Client-Hello Routing for Multipath VPN and ZTNA Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VPN and ZTNA technologies face challenges in managing dynamic routing and load balancing in multipath and multi-tunnel secure access systems, particularly when using Anycast networking, due to the difficulty in maintaining unique DNS entries and managing multiple data plane sessions across different datacenters.
Innovation Solution
The use of client-hello techniques for intelligent routing and layer 3 firewalling, where communication session identifiers are generated and assigned a priori to target specific routing devices, allowing for efficient load balancing and rapid setup of encrypted data plane sessions using a Resumed Handshake.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Anycast networking is used with multiple datacenters hosting ZTNA/VPN termination points sharing common IP address space, then service availability and load distribution are improved, but routing management complexity and DNS entry maintenance become intractable
Solution Approach 1:
The system performs preliminary actions by establishing control plane sessions and pre-assigning communication session identifiers to specific routing devices before data plane traffic arrives. This pre-establishment of routing mappings eliminates the need for complex real-time DNS management and routing decisions, allowing Anycast networking to function effectively without intractable management complexity
Solution Approach 2:
The communication session identifier acts as an intermediary between the shared Anycast IP address and the specific routing devices. Instead of directly managing complex routing tables and DNS entries for multiple datacenters, the system uses these identifiers as mediators to steer traffic to appropriate termination points, simplifying the routing management while maintaining service availability
2Productivity
If multiple data plane sessions are established across different datacenters for multipathing, then network resilience and load balancing are improved, but session management and target identification become difficult
Solution Approach 1:
The system segments the session management by separating control plane and data plane protocols, and further segmenting data plane sessions through unique communication session identifiers. Each identifier encapsulates target routing device information, allowing independent management of multiple data plane sessions across different datacenters without requiring complex coordinated management
Solution Approach 2:
The control plane session performs preliminary actions by pre-establishing the mapping between communication session identifiers and target routing devices. This pre-configuration enables data plane sessions to be rapidly established across multiple datacenters with simplified management, as the target identification is already determined before data plane traffic arrives
3Adaptability or versatility
If dynamic routing based on domain naming and SNI is implemented, then intelligent load balancing is achieved, but DNS entry maintenance and system management become difficult
Solution Approach 1:
The system replaces the mechanical DNS lookup and SNI-based routing mechanism with a more efficient approach using communication session identifiers embedded in the data plane protocol. Instead of relying on domain naming conventions and SNI headers that require extensive DNS entry maintenance, the system substitutes this with direct identifier-based routing that achieves intelligent load balancing without the operational burden of managing numerous DNS entries
4Reliability
If control plane and data plane use independent protocols (e.g., IPsec with IKE and ESP), then security and protocol independence are improved, but session mapping and routing become complex
Solution Approach 1:
The system extracts the routing identification information from the control plane protocol exchange and embeds it directly into the data plane protocol as communication session identifiers. This extraction eliminates the need for complex session mapping between independent control and data plane protocols, as the target routing device information is self-contained within the data plane packets themselves
Data Source
AI summary
Techniques for utilizing a portion of a communication session identifier (e.g., a Session-ID, an SPI, a CID, a DCID, and/or the like) to indicate a target routing device (e.g., a VPN and/or ZTNA termination device) for establishing control plane session(s) and/or data plane session(s) at wire-speed in a networked computing environment. The routing device(s) of a networked computing environment may generate a communication session identifier and send the communication session identifier to the client device, such that subsequent packets send from the client device may be forwarded to the proper routing device indicated by the communication session identifier for establishment of one or more data plane sessions. Additionally, data plane sessions may be established using a Resumed Handshake rather than a full handshake that is typically required, as Session Resumption utilizes the assigned communication session identifier for mapping.