Host SNAT for Cloud Service Access Bottlenecks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud service access methods using private IP addresses are inefficient due to the need for network address translation (NAT) gateways, which create bottlenecks and require multiple floating IP addresses or NAT gateways, leading to high costs and performance issues.
Innovation Solution
Implementing source network address translation (SNAT) with a centralized controller to manage a pool of unique private IP address and port number pairs across multiple tenant logical networks, allowing packets to bypass NAT gateways and directly access cloud services without going through a NAT gateway, even when VMs are on different hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If one floating IP address is assigned to each virtual machine (1:1 NAT), then cloud service access is enabled, but cost increases due to requiring one floating IP address per VM
Solution Approach 1:
The patent merges multiple VMs' NAT requirements into a single shared NAT gateway. Instead of assigning separate floating IP addresses to each VM, multiple VMs share common NAT resources (floating IP pool and port ranges), reducing the total number of floating IP addresses needed while maintaining access capability.
Solution Approach 2:
The NAT gateway is designed as a universal resource that serves multiple VMs simultaneously. A single NAT gateway can handle NAT operations for numerous VMs across different tenant logical networks, making the floating IP addresses and NAT functionality universally applicable rather than dedicated to individual VMs.
2Ease of operation
If one NAT gateway is used per tenant logical network, then cloud service access is enabled, but network I/O performance degrades due to bottleneck at the NAT gateway
Solution Approach 1:
The patent segments the NAT functionality from the VM communication paths. By using source NAT at the hypervisor level and distributing NAT operations across multiple hosts, the system avoids concentrating all network I/O through a single NAT gateway, thereby reducing the bottleneck effect and improving overall network throughput.
Solution Approach 2:
The patent introduces an intermediary mechanism (shared NAT gateway with pool-based address allocation) that mediates between multiple VMs and external networks. This intermediary approach allows efficient address reuse and reduces the need for each VM to establish separate NAT paths, improving network I/O efficiency while maintaining access functionality.
3Ease of operation
If NAT gateway is used for all tenant VMs, then cloud service access is enabled, but device complexity increases due to requiring NAT gateway infrastructure
Solution Approach 1:
The patent merges the NAT gateway functionality into the existing hypervisor infrastructure. Instead of requiring separate dedicated NAT gateway devices, the NAT functions are combined with the virtualization layer, utilizing existing host resources and reducing overall infrastructure complexity.
Solution Approach 2:
The hypervisor is enhanced to provide universal NAT capabilities that serve multiple purposes: VM networking, address translation, and service access mediation. This multi-functional approach eliminates the need for separate NAT gateway infrastructure, reducing device complexity while maintaining all necessary functions.
Data Source
AI summary
A method for a host machine that hosts at least one tenant virtual machine (VM) of a particular tenant logical network that accesses service VMs of a particular service logical network. The method, prior to a packet being received at a PFE on the host, intercepts the packet that sent by the tenant VM to one of the service VMs based on a set of forwarding rules. The packet includes a source IP address and a source port number of the tenant VM. The method, prior to the packet leaving the PFE in the host, replaces the source IP address and source port number with a replacement IP address and port number pair from a set of replacement IP address and port number pairs allocated to the host for accessing service VMs. The method sends the modified packet to the PFE to forward the modified packet to the service VM.