Adaptive Traffic Offloading for Next-Hop Route Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network traffic offloading in hyperscaler environments leads to inefficiencies due to routing changes in long-lived flows, resulting in packets being transmitted over inefficient paths or to black holes, which is costly and disruptive.
Innovation Solution
A system where a firewall maintains data for offloaded flows and communicates next-hop changes to an offload device, updating its flow table to adapt to routing changes, ensuring efficient traffic routing without disruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network traffic is offloaded to an offload device, then security inspection costs are reduced and throughput is improved, but routing changes cause packets to be transmitted over inefficient paths or to black holes
Solution Approach 1:
The system implements a feedback mechanism where the offload device monitors routing changes and sends notifications to the firewall. The firewall then updates the flow table with new next-hop information and sends confirmation back to the offload device. This closed-loop feedback ensures routing accuracy is maintained while traffic remains offloaded, resolving the contradiction between throughput improvement and routing reliability.
Solution Approach 2:
The offload device autonomously monitors its own flow table for routing changes and initiates updates without requiring manual intervention. The system self-services by automatically detecting when routing information becomes stale and triggering the appropriate update sequence, maintaining routing accuracy while preserving the performance benefits of offloading.
2Reliability
If firewalls inspect all network traffic, then security is maximized, but cost and overhead increase significantly
Solution Approach 1:
The system segments traffic handling into two paths: traffic requiring security inspection remains processed by the firewall, while traffic that does not require inspection is offloaded to the offload device. This segmentation allows the firewall to focus only on necessary security inspections, reducing overhead and complexity while maintaining security for traffic that requires it.
Solution Approach 2:
The system extracts traffic that does not require security inspection from the firewall's processing load and redirects it to the offload device. This extraction removes unnecessary overhead from the firewall while preserving security inspection capabilities for traffic that actually needs them, reducing device complexity without compromising security.
3Reliability
If flow tables are updated frequently to adapt to routing changes, then routing accuracy is maintained, but system complexity and update overhead increase
Solution Approach 1:
Instead of continuous monitoring and updating, the system uses periodic action where the offload device checks for routing changes at intervals and only updates the flow table when necessary. This periodic approach maintains routing accuracy while reducing the complexity and overhead associated with constant flow table management.
Data Source
AI summary
A host with a firewall and an offload device can be configured/programmed to balance security and cost. Services are instantiated on the firewall and on the offload device. The service on the firewall maintains data for offloaded flows that indicate the next-hops for the offloaded flows when offloaded. The service on the offload device periodically copies samples from offloaded flows and communicates the samples to the service on the firewall. The service on the firewall determines a next-hop for the copied samples according to the firewall's routing information. If the determined next-hop has changed from what is indicated in the offloaded flows data, then the service on the firewall updates the offloaded flows data and communicates the next-hop change to the service on the offload device which causes an update to the flow table on the offload device for relevant offloaded flows.