Abstract: The disclosure describes examples where a first data center includes a first gateway router, a first set of computing devices, and a second set of computing devices. The first set of computing devices is configured to execute a software defined networking (SDN) controller cluster to facilitate operation of one or more virtual networks within the first data center. The second set of computing devices is configured to execute one or more control nodes to exchange route information, between the first gateway router and a second gateway router of a second data center different than the first data center, for a virtual network between computing devices within the second data center, and to communicate control information for the second data center to the second set of computing devices, wherein the one or more control nodes form a subcluster of the SDN controller cluster.

Abstract: The disclosure describes examples where a first data center includes a first gateway router, a first set of computing devices, and a second set of computing devices. The first set of computing devices is configured to execute a software defined networking (SDN) controller cluster to facilitate operation of one or more virtual networks within the first data center. The second set of computing devices is configured to execute one or more control nodes to exchange route information, between the first gateway router and a second gateway router of a second data center different than the first data center, for a virtual network between computing devices within the second data center, and to communicate control information for the second data center to the second set of computing devices, wherein the one or more control nodes form a subcluster of the SDN controller cluster.

Abstract: The disclosure describes examples where a first data center includes a first gateway router, a first set of computing devices, and a second set of computing devices. The first set of computing devices is configured to execute a software defined networking (SDN) controller cluster to facilitate operation of one or more virtual networks within the first data center. The second set of computing devices is configured to execute one or more control nodes to exchange route information, between the first gateway router and a second gateway router of a second data center different than the first data center, for a virtual network between computing devices within the second data center, and to communicate control information for the second data center to the second set of computing devices, wherein the one or more control nodes form a subcluster of the SDN controller cluster.

Abstract: The disclosure describes examples where a first data center includes a first gateway router, a first set of computing devices, and a second set of computing devices. The first set of computing devices is configured to execute a software defined networking (SDN) controller cluster to facilitate operation of one or more virtual networks within the first data center. The second set of computing devices is configured to execute one or more control nodes to exchange route information, between the first gateway router and a second gateway router of a second data center different than the first data center, for a virtual network between computing devices within the second data center, and to communicate control information for the second data center to the second set of computing devices, wherein the one or more control nodes form a subcluster of the SDN controller cluster.

Abstract: In general, techniques are described for providing software redundancy for Virtual Network Functions (VNF). In one example, a method includes, by a host process executed by an insertable service card of a network device, pinning, to a plurality of hardware-based processors, active threads of an active network function. The host process pins, to a single hardware-based processor, backup threads of a backup network function for the active network function, wherein the plurality of hardware-based processors does not include the single hardware-based processor. The host process pins, to the single hardware-based processor, management threads of the active and backup network functions. The single hardware-based processor executes the management threads of the active and backup network functions to cause the management thread of the backup network function to receive, from the management thread of the active network function, state data generated by the active threads.

Abstract: Techniques are disclosed for performing an In-Service Software Upgrade (“ISSU”) of a first packet forwarding component (PFC) of a virtual router configured to forward traffic flows for a plurality of session instances within a cloud-based data center. The techniques described herein may retain flow state information throughout the ISSU process without interrupting network traffic flow. In one example, a processor of a plurality of compute nodes within the data center receives a request to perform an ISSU of the first PFC. The processor spawns a second virtual routing agent and a second PFC. The second virtual routing agent synchronizes flow state information with a first virtual routing agent for the virtual router. After synchronizing the flow state information, the virtual router switches from forwarding traffic flows by the first PFC to forwarding traffic flows by the second PFC. The ISSU process deactivates the first virtual router and the first PFC.

Abstract: Techniques are disclosed describing an In-Service Software Upgrade for a Software Defined Networking (SDN) controller of a cloud data center. A cloud data center includes a first SDN controller configured to perform session management of a plurality of session instances, an orchestration engine communicatively coupled to the first SDN controller via a northbound application program interface (API); and a plurality of compute nodes configured to perform compute functions for the plurality of session instances. In response to receiving a request to perform an in-service software upgrade (ISSU) of the first SDN controller, the orchestration engine spawns a second, upgraded SDN controller on the cloud data center. An ISSU process initializes the second SDN controller and transfers session management for the plurality of session instances from the first SDN controller to the second SDN controller. Finally, the ISSU process removes the first SDN controller from the cloud data center.

Abstract: A source network address and port translation (NAPT) mechanism is described that reduces or eliminates the need to log any NAT translations. As described herein, a mapping between a subscriber's private address to a public address and port range is determined algorithmically. Given a particular mapping rule, as specified by the service provider, a subscriber is repeatedly and deterministically mapped to the same public network address and a specific port range for that network address. Once the public address and port range for a subscriber are computed, the particular ports for each session for that subscriber are allocated dynamically within the computed NAT port range on per session basis.

Abstract: In one example, a network device includes one or more network interfaces configured to receive a message according to a protocol for reserving a public Internet protocol (IP) address and port for a network connection and to receive one or more packets of a packet flow associated with the public IP address and the port for the network connection, and one or more processors comprising a primary service device, wherein the processors are configured to determine whether the message includes an indication that the network connection is to be checkpointed for high availability, and wherein the primary service device is configured to, based on the indication, checkpoint data of at least one of the received packets to a backup service device. Accordingly, a message of a protocol for reserving a public network address and port may be used to indicate whether a network connection should be checkpointed for high availability.

Abstract: A node is configured to receive, from a second node, a request to establish a session; perform, in response to the request, a network address translation (NAT) operation to establish the session, the NAT operation causing a first port block to be allocated to the session, the first port block including a first set of ports via which traffic, associated with the session, is transported; determine that the set of ports are no longer available for the session; determine whether a quantity of times that the first port block has been allocated to the session is greater than a threshold; and retain the first port block, for the session, when the quantity of times that the first port block has been allocated to the session is not greater than the threshold.

Abstract: A network device may receive a request from a local device to establish a connection with a another device. The request may include an internal network identifier of the local device. The network device may evaluate a plurality of external network identifiers, associated with the network device based on selected criteria. The network device may also, or alternatively, evaluate the external network identifiers by identifying an external network identifier that is already mapped to, or paired with, the internal network identifier. The network device may select an external network identifier, of the plurality of external network identifiers, based on the evaluation and establish the connection requested by the local device using the internal network identifier and the external network identifier.

Abstract: In general, techniques are described for load balancing, with a service node, packet flows using stateless load balancing that adapts to server failure to provide flow affinity to initially selected servers for the duration of respective flows. In one example, service node device applies stateless load balancing to packet flows to distribute the flows among a plurality of servers. The service node determines a failure of a failed server and then receives an initial packet of a packet flow from the packet flows and forwards the initial packet to an active server. The service node generates a mapping of the packet flow to the active server, determines a recovery of the failed server, receives a subsequent packet of the packet flow, and forwards the subsequent packet of the packet flow to the active server based at least on the mapping of the packet flow to the active server.

Abstract: In one example, a network device includes one or more network interfaces configured to receive a message according to a protocol for reserving a public Internet protocol (IP) address and port for a network connection and to receive one or more packets of a packet flow associated with the public IP address and the port for the network connection, and one or more processors comprising a primary service device, wherein the processors are configured to determine whether the message includes an indication that the network connection is to be checkpointed for high availability, and wherein the primary service device is configured to, based on the indication, checkpoint data of at least one of the received packets to a backup service device. Accordingly, a message of a protocol for reserving a public network address and port may be used to indicate whether a network connection should be checkpointed for high availability.

Abstract: A node is configured to receive, from a second node, a request to establish a session; perform, in response to the request, a network address translation (NAT) operation to establish the session, the NAT operation causing a first port block to be allocated to the session, the first port block including a first set of ports via which traffic, associated with the session, is transported; determine that the set of ports are no longer available for the session; determine whether a quantity of times that the first port block has been allocated to the session is greater than a threshold; and retain the first port block, for the session, when the quantity of times that the first port block has been allocated to the session is not greater than the threshold.

Abstract: A source network address and port translation (NAPT) mechanism is described that reduces or eliminates the need to log any NAT translations. As described herein, a mapping between a subscriber's private address to a public address and port range is determined algorithmically. Given a particular mapping rule, as specified by the service provider, a subscriber is repeatedly and deterministically mapped to the same public network address and a specific port range for that network address. Once the public address and port range for a subscriber are computed, the particular ports for each session for that subscriber are allocated dynamically within the computed NAT port range on per session basis.

Abstract: A node is configured to receive, from a second node, a request to establish a session; perform, in response to the request, a network address translation (NAT) operation to establish the session, the NAT operation causing a first port block to be allocated to the session, the first port block including a first set of ports via which traffic, associated with the session, is transported; determine that the set of ports are no longer available for the session; determine whether a quantity of times that the first port block has been allocated to the session is greater than a threshold; and retain the first port block, for the session, when the quantity of times that the first port block has been allocated to the session is not greater than the threshold.

Abstract: Techniques are described for load-balancing deterministic NAT functions in a mobile gateway or other device in which subscriber sessions are distributed across a plurality of session management cards. Each of the session management cards may host a non-contiguous set of public addresses and a non-contiguous set of private network addresses associated with the subscriber sessions. To facilitate deterministic NAT under such conditions, each of the session management cards locally maps the non-contiguous set of public network addresses to an internal contiguous sequence of identifiers for the public addresses and maps the non-contiguous set of private network addresses to an internal contiguous sequence of identifiers for the private addresses. Each of the session management cards may then perform deterministic NAT on packets based on the contiguous sequence of identifiers for the public addresses and the contiguous sequence of identifiers for the private addresses internal to the session management card.

Abstract: A network device may receive a request from a local device to establish a connection with a another device. The request may include an internal network identifier of the local device. The network device may evaluate a plurality of external network identifiers, associated with the network device based on selected criteria. The network device may also, or alternatively, evaluate the external network identifiers by identifying an external network identifier that is already mapped to, or paired with, the internal network identifier. The network device may select an external network identifier, of the plurality of external network identifiers, based on the evaluation and establish the connection requested by the local device using the internal network identifier and the external network identifier.

Abstract: A network device may receive a request from a local device to establish a connection with a another device. The request may include an internal network identifier of the local device. The network device may evaluate a plurality of external network identifiers, associated with the network device based on selected criteria. The network device may also, or alternatively, evaluate the external network identifiers by identifying an external network identifier that is already mapped to, or paired with, the internal network identifier. The network device may select an external network identifier, of the plurality of external network identifiers, based on the evaluation and establish the connection requested by the local device using the internal network identifier and the external network identifier.

Abstract: An example network system includes network interfaces, a data repository, a forwarding structure, a service element, and a forwarding element. The forwarding element is configured to receive a first packet having header information via a tunnel over the first network with one of the networking interfaces, pass the first packet to the service element, receive a second packet from the service element, and forward the second packet via the network interfaces to the second network, wherein the first packet conforms to the first network-layer protocol, and wherein the second packet conforms to the second network-layer protocol. The service element is configured to transform the first packet from a format conforming with the first network-layer protocol into the second packet having a format conforming with the second network-layer protocol, and direct the second packet to the forwarding element.