Stateful Gateway Failover via Address Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public multi-tenant clouds, high availability logical network gateways face challenges in maintaining stateful services across active and standby instances operating in different physical locations, as the active and standby instances have different network addresses, leading to invalid connection state data when the active instance fails.
Innovation Solution
The stateful service rules are distributed using the public network address, with each instance mapping the active instance's interface network address to its own, ensuring that the standby instance receives valid connection state data and can seamlessly take over in case of a failure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If active and standby gateway instances are deployed in different physical locations for high availability, then network reliability is improved, but connection state data becomes invalid due to different network addresses
Solution Approach 1:
The patent introduces a control plane as an intermediary that mediates between the active and standby gateway instances. The control plane collects connection state data from the active instance and republishes it to the standbyinstance, enabling the standby instance to maintain valid connection state information without directly accessing potentially invalid data from the active instance's network address space.
Solution Approach 2:
The patent implements copying of connection state data from the active gatewayinstance to the standby gatewayinstance through the control plane. The control plane copies the connection state data structure, including active connection information, and republishes it to the standbyinstance, ensuring the standby instance has an accurate copy of the state data for seamless failover.
2Adaptability or versatility
If centralized routing components are deployed in gateway appliances within public cloud data compute nodes, then service functionality is improved, but system complexity increases
Solution Approach 1:
The patent implements multi-functionality by deploying centralized routing components that can perform multiple stateful services including firewall, network address translation (NAT), load balancing, and virtual private networking (VPN) within the same gateway appliance architecture, allowing a single system to handle diverse network functions.
Solution Approach 2:
The patent applies preliminary action by pre-configuring and pre-loading routing tables, connection state data, and service policies into the standby gatewayinstance before failover is needed. This ensures that when failover occurs, the standbyinstance can immediately assume operational status with all necessary configurations already in place, reducing the complexity of real-time configuration changes.
Data Source
AI summary
Some embodiments provide a method for a first DCN operating in a first datacenter as a logical network gateway that processes messages between other DCNs of the logical network and external entities, which address the logical network gateway using a first address. The first DCN has an interface with a second address for use in the first datacenter. The method stores a mapping between the second address and a third address. A second DCN operates the logical network gateway in a second datacenter and has an interface with the third address for use in the second datacenter. From the second DCN, the method receives connection state data, describing connections between the external entities and the DCNs of the logical network, that uses the third address. The method replaces the third address with the second address in the connection state data using the stored mapping and stores the connection state data.