Patent ID: 11929987
Assignee: JUNIPER NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 19:
20. A computing device comprising:
a memory; and
one or more processors coupled to the memory, wherein the one or more processors are configured to:
instantiate a plurality of virtual execution elements, wherein a first virtual execution element is configured to provide an execution environment for one or more application workloads, and wherein a second virtual execution element is configured as a firewall configured as a bump-in-the-wire;
attach a virtual network interface to the plurality of virtual execution elements to enable packetized communications by the plurality of virtual execution elements on a virtual network; and
instantiate a virtual router configured to:
receive a packet including a layer 2 (L2) packet header;

determine that the packet matches a first one of the packet flows that is associated with an action to redirect the packet to a firewall configured as a bump-in-the-wire;
prior to redirecting the packet to the firewall, modify a Media Access Control (MAC) address field of the L2 packet header of the packet with a flow identifier of the first one of the packet flows;
send the packet including the flow identifier to the firewall; receive the packet including the flow identifier returned from the firewall; and
in response to receiving the packet including the flow identifier returned from the firewall, perform at least one of:
determine, when the flow identifier is included in a source MAC address of the L2 packet header, a first virtual machine interface (VMI) from which the computing device received the packet from before the packet was sent to the firewall; or
determine, when the flow identifier is included in a destination MAC address of the L2 packet header, a second VMI by which the computing device sends the packet to a destination of the packet;

determine, based on determining the first VMI or the second VMI, the L2 packet header of the packet from before the packet was sent to the firewall; and
in response to determining the L2 packet header of the packet from before the packet was sent to the firewall, modify, based on the flow identifier, the packet to restore the L2 packet header of the packet from before the packet was sent to the firewall.