Managed Forwarding Nodes for Multi-Cloud Virtual Network Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Corporate networks face inefficiencies due to the paradigm shift in communication services, with a significant portion of traffic being routed through expensive leased lines and unreliable public Internet, leading to costly detours and poor performance, especially with the migration of applications to SaaS and public clouds.
Innovation Solution
A virtual network is established over multiple public cloud datacenters using managed forwarding nodes (MFNs) and a logically centralized controller cluster to optimize routing, ensuring high-speed, reliable connections across public clouds, minimizing Internet traversal, and providing secure, customizable network services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If corporate traffic is routed through secure WAN gateways using expensive leased lines, then security and reliability are improved, but cost and latency increase
Solution Approach 1:
The patent changes the routing parameters by implementing intelligent path selection that dynamically switches between private WAN connections and public Internet connections based on traffic type, destination, and current network conditions. This allows the system to optimize for both cost and reliability by using expensive leased lines only when necessary for critical traffic while routing non-critical traffic through cheaper public infrastructure.
Solution Approach 2:
The system implements dynamic routing policies that adapt to changing network conditions, traffic patterns, and cost considerations. The routing decisions are not static but continuously adjusted based on real-time measurements of latency, bandwidth availability, and cost metrics, allowing the network to flexibly optimize between reliability and cost.
2Loss of energy
If corporate traffic is routed through public Internet, then cost is reduced, but reliability and security deteriorate
Solution Approach 1:
The patent introduces intermediary components including SD-WAN edge devices, firewalls, and security appliances that act as mediators between corporate traffic and the public Internet. These intermediaries provide security enforcement, traffic inspection, and protocol optimization, thereby maintaining reliability and security standards even when traffic traverses the public Internet infrastructure.
Solution Approach 2:
The system changes the operational parameters of public Internet connections by applying QoS policies, traffic prioritization, and protocol optimization techniques. Critical business traffic is prioritized over non-critical traffic, and protocols are optimized to maximize performance over public infrastructure, thereby improving reliability without increasing cost.
3Reliability
If all corporate traffic is forced through secure WAN gateways, then security is maintained, but performance and speed decrease
Solution Approach 1:
The patent segments corporate traffic into different categories (critical business traffic, non-critical traffic, Internet-bound traffic, cloud-access traffic) and applies different routing policies to each segment. This segmentation allows security-critical traffic to traverse through secure WAN gateways while non-critical and Internet-bound traffic can use faster public Internet connections, thereby maintaining security where needed while optimizing speed where appropriate.
Solution Approach 2:
The system implements dynamic policy enforcement that adjusts routing decisions based on real-time traffic characteristics, user roles, application requirements, and network conditions. Security policies are dynamically applied based on the specific needs of each traffic flow, allowing the system to maintain security while minimizing performance impact through intelligent, adaptive decision-making.
4Adaptability or versatility
If multiple public clouds are used for virtual network, then scalability and adaptability are improved, but device complexity increases
Solution Approach 1:
The patent implements a universal SD-WAN controller that can manage multiple public cloud providers and virtual network functions through a single, standardized interface. This universal controller provides multi-functionality by handling routing, security, monitoring, and optimization across diverse cloud infrastructures, thereby achieving high adaptability while abstracting away the underlying complexity from individual network operations.
Solution Approach 2:
The SD-WAN controller acts as an intermediary layer between the diverse public cloud infrastructures and the corporate network requirements. It translates various cloud provider-specific protocols and interfaces into a unified management plane, thereby enabling multi-cloud deployment and adaptability while reducing the complexity that would otherwise be exposed to network administrators and users.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Some embodiments provide a novel method for deploying different virtual networks over several public cloud datacenters for different entities. For each entity, the method (1) identifies a set of public cloud datacenters of one or more public cloud providers to connect a set of machines of the entity, (2) deploys managed forwarding nodes (MFNs) for the entity in the identified set of public cloud datacenters, and then (3) configures the MFNs to implement a virtual network that connects the entity's set of machines across its identified set of public cloud datacenters. In some embodiments, the method identifies the set of public cloud datacenters for an entity by receiving input from the entity's network administrator. In some embodiments, this input specifies the public cloud providers to use and/or the public cloud regions in which the virtual network should be defined. Conjunctively, or alternatively, this input in some embodiments specifies actual public cloud datacenters to use.