Abstract: Disclosed is a method for load balancing at the source side rather than the destination side of a network. Destination networks can communicate with source load balancers by transmitting network protocol advertisements such as border gateway protocol (BGP) advertisements. The advertisements can communicate prefixes representing available subnets for load balancing purposes. The source load balancer would then load balance and transmit the network traffic along a path made up at least in part by the prefixes advertised by the network.

Abstract: The systems and methods disclosed herein provide for coalescing data packets into jumbo frames in order to maximize the throughputs inside the service provider Local Area Network (LAN), thereby increasing the amount of traffic forwarded between internal services. The systems and methods outlined herein enable a source service on a LAN to receive a plurality of data packets from a public cloud-based network (e.g., the Internet) having a packet size limit less than the MTU limit of the LAN, and coalesce the plurality of data packets into a jumbo frame having a size based on the MTU limit of the LAN. The jumbo frame is then transmitted over the LAN to a destination service on the LAN. The destination service then separates the jumbo frame back into the plurality of data packets for further transmission back to the public cloud-based network.

Abstract: Proposed herein at techniques for scalable network traffic steering in a multi-tenant network. In one aspect, a method includes receiving, at an ingress of a multi-tenant network, a data packet, the data packet including a Virtual Network Identifier (VNI) identifying a corresponding tenant for the data packet in the multi-tenant network, and determining, at the ingress, a corresponding cluster of routers for processing the data packet based on the VNI, wherein the corresponding cluster of routers is one of a plurality of clusters of routers in the multi-tenant network. The method further includes forwarding the data packet to a router in the corresponding cluster of routers for processing.

Abstract: The present technology pertains to receiving, by a multi-tenanted cloud-native headend, network traffic from a source that is directed to a destination within a network of a first tenant, where the network traffic is routed using BGP over a multi-tenanted BGP network, where the multi-tenanted BGP network utilizes route isolation to isolate the network of the first tenant from networks of other tenants making use of the multi-tenanted BGP network, mapping the received network traffic based on at least a source IP, source port, and virtual network interface (VNI) to a port associated with the network of the first tenant over the isolated BGP route, where the mapping is a stateful mapping, where the mapping is also potentially based on other information associated with the network traffic, and directing the received network traffic to a local address in the network of the first tenant.

Abstract: Disclosed is a method for load balancing at the source side rather than the destination side of a network. Destination networks can communicate with source load balancers by transmitting network protocol advertisements such as border gateway protocol (BGP) advertisements. The advertisements can communicate prefixes representing available subnets for load balancing purposes. The source load balancer would then load balance and transmit the network traffic along a path made up at least in part by the prefixes advertised by the network.

Abstract: The systems and methods disclosed herein provide for coalescing data packets into jumbo frames in order to maximize the throughputs inside the service provider Local Area Network (LAN), thereby increasing the amount of traffic forwarded between internal services. The systems and methods outlined herein enable a source service on a LAN to receive a plurality of data packets from a public cloud-based network (e.g., the Internet) having a packet size limit less than the MTU limit of the LAN, and coalesce the plurality of data packets into a jumbo frame having a size based on the MTU limit of the LAN. The jumbo frame is then transmitted over the LAN to a destination service on the LAN. The destination service then separates the jumbo frame back into the plurality of data packets for further transmission back to the public cloud-based network.

Abstract: Techniques for utilizing a portion of a communication session identifier (e.g., a Session-ID, an SPI, a CID, a DCID, and/or the like) to indicate a target routing device (e.g., a VPN and/or ZTNA termination device) for establishing control plane session(s) and/or data plane session(s) at wire-speed in a networked computing environment. The routing device(s) of a networked computing environment may generate a communication session identifier and send the communication session identifier to the client device, such that subsequent packets send from the client device may be forwarded to the proper routing device indicated by the communication session identifier for establishment of one or more data plane sessions. Additionally, data plane sessions may be established using a Resumed Handshake rather than a full handshake that is typically required, as Session Resumption utilizes the assigned communication session identifier for mapping.

Abstract: Techniques for routing Internet Protocol security (IPsec) data packets. An index is assigned to a Security Parameter Index (SPI) header of the IPsec data packet. The index includes information for routing the data packet to a particular Encapsulating Security Payload (ESP) processor. The data packet can be routed using techniques that are analogous to conventional routing protocols such as IPv4 routing protocol. This allows the data packet to be routed using less expensive routing protocols rather than relying solely on more expensive load balancing techniques to route the data packet. This also advantageously allows the data packet to be routed employing routing techniques developed over decades of routing protocol development.

Abstract: Techniques for utilizing a portion of a communication session identifier (e.g., a Session-ID, an SPI, a CID, a DCID, and/or the like) to indicate a target routing device (e.g., a VPN and/or ZTNA termination device) for establishing control plane session(s) and/or data plane session(s) at wire-speed in a networked computing environment. The routing device(s) of a networked computing environment may generate a communication session identifier and send the communication session identifier to the client device, such that subsequent packets send from the client device may be forwarded to the proper routing device indicated by the communication session identifier for establishment of one or more data plane sessions. Additionally, data plane sessions may be established using a Resumed Handshake rather than a full handshake that is typically required, as Session Resumption utilizes the assigned communication session identifier for mapping.

Abstract: The present technology pertains to receiving, by a multi-tenanted cloud-native headend, network traffic from a source that is directed to a destination within a network of a first tenant, where the network traffic is routed using BGP over a multi-tenanted BGP network, where the multi-tenanted BGP network utilizes route isolation to isolate the network of the first tenant from networks of other tenants making use of the multi-tenanted BGP network, mapping the received network traffic based on at least a source IP, source port, and virtual network interface (VNI) to a port associated with the network of the first tenant over the isolated BGP route, where the mapping is a stateful mapping, where the mapping is also potentially based on other information associated with the network traffic, and directing the received network traffic to a local address in the network of the first tenant.

Abstract: Techniques for routing Internet Protocol security (IPsec) data packets. An index is assigned to a Security Parameter Index (SPI) header of the IPsec data packet. The index includes information for routing the data packet to a particular Encapsulating Security Payload (ESP) processor. The data packet can be routed using techniques that are analogous to conventional routing protocols such as IPv4 routing protocol. This allows the data packet to be routed using less expensive routing protocols rather than relying solely on more expensive load balancing techniques to route the data packet. This also advantageously allows the data packet to be routed employing routing techniques developed over decades of routing protocol development.

Abstract: The systems and methods disclosed herein provide for coalescing data packets into jumbo frames in order to maximize the throughputs inside the service provider Local Area Network (LAN), thereby increasing the amount of traffic forwarded between internal services. The systems and methods outlined herein enable a source service on a LAN to receive a plurality of data packets from a public cloud-based network (e.g., the Internet) having a packet size limit less than the MTU limit of the LAN, and coalesce the plurality of data packets into a jumbo frame having a size based on the MTU limit of the LAN. The jumbo frame is then transmitted over the LAN to a destination service on the LAN. The destination service then separates the jumbo frame back into the plurality of data packets for further transmission back to the public cloud-based network.

Abstract: Techniques for utilizing a portion of a communication session identifier (e.g., a Session-ID, an SPI, a CID, a DCID, and/or the like) to indicate a target routing device (e.g., a VPN and/or ZTNA termination device) for establishing control plane session(s) and/or data plane session(s) at wire-speed in a networked computing environment. The routing device(s) of a networked computing environment may generate a communication session identifier and send the communication session identifier to the client device, such that subsequent packets send from the client device may be forwarded to the proper routing device indicated by the communication session identifier for establishment of one or more data plane sessions. Additionally, data plane sessions may be established using a Resumed Handshake rather than a full handshake that is typically required, as Session Resumption utilizes the assigned communication session identifier for mapping.

Abstract: Systems, methods, and computer-readable media are provided for securely advertising autoconfigured prefixes in a cloud environment. In some examples, a method can include, receiving, by a first router, an indication of an available network address prefix. In some aspects, the method can also include selecting, by the first router, a first network address prefix that is within the available network address prefix, wherein the first network address prefix provides at least one route to one or more network elements associated with the first router. In some cases, the method may further include sending, to a second router, a message including a stub registration option that indicates the first network address prefix.

Abstract: Proposed herein at techniques for scalable network traffic steering in a multi-tenant network. In one aspect, a method includes receiving, at an ingress of a multi-tenant network, a data packet, the data packet including a Virtual Network Identifier (VNI) identifying a corresponding tenant for the data packet in the multi-tenant network, and determining, at the ingress, a corresponding cluster of routers for processing the data packet based on the VNI, wherein the corresponding cluster of routers is one of a plurality of clusters of routers in the multi-tenant network. The method further includes forwarding the data packet to a router in the corresponding cluster of routers for processing.

Abstract: Techniques for routing Internet Protocol security (IPsec) data packets. An index is assigned to a Security Parameter Index (SPI) header of the IPsec data packet. The index includes information for routing the data packet to a particular Encapsulating Security Payload (ESP) processor. The data packet can be routed using techniques that are analogous to conventional routing protocols such as IPv4 routing protocol. This allows the data packet to be routed using less expensive routing protocols rather than relying solely on more expensive load balancing techniques to route the data packet. This also advantageously allows the data packet to be routed employing routing techniques developed over decades of routing protocol development.

Abstract: Techniques for a hub node, provisioned in a site of a hub and spoke overlay network, to receive, store, and/or forward network routing information associated with a spoke, and send packets directly to spoke(s) that are remote from the hub node. A first hub node may receive a network advertisement including a border gateway protocol (BGP) large community string from a first spoke local to the first hub node. The first hub node may send the BGP large community string to a second hub node remote from the first hub node. The second hub node may decode network routing information from the BGP large community string and store the network routing information locally. The second hub node may send a packet from a second spoke local to the second hub node directly to the first spoke without the data packet being routed via the first hub node.

Abstract: Techniques for a hub node, provisioned in a site of a hub and spoke overlay network, to receive, store, and/or forward network routing information associated with a spoke, and send packets directly to spoke(s) that are remote from the hub node. A first hub node may receive a network advertisement including a border gateway protocol (BGP) large community string from a first spoke local to the first hub node. The first hub node may send the BGP large community string to a second hub node remote from the first hub node. The second hub node may decode network routing information from the BGP large community string and store the network routing information locally. The second hub node may send a packet from a second spoke local to the second hub node directly to the first spoke without the data packet being routed via the first hub node.

Abstract: Systems, methods, and computer-readable media are provided for securely advertising autoconfigured prefixes in a cloud environment. In some examples, a method can include, receiving, by a first router, an indication of an available network address prefix. In some aspects, the method can also include selecting, by the first router, a first network address prefix that is within the available network address prefix, wherein the first network address prefix provides at least one route to one or more network elements associated with the first router. In some cases, the method may further include sending, to a second router, a message including a stub registration option that indicates the first network address prefix.

Abstract: Systems, methods, and computer-readable storage media are provided to populate databases with routing data for containers to eliminate the need for continuously accessing a global discovery service. An example method includes initiating, from a source container operating on a first machine in a first rack, a communication with a destination container operating on a second machine on a second rack, wherein a local database on the first machine does not know an address of the destination container. The method includes accessing a global discovery service to provide the address of the destination container, populating the local database on the first machine with the address of the destination container and routing a packet from the source container to the destination container according to the address of the destination container.