Abstract: Local internet functionality may allow host devices positioned in branch office locations to securely communicate outgoing internet traffic directly over the internet. Local internet functionality may also allow said host devices to securely receive incoming internet traffic through the creation and tracking of local internet sessions. Local internet functionality is achieved by forwarding egress internet traffic over a local internet virtual pathway extending to a WAN interface/port of a local host device. The WAN interface/port is configured to communicate traffic received over the local internet virtual pathway directly over the internet, while communicating all other egress traffic over secure tunnels of the virtual edge router. The WAN interface/port is further configured to monitor outgoing local internet traffic to create and track local internet sessions.

Abstract: A virtual edge router network for providing managed services to distributed remote office locations can include routing components that are capable of being autonomously deployed at the network edge, as well as remotely managed, thereby obviating the need for on-site technical support in remote offices of the a small and medium business (SMB) client. Autonomous deployment and remote management is achieved through abstraction of the control and management planes from the data plane. Virtual edge routers may include virtual forwarding units and virtual remote agents instantiated on host devices in each remote office location, as well as a virtual network controller instantiated on a host device in a head-office location. A data plane of the virtual edge router communicatively couples the virtual forwarding units to one another, while a control plane communicatively couples the virtual network controller to each virtual data forwarding unit.

Abstract: Incoming packets communicated over a common WAN interface of a distributed host device may be processed differently depending on their traffic classification. A virtual forwarding unit classifies incoming packets as tunneled traffic, tunnel-related control traffic, remote agent traffic, or local internet traffic. Tunneled traffic classifies packets transported over data or control tunnels extending between WAN interfaces of distributed host devices. Tunnel-related control traffic classifies packets communicated to measure a quality parameter of the data or control tunnels, such as operations, administration and maintenance (OAM) packets. Remote agent traffic classifies packets associated with existing remote agent sessions, which are created and tracked based on outgoing management traffic originating from the virtual remote agent. Local internet traffic classifies packets associated with existing local internet sessions, which are created and tracked based on outgoing local internet traffic.

Abstract: Dual-homed forwarding techniques ensure that packets destined for a private network location are forwarded directly to the private network. Host devices adapted for dual-homed forwarding techniques may first search a forwarding table to identify an outgoing interface associated with a packet's destination address, and then search an egress table to identify an entry associated with the outgoing interface. The identified entry in the egress table indicates whether the outgoing interface is a remote interface, and if so, a dual-homing identifier associated with the outgoing interface. If so, the host device searches the forwarding table a second time to determine whether any local interfaces are associated with the dual-homing identifier. The packet is then forwarded either over the local outgoing interface associated with the dual-homing identifier or the originally identified outgoing interface.