Shared SD-WAN Control Connection for Multi-Tenant Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SD-WAN systems face challenges in achieving high scalability and efficient utilization of resources due to the overhead and cost associated with multiple control connections per tenant, which increases the complexity and resource consumption.
Innovation Solution
Implementing a shared control plane infrastructure across tenants using a centralized network management system to multiplex multiple tenants onto a single encrypted control connection, reducing the number of control connections and optimizing the control plane interfaces for minimal overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple control connections are established per tenant, then each tenant can have dedicated control communication, but the number of control connections, sockets, memory usage, and bandwidth requirements increase
Solution Approach 1:
Multiple tenants are merged onto a single shared control connection instead of having separate dedicated connections for each tenant. The control connection includes a tenant identifier that allows the system to distinguish between different tenants while using the same physical connection infrastructure, thereby reducing the total number of connections and associated overhead.
Solution Approach 2:
The shared control connection serves multiple tenants simultaneously through multi-functionality. By incorporating tenant identifiers into the control connection, the same connection infrastructure can be universally used across different tenants, eliminating the need for separate dedicated connections for each tenant while maintaining their individual control communication needs.
2Reliability
If multiple control connections are established per tenant, then dedicated control communication is achieved, but resource consumption and system cost increase
Solution Approach 1:
Multiple control connections are merged into a single shared connection that serves multiple tenants. The tenant identifier embedded in the control connection enables the system to multiplex control traffic from different tenants over the same physical connection, significantly reducing the quantity of control connections required while maintaining reliable control communication for each tenant.
3Productivity
If a shared control connection is used across tenants, then scalability and resource efficiency improve, but control connection sharing complexity increases
Solution Approach 1:
The control connection is segmented at the logical level through the inclusion of tenant identifiers, allowing the system to distinguish between different tenants while using the same physical connection. This segmentation enables multi-tenancy without requiring separate physical connections for each tenant, improving scalability while managing complexity through logical rather than physical separation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a method includes onboarding, by an edge router, a first tenant from a network management system and determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller. The method also includes reserving, by the edge router, a port number in a kernel for the first tenant and inserting, by the edge router, the tenant identifier into a first control packet. The method further includes communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session. The first peering session shares the encrypted control connection with a second peering session.