SD-WAN Service Chain Sharing With VPN Segment Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SD-WAN technologies fail to efficiently manage bidirectional traffic and maintain VPN segment preservation while allowing scalability for service chain elements, leading to issues such as dropped packets and compromised security.
Innovation Solution
A hub node extracts and removes source VPN segment information from data packets before forwarding them to service chain elements, and upon return, retrieves this information using packet tuple data to route packets back to the correct VPN segment, ensuring scalable and secure service chain sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If service chain elements use their own VPN segments, then network security is improved, but bidirectional traffic management deteriorates causing packet loss
Solution Approach 1:
The hub node functions as an intermediary between source VPN segments and service chain VPN segments. It extracts source VPN information from incoming packets, forwards packets to service chain elements over service chain VPN segments, and reconstructs source VPN segments for return traffic. This mediator approach allows service chain elements to operate in isolated VPN segments while maintaining bidirectional traffic flow and preventing packet loss.
Solution Approach 2:
The system segments network traffic into distinct VPN segments: source VPN segments for ingress traffic, service chain VPN segments for processing, and reconstructed source VPN segments for egress traffic. This segmentation allows service chain elements to use dedicated VPN segments for security while the hub node manages the mapping between different segments to prevent packet loss.
2Reliability
If service chain elements have dedicated VPN segments, then network security is improved, but scalability deteriorates
Solution Approach 1:
The hub node provides universal functionality by serving as a central point that handles VPN segment mapping for multiple service chain elements and multiple source VPN segments. Instead of requiring dedicated infrastructure for each service chain element, the hub node universally manages the abstraction layer, allowing any service chain element to be added to any VPN segment through configuration rather than physical infrastructure changes.
3Reliability
If source VPN segment information is removed before service chain processing, then VPN segment isolation is improved, but traffic routing deteriorates
Solution Approach 1:
The hub node performs preliminary action by extracting and storing source VPN segment information from incoming packets before forwarding them to service chain elements. This pre-extraction ensures VPN segment isolation is maintained during service chain processing while the stored information is readily available for routing return traffic, eliminating the need to preserve VPN information throughout the entire service chain path.
Data Source
AI summary
A system facilitates communication between branches of an SD-WAN and a service chain element. A hub node receives a data packet of a flow from a source branch over a VPN segment to be transmitted to a destination branch, extracts flow information from the data packet including VPN segment information to be stored in a flow table before transmitting the data packet to the service chain element over a service chain VPN. Upon return of the data packet from the service chain element, the hub node uses packet tuple information to retrieve the flow information with VPN segment information from the flow table. The hub node can then forward the data packet to the destination branch over the VPN segment. The hub node can generate and store an Auto Service Chaining Key that connects bidirectional flows so that the hub node can apply service-chaining to bidirectional traffic.