Distributed Source NAT for Cloud VM Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud service access methods using private IP addresses are inefficient due to the need for network address translation (NAT) gateways, which create bottlenecks, especially in intensive network input/output operations, and require multiple floating IP addresses or NAT gateways, leading to high costs and performance issues.
Innovation Solution
Implementing source network address translation (SNAT) with a centralized controller to manage a pool of unique private IP address and port number pairs across multiple tenant logical networks, allowing packets to bypass NAT gateways and directly access cloud services without going through a NAT gateway, even when VMs are on different hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If one floating IP address is assigned to each virtual machine (1:1 NAT), then a client VM can directly access cloud services, but it is expensive because it requires one floating IP address per VM
Solution Approach 1:
Multiple tenant VMs from different logical networks are merged into a single broadcast domain using a common NAT network. They share a pool of private IP addresses instead of each requiring a floating IP address. This consolidation reduces the quantity of floating IP addresses needed while maintaining direct access capability through the shared network segment.
Solution Approach 2:
A single floating IP address on the NAT gateway serves multiple functions: it acts as the default gateway for all tenant VMs, performs network address translation for multiple logical networks, and enables direct access for all VMs in the NAT network. This universal gateway replaces the need for individual floating IP addresses on each VM.
2Ease of operation
If one NAT gateway is used per tenant logical network, then client initiated communication can be managed, but it would become a bottleneck when the network input/output (I/O) is intensive
Solution Approach 1:
The NAT functionality is segmented from the gateway and distributed to each host running tenant VMs. NAT agents on individual hosts perform local address translation, eliminating the need for all traffic to traverse a central NAT gateway. This segmentation distributes the I/O load across multiple hosts, preventing bottlenecks while maintaining communication management capabilities.
Solution Approach 2:
A NAT agent acts as an intermediary component deployed on each host, performing local address translation between tenant VMs and the NAT network. This intermediary function eliminates the need for traffic to travel to a centralized gateway, improving network I/O performance by handling translation locally at the source.
3Reliability
If traditional NAT through gateway is used, then private IP address translation can be performed, but packets have to travel through gateway even when VMs are on the same host
Solution Approach 1:
The NAT translation function is extracted from the gateway and embedded directly into the host's NAT agent. This extraction allows address translation to occur locally on the host where the VMs reside, eliminating unnecessary packet trips to the gateway. The translation reliability is maintained through the NAT agent's implementation of the same address translation logic.
Solution Approach 2:
Each host performs its own NAT translation operations through the NAT agent, serving itself rather than relying on the gateway. When a VM on a host needs to communicate with the NAT network, the local NAT agent translates the address and routes the packet directly, enabling the host to serve its own translation needs without external gateway involvement.
Data Source
AI summary
A method for coordinating distributed network address translation (NAT) in a network within which several logical networks are implemented. The logical networks include several tenant logical networks and at least one service logical network that include service virtual machines (VMs) that are accessed by VMs of the tenant logical networks. The method defines a group of replacement IP address and port number pairs. Each pair is used to uniquely identify a VM across all tenant logical networks. The method sends to at least one host that is hosting a VM of a particular tenant logical network, a set of replacement IP address and port number pairs. Each replacement IP address and port number pair can be used by the host to replace a source IP address and a source port number in a packet that is destined from the particular VM to a VM of the particular service logical network.