Abstract: Methods for establishing a stateless extranet in a secure communication network include transmitting a consumer NHOP to a provider CPE from a consumer CPE in a control plane. The consumer NHOP is associated with at least one attribute of an NHOP, including an encryption key available with the consumer CPE, to establish a secure communication tunnel in a data plane. The consumer CPE receives a service definition over the control plane associated with a service available with the provider CPE. A service anchor point is created based on an identifier of the service definition. A network address translation (NAT) IP request is transmitted to the provider CPE. The consumer CPE receives a NAT IP from the provider CPE in response to the NAT IP request. The NAT IP is associated with the service anchor point of the consumer CPE. A stateless service is thereby instantiated on the consumer CPE.

Abstract: Embodiments of a method of communicating a packet by a network address translation (NAT) enabled router, are described. In an embodiment, the method includes receiving a return packet to be communicated to a destination. The destination is associated with a first source address in the context of a forward packet. The method further includes determining a return path to transmit the return packet to the destination based on security association data. The security association data is pre-recorded in a routing table of the NAT enabled router when the forward packet is received, prior to receiving the return packet, over a forward path established between the NAT enabled router and an enterprise node. The security association data uniquely identifies the forward path as the return path.

Abstract: In one embodiment, a method includes receiving from a host node comprising a tenant multicast application with a single tenant deployment, an encapsulated multicast packet over unicast at a virtual replicator, the encapsulated multicast packet comprising receiver information for the virtual replicator, replicating the encapsulated multicast packet at the virtual replicator, and transmitting the encapsulated multicast packet over unicast to a plurality of receiving nodes based on the receiver information. The receiving nodes comprise the tenant multicast application and the virtual replicator operates in a cloud without multicast capability. An apparatus is also disclosed herein.

Abstract: In one embodiment, a method includes receiving from a host node comprising a tenant multicast application with a single tenant deployment, an encapsulated multicast packet over unicast at a virtual replicator, the encapsulated multicast packet comprising receiver information for the virtual replicator, replicating the encapsulated multicast packet at the virtual replicator, and transmitting the encapsulated multicast packet over unicast to a plurality of receiving nodes based on the receiver information. The receiving nodes comprise the tenant multicast application and the virtual replicator operates in a cloud without multicast capability. An apparatus is also disclosed herein.