scheme based on DPU, and comprises the following steps: S1, basic network configuration; S2, out direction traffic identification and forwarding flow table configuration; and S3, in direction traffic identification and forwarding configuration. The scheme does not need additional planning calculation of private IP addresses, does not involve SNAT, and does not additionally design vpc and overlay, so that network migration channels are realized by utilizing PF and reusing original calculation internal network addresses, and the bandwidth of the migration network is ensured.

A method for obtaining information includes: receiving, by a first communication device, a first request, where the first request is used for requesting to obtain first information; and the first information comprises at least one of the following: a second internet protocol (IP) address corresponding to a first IP address; a mapping relationship between the first IP address and the second IP address; the second IP address; or a second port number, where the second port number is associated with the second IP address; and the first IP address is a private IP address, and the second IP address is a public IP address.

The disclosure provides a method for managing an internet protocol (IP) address of a user equipment (UE) 502 in a network 106. A first network element such as a control plane 506 assigns a first dynamic private IP address to the UE 502 upon session creation and creates session mapping between the first dynamic private IP and a static public IP address and a port address in a second network element, such as a Public Internet Protocol (IP) Gateway (PIG) 510. The session mapping is updated in real-time based on session events. The second network element routes uplink and downlink traffic according to the maintained mapping. Upon session termination, the mapping is deleted to release IP resources. This approach enables efficient reuse of static public IPs across multiple users, reduces signaling overhead, and improves IP address utilization without compromising session continuity or service quality.

Techniques for providing, to a resource on a private network of a service provider, access to a resource on a private network of a customer. Service to customer (S2C) resources deployed on a cloud infrastructure to facilitate the access. Whereas IP address ranges may overlap between private networks and / or private IP addresses may be used in one or more of the private networks, the S2C resources enable the data exchange between the private networks. For example, the S2C resources translate between IP addresses such that data within each private network uses IP addresses that can be properly processed by the private network.