WebSocket Gateway Relay for Cloud BMC Management Across NAT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
On-premises baseboard management controllers in local computers or servers are unable to establish a network connection with system management software in a public cloud due to network address translation (NAT) and firewall configurations, preventing bidirectional communication.
Innovation Solution
A manager gateway establishes a WebSocket connection over a wide area network, creating virtual network interface controllers and DNS Services to facilitate communication between baseboard management controllers in a private network and system management applications in a public cloud, using universally unique identifiers and port numbers to relay messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If NAT and firewall are configured for security in on-premises edge store, then security is improved, but bidirectional network communication between cloud system management software and on-premises baseboard management controllers is blocked
Solution Approach 1:
A WebSocket server acts as an intermediary component deployed within the on-premises private network. This server receives and forwards messages between baseboard management controllers and the cloud-based system management software, enabling bidirectional communication without requiring firewall rule changes or NAT configuration modifications. The intermediary maintains security by operating within the existing secure boundary while providing the necessary communication pathway.
2Ease of operation
If on-premises baseboard management controllers initiate network connections to cloud system management software, then connection establishment is possible, but the cloud software cannot initiate connections back to the on-premises controllers
Solution Approach 1:
Instead of attempting to enable inbound connections through firewalls and NAT (the conventional approach), the solution inverts the architecture by deploying a WebSocket server inside the private network that proactively maintains persistent connections. This allows the cloud software to send messages to the on-premises system through the inverted communication pathway, effectively enabling inbound connectivity without compromising the existing network security model.
3Ease of operation
If WebSocket connection is established over wide area network between device gateway and manager gateway, then full-duplex communication is enabled, but network latency and bandwidth consumption increase
Solution Approach 1:
The WebSocket protocol establishes persistent, long-lived connections between the device gateway and manager gateway, eliminating the need for repeated connection handshakes and protocol negotiations. This continuous connection maintains bidirectional communication channels that remain open and ready for data transmission, significantly reducing the overhead associated with connection establishment and improving network efficiency compared to traditional request-response protocols.
Data Source
AI summary
A method includes a manager gateway receiving a baseboard management controller configuration over a WebSocket connection that supports communication over a wide area network (WAN) between the controller in a device-side private network and a system management application that runs in a cloud-side private network within a public cloud computing system, wherein the manager gateway connects the cloud-side private network to the WAN. The manager gateway creates, in response to receiving the configuration for the controller, a virtual network interface controller (vNIC) having a cloud-side local network address and creating a record in a cloud-side DNS Service to map the controller to the vNIC. When the manager gateway receives a request message over the cloud-side private network from the application at the virtual network interface controller, the manager gateway relays the request message to the controller over the WebSocket connection that the cloud-side DNS Service maps to the vNIC.