SD-WAN High-Availability Clusters with Stateless VPN Homing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High availability (HA) clusters face issues with session resetting due to the inability of standby nodes to inspect bidirectional packet flow, particularly in Active/Standby configurations, as they lack knowledge of flow ownership, leading to improper routing of return traffic.
Innovation Solution
Implementing stateless virtual private networks (VPNs) to designate active and standby nodes within HA clusters, allowing both sets of uplinks to be utilized without session resets by ensuring the standby node can redirect traffic to the active node, leveraging stateless VPNs to maintain flow ownership information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a standby node receives return traffic in an Active/Standby HA configuration, then the standby node cannot forward the packet to the active node, but utilizing both uplinks would improve bandwidth and load balancing
Solution Approach 1:
The patent introduces an intermediary mechanism where the standby node detects return traffic and redirects it to the active node through internal forwarding. This mediator approach allows the standby node to receive traffic on its uplink while ensuring proper handling by the active node, thus utilizing both uplinks without breaking session continuity.
Solution Approach 2:
The patent segments the traffic handling function by separating the reception capability (available on standby node uplinks) from the forwarding decision logic (handled by active node). This segmentation allows each node to independently utilize its uplinks while maintaining coordinated session management through the HA cluster protocol.
2Reliability
If the standby node inspects bidirectional packet flow, then session continuity is maintained, but the standby node cannot utilize its uplinks for traffic forwarding
Solution Approach 1:
Instead of requiring the standby node to inspect bidirectional flow (which would prevent uplink usage), the patent inverts the approach: the standby node accepts return traffic on its uplink without inspection, and the active node performs the inspection and forwarding decision. This inversion allows uplink utilization while maintaining session continuity.
3Productivity
If return traffic is routed to the standby node without flow inspection, then uplink bandwidth is utilized, but the session is reset due to lack of flow ownership knowledge
Solution Approach 1:
The patent introduces an intermediary redirecting mechanism where the standby node, upon receiving return traffic, identifies it as such and redirects it to the active node. This intermediary action prevents the harmful session reset by ensuring the traffic reaches the node that owns the session state, while still allowing the standby uplink to be utilized for traffic reception.
Data Source
AI summary
The present technology uses stateless virtual private network (VPN) homing to assign one of the nodes as an active node and the other as a standby node. When the packet is received at the active node and return traffic received at the standby node, the standby node can redirect the traffic to the VPN-homed active node since the VPN is stateless and therefore the resetting by the stateful application will not occur. Multiple VPNs can be implemented to route more business-critical traffic across an active node while still permitting the other node to be active in a second VPN for less critical traffic. The nodes can therefore be used more efficiently but without the session reset problem inherent in stateful application configurations.