Application awareness in a data network with network address translation

Techniques for management of traffic in a network. The techniques provide application awareness in a Network Address Translation (NAT) system. In some examples, a first traffic is received at a first switch in a network from a first application hosted behind the first switch. The first switch identifies a first resource tag associated with the application from the first traffic. Further, the first switch identifies a first rule from the first resource tag indicating that the first traffic is to be routed through an intermediate device that performs network address translation. Moreover, the first switch transmits the traffic to an intermediate device, which perform NAT to translate the source IP address of the first traffic to a second IP address. Finally, the intermediate device sends the traffic to a destination device indicated by the first traffic.

TECHNICAL FIELD

The present disclosure relates generally to techniques for application awareness in a data network with Network Address Translation (NAT). More specifically, it is directed to extending application awareness to a classic network architecture to enable a truly distributed NAT functionality in modern data centers.

BACKGROUND

Computer networks are generally a group of computers or other devices that are communicatively connected and use one or more communication protocols to exchange data, such as by using packet switching. For instance, computer networking can refer to connected computing devices (such as laptops, desktops, servers, smartphones, and tablets) as well as an ever-expanding array of Internet-of-Things (IoT) devices (such as cameras, door locks, doorbells, refrigerators, audio/visual systems, thermostats, and various sensors) that communicate with one another. Modern-day networks deliver various types of network architectures, such as Local-Area Networks (LANs) that are in one physical location such as a building, Wide-Area Networks (WANs) that extend over a large geographic area to connect individual users or LANs, Enterprise Networks that are built for a large organization, Internet Service Provider (ISP) Networks that operate WANs to provide connectivity to individual users or enterprises, and so forth.

These networks often include specialized network devices to communicate packets representing various data from device-to-device, such as switches, routers, servers, access points, and so forth. Each of these devices is designed and configured to perform different networking functions. For instance, switches act as controllers that allow devices in a network to communicate with each other. Routers connect multiple networks together, and also connect computers on those networks to the Internet, by acting as a dispatcher in networks by analyzing data being sent across a network and choosing an optimal route for the data to travel. Access points act like amplifiers for a network and serve to extend the bandwidth provided by routers so that the network can support many devices located further distances from each other.

Computing networks have continued to become more complex, such as with the introduction of software-defined networks (SDNs). In SDNs, the management of networks is centralized at a controller or orchestrator such that the control plane is abstracted from the data forwarding functions in the discrete networking devices. The SDN orchestrator is the core element of an SDN architecture and enables centralized management and control, automation, and policy enforcement across physical and virtual network environments. Various standards or protocols have been developed for SDN architectures, such as OpenFlow, Programming Protocol-independent Packet Processors (P4), open virtual switch database (OVSDB), Python, and so forth. These SDN protocols allows the SDN controller to directly interact with the forwarding plane of network devices (such as switches and routers) using, for example, various application programming interfaces (APIs).

Traditionally, SDN controllers and switches use Network Address Translation techniques to map an unregistered IP address to a registered IP address by modifying network address information included in the IP header of incoming packets while they are in transit traffic across routing device. Before a switch or router forwards a packet, it translates the private internal network address into a globally unique address. In a NAT network, a unique IP address represents an entire group of computers. In addition, in NAT, a network device, often a router or NAT firewall, assigns a computer or computers inside a private network a public address. In this way, NAT allows the single device to act as an intermediary or agent between the local, private network and the public network that is the internet. NAT's main purpose is to conserve the number of public IP addresses in use, for both security and economic goals. In some examples, multiple networks may be assigned with their own private IP address space, while trying to access a common or shared network. In this scenarios, NAT can be used to translate the private address among these network can be to the shared network IP address.

In NAT configuration, one IP address is assigned for an entire network to the outside world, effectively hiding the entire internal network and providing additional security. NAT is typically implemented in remote-access environment, as offers the dual functions of address conservation and enhanced security.

Various challenges arise when deploying NAT in a data network. For instance, the performance bottleneck caused by the NAT traditional client-server structure brings low reliability to the data network. In some other examples, when multiple applications are hosted in the same network device, NAT session setup treats the applications with the same priority and awareness. Thus, to improve the network reliability and efficiency, there is a need for techniques and methods to provide cooperation between network devices in the NAT or multiple NAT systems. Additionally, these techniques and mechanism may enable application awareness in the NAT network. Accordingly, such mechanisms may improve the overall network performance, reliability, and user experience by improving the router performance.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

This disclosure describes techniques and mechanisms to provide application awareness in distributed Network Address Translation (NAT) configuration. Traditionally, NAT functionality maps network layer 3/layer 4 address into a different space when an IP packet traverses a router or switch. Further, this disclosure extends network layer3/layer 4 NAT to network layer 7.

This disclosure further describes a method for a network controller to manage traffic in the network. the method may be performed using control-plane techniques by the network controller component (e.g., software defined network (SDN) controller). The method may include receiving, at a first switch in a network, first traffic from a first application hosted behind the first switch. The first switch may identify from the first traffic, a first group tag associated with the application. Further, the first switch may identify, using the first group tag, a first rule indicating that the first traffic is to be routed through an intermediate device that performs network address translation. Later, the first switch may send the first traffic to the intermediate device. The intermediate device (e.g., a switch or router) may receive the first traffic at the intermediate device. Once the intermediate device receives the traffic, it translates using network address translation (NAT) at the intermediate device, a source address of the first traffic from a first IP address associated with the application to a second IP address obtained from the NAT pool at the intermediate device. Finally, the intermediate device may send the first traffic to a first destination address indicated in the first traffic.

EXAMPLE EMBODIMENTS

Computer networking has continued to evolve and become more complex in terms of how network devices are controlled or instructed to communicate data through network architectures. For instance, SDN technologies emerged, continue to evolve, and generally include using a network controller such that the network services are separated from the network devices, while automatically configuring the network services from the network devices as per the service specifications provided.

A network controller is built to manage and configure traffic at the routers and switches. It has intimate knowledge of network's configuration, architecture, infrastructure elements, users and their devices, and traffic patterns.

In some scenarios, the network may perform a Network Address Translation (NAT) protocol to manage routing and forwarding the traffic from a first network device to a second network device. If the network devices in a network are configured with NAT, a unique IP address represent an entire group of network devices, and the controller assigns the network devices (e.g., routers, switches) a private or public address. In this way, network address translation allows the single device to act as an intermediary or agent between local, private network and the public network.

NAT converses IP addresses by enabling private IP networks using unregistered IP addresses to connect to a public network. In NAT configuration, a network device (e.g., switch or router) translates the private internal network into a globally unique address. Since the NAT configuration reveals just one IP address for an entire network to an outside network, effectively hiding the entire internal network, and thus providing additional security. Additionally, NAT permits a single device, such as a router or switch to act as an intermediate device between a private network and a public network.

A common approach for NAT configuration is to have an interface on a switch or router inside a private network and another interface on a switch or router outside of the public network, and a set of rules for translating the IP packet address. In this approach, whenever a device inside the private network needs to communicate with another device outside the network or in a public network, the switch or router translates the unregistered local IP address on the private network to a registered IP address in the public network. This allows an entire group of devices to be represented by a single unique IP address when they do connect outside network. Traditional Data Center Networks thus look into only the Layer 3 and Layer 4 fields in the packets to affect this translation.

An End Point Group (EPG) includes a collection of endpoints devices (e.g., network Virtual Machine (VM)) that can have common policies. In other words, EPG uniquely maps to the different applications based on their network constructs like Virtual Local Area Network (VLAN)/Virtual Extensive LAN identifiers and IP/MAC addresses. Therefore, instead of defining the policies for a VM//network device, the policies may be defined for EPG or the application it maps into. In some scenarios that the application may be virtual and hosted in a VM server. In these scenarios, if the VM moves within the data center, the associated EPG policies may also move with it. Every EPG in an EPG group may be associated with a ‘Group TAG’ or ‘ClassID’.

In some examples, contract policy rules for a set of data nodes are described. The contract policy rules specify the communication between EPGs and a whitelist model. The whitelist may allow some identified entities to access a particular privilege, service, mobility, or recognition. The contract policy rules may be comparable to a Network Access Control List (ACL) which is an optional security for Virtual Private Cloud (VPC), and act as a firewall for controlling traffic out of or more network devices. The contract policy rules can add an additional layer of security to the VPC. Further, the contract may be applied at a more granular level between the applications and EPGs. In some examples, the EPG contract model in which the policies can move with application VM, may provide a means for optimal enforcement of the aforementioned policies

In some examples, rules are enforced when the traffic enters the data center server (e.g., client to server direction) or exits the data center (e.g., server to client). In some examples EPG policies are enforced for the forward direction traffic (e.g., client to server) or the return traffic (e.g., server to client). Further, this rule enforcement model for fabric may enable the fabric to be more intelligent, and can provide handshake techniques between switches with forward traffic and reverse traffic in the fabric. It is noted that, the rules may be enforced once in the fabric either for the forward direction traffic or the reverse direction traffic. In other words, the distributed fabric behaves as one intelligent big switch with handshake between switch which handles forward and reverse direction traffic.

In some examples, the techniques described herein includes a method for managing traffic for a set of data nodes. In some examples, a traffic may be received from a first application hosted behind a first switch. The method may identify a first group tag associated with the application. Further, the method may identify from the first group tag a first rule indicating that first traffic is to be routed through an intermediate device (e.g., another switch in the data center), which may use NAT to translate the traffic private address to a public address. Once the intermediate device translates the address, it may send the traffic to a second device. For instance, part of an application may be hosted behind a first switch and a server, and another part of the application may be hosted under a second switch. NAT may be used to translate the Layer 3 address and Layer 4 port space from the private space to the public space or vice versa. In some examples, the first switch may be enforced to be an switch handling forward direction traffic, and thus source NAT for the client to server forward direction may be performed at the first switch, while the second switch may be enforced to be node for handling reverse traffic, and destination NAT for the return direction server to client may be performed at the second switch.

Further, the techniques described herein provides a method for application-awareness traffic management. In some examples, a second traffic may be received from a second application hosted behind the second switch. The method, may identify a second group tag from the second traffic, and identify a second rule from the second group tag indicating that the second traffic is to be routed through the intermediate device which may use NAT to translate the traffic private address to the public address. Further, the method may identify from the second rule that the second application is a high priority application or a low priority application. In some examples, the method may replace the MAC address of the second traffic with a first address that is associated with the high priority traffic. In some other examples, the method may replace the MAC address of the second traffic with a second address that is associated with a low priority traffic. Lastly, the method proceeds with processing the second application based on its priority.

It is worth to mention that the same intermediated device (e.g., an intermediate switch) used to route the first traffic in the forward direction, may be used to route the second traffic in the reverse direction, since the NAT state is maintained at the intermediate device.

FIG.1illustrates a system diagram of network architecture100of a static NAT configuration in data centers. System architecture100includes a network architecture102that may include one or more data centers104, and in which destination device132utilizes a user interface to configure data nodes to perform network operations. System architecture100further illustrates a network controller120in the network architecture102deploying NAT configuration in the network architecture102. The spine switch116interconnects the switches106,108, and110to the other network devices.

In some examples, the network architecture102may include devices housed or located in one or more data centers104. The network architecture102may include one or more networks implemented by any viable communication technology, such as wired and/or wireless modalities and/or technologies. The network architecture102may include any combination of Personal Area Networks (PANs), Local Area Networks (LANs), Campus Area Networks (CANs), Metropolitan Area Networks (MANs), extranets, intranets, the Internet, short-range wireless communication networks (e.g., ZigBee, Bluetooth, etc.) Wide Area Networks (WANs)—both centralized and/or distributed—and/or any combination, permutation, and/or aggregation thereof. The network architecture102may include devices, virtual resources, or other nodes that relay packets from one network segment to another by nodes in the computer network. The network architecture102may include multiple devices that utilize the network layer (and/or session layer, transport layer, etc.) in the OSI model for packet forwarding, and/or other layers. The network architecture102may include various hardware devices, such as routers, switches, gateways, smart NICs, NICs, ASICs, FPGAs, servers, and/or any other type of device. Further, the network architecture102may include virtual resources, such as VMs, containers, and/or other virtual resources.

The one or more data centers104may be physical facilities or buildings located across geographic areas that designated to store networked devices that are part of the network architecture102. The data centers104may include various networking devices, as well as redundant or backup components and infrastructure for power supply, data communications connections, environmental controls, and various security devices. In some examples, the data centers104may include one or more virtual data centers which are a pool or collection of cloud infrastructure resources specifically designed for enterprise needs, and/or for cloud-based service provider needs. Generally, the data centers104(physical and/or virtual) may provide basic resources such as processor (CPU), memory (RAM), storage (disk), and networking (bandwidth). However, in some examples the devices in the packet-forwarding networks102may not be located in explicitly defined data centers104, but may be located in other locations or buildings.

The destination device132may establish communication connections over one or more networks130to communicate with devices in the network architecture102, such as a network controller120of the network architecture102. The network(s)130may include any viable communication technology, such as wired and/or wireless modalities and/or technologies. Networks130may include any combination of Personal Area Networks (PANs), Local Area Networks (LANs), Campus Area Networks (CANs), Metropolitan Area Networks (MANs), extranets, intranets, the Internet, short-range wireless communication networks (e.g., ZigBee, Bluetooth, etc.) Wide Area Networks (WANs)—both centralized and/or distributed—and/or any combination, permutation, and/or aggregation thereof. The destination device132may communicate using any type of protocol over the network130, such as the transmission control protocol/Internet protocol (TCP/IP) that is used to govern connects to and over the Internet.

The switches106,108,110may include one or more switches housed or located in one or more sever racks. The switches106,108,110may interconnect nodes in the network130to nodes in the network102. The switches106,108,110may be implemented in hardware and software, and may move the IP packet from the network130to the network102or vice versa. The switches106,108,110may use of a shared memory (e.g., RAM), and data buffers shared among different switches. The switches106,108,110may include a device deployable configuration including switch parameterized elements (variables) and control logic statements. The switch configuration may define the switch functionality, and enables to move the data packet between the different nodes of the network130and102. In some examples, the switch configuration may be configured via a user interface by the destination device132. In some examples, the switch configuration may be configured by the controller120.

The servers112,114housed or located in one or more sever racks manage access to the network102. In some example, the server112,114may be database servers, file servers, mail servers, print servers, web servers, game servers, and application servers. The servers112,114may provide functionality for the users and devices in the network102and130. In addition, the servers112,114may provide shared services such as sharing data or resources among multiple users of the network130,102, or performing computation for a user.

The switch106may connect a client Virtual Machine (VM)112to the spine switch116. The switch110may connect a server VM114to the spine switch116. A first EPG associated to a first application may be hosted behind switch106and client VM112, and a second EPG associated to a second application may be hosted behind switch110and server VM114. The controller120manages, configure and monitors network devices and switches (e.g., switches106,108,110). As shown, in the forward client direction the NAT may change private address 10.10.10.10 to public address 30.30.30.30 for the first; in the reverse server to client direction, the NAT may change the private address 30.30.30.30 to public address 10.10.10.10 for the second application.

At “1,” the switch106may receive a traffic from an application hosted under the VM112. A first part of the first traffic may be hosted under the switch106and client VM112; a second part of the first traffic may be hosted under the switch110and VM sever114. For instance, the client VM112may be identified by the IP address 10.10.10.10/16, and the server VM114may be identified by the IP address 20.20.20.20/24. In the forward client to server direction, the application may be identified by the source address 10.10.10.10 and the destination address 20.20.20.20. In the reverse direction server to client direction, the application may be identified by the source address 30.30.30.30 and the destination address 20.20.20.20.

At “2”, the switch106may identify a group tag from the application. The group tag may include a source tag, a source address, a destination tag, and a destination address. In some examples, the source tag may be derived from the source address, and the destination tag derived from the destination. The destination address may identify the application source private address, and may determines that private address may be required to be translated to a public address. The destination address may identify another application or another network to which the application will be routed. In some examples, the source and destination tags may be used in an ACL lookup table to find the rule indicating how traffic is routed through the intermediate device.

At “3”, once the rule is identified, the traffic may be routed from the switch106to the switch110in the forward client to server direction via the intermediate switch108. The rule may also determine the load-balancing between the switches106and110, and may also indicate the routing path from source to the destination. In some examples, the intermediate switch108may be physically be presented by the switch106. In some examples, the intermediate switch108may be physically be presented by the switch106.

At “4”, the traffic is transmitted from the switch106to the intermediate switch108according to the source address, destination address, load-balancing, and routing path determined by rule.

At “5”, the intermediate switch108receives the traffic. Upon receiving a packet from the switch106, the switch108may search the IP address of the received packet in an address translation table. If a match is found, the switch108may translate the private IP address of the traffic to a public address. Otherwise, the switch108may drop or reject the traffic.

At “6”, the switch108may establish a NAT session, and replace the Layer 3 and Layer 4 source private addresses of the traffic with the public addresses of the switch106. The switch108, may then make an entry in address translation table containing the private and public IP addresses. Thus, subsequent packets from the switch106, may be translated to the same public address.

At “7”, the switch108may transmit the traffic to the switch110. Upon receiving the traffic at the switch108, the switch108may search an address table to determine if incoming traffic address and port number is valid. If the IP and port number of traffic is valid, the traffic is forwarded to the server VM114.

It is appreciated that in the forward client to server direction described above, the switch106acts a node handling forward direction traffic. In reverse direction the switch110acts as a node for handling reverse direction traffic. Similar to the process described above for the forward direction, in the reverse direction the traffic is routed from switch110to the switch106via the intermediate device108. However, the forward direction Source NAT (SNAT) may be more straightforward than the reverse direction Destination NAT (DNAT), because only source IP address of the traffic is changed, and routing the traffic within the fabric switches is not hindered. In the reverse direction, since the return traffic destination IP address is not DNAT-ed in layer three, the fabric switches cannot route the traffic. As shown, in the reverse direction the source public address 30.30.30 will be translated to the private address 10.10.10.10, and the packet is routed from the server VM114to the client VM112via switch108.

In some examples, the process described above may be implemented by hardware and software agnostic model, where reliance on hardware or a specific platform is not required. A hardware-agnostic system may not require any modifications to run on a variety of network devices. Thus, hardware agnostic design brings about a high level of compatibility across most common network devices which is suitable for a brownfield environment.

FIG.2illustrates a system diagram of network architecture of a distributed NAT configuration in data centers with endpoint mobility. System architecture200includes switches206,208, and210. The switch206is connected with the client VM112, and the switch210is connected with the VM114. System architecture200further illustrates a spine switch116in the network architecture interconnects the switches206,208, and210to the other network devices.

The switches206,208,210may include one or more switches housed or located in one or more sever racks. The switches206,208,210may interconnect nodes in the network130to nodes in the network102. The switches206,208,210may be implemented in hardware and software, and may move the IP packet from the network130to the network102or vice versa. The switches206,208,210may use of a shared memory (e.g., RAM), and data buffers shared among different switches. The switches206,208,210may include a device deployable configuration including switch parameterized elements (variables) and control logic statements. The switch configuration may define the switch functionality, and enables to move the data packet between the different nodes of the network130and102. In some examples, the switch configuration may be configured via a user interface by the destination device132. In some examples, the switch configuration may be configured by the controller120.

In some examples, when many applications will be hosted behinds VMS (e.g., modern data centers), virtual workload migration within the data centers may be required to be handled. For example, VM112ofFIG.1hosted behind switch106, may move to be hosted behind the switch206ofFIG.2. In some examples, it may be required that when the VM moves from being hosted behind one switch to another switch, the processing of the existing application running behind the VM will not be halted. However, as shown, this may not be feasible with NAT, since the switch208may not have the dynamic NAT session 10.10.10.10/1000 to 30.30.30.30/5000 setup in the switch206. Thus, control plane may be involved to distribute this session, which can increase software cost and consumes hardware resources. As illustrated, the switch208may be enforced as a switch for handling forward direction traffic, and the switch210may be enforced as a switch for handling reverse direction traffic. As illustrated, the private layer three address 10.10.10.10 may be mapped to the public address 30.30.30.30 in the forward client to server direction in the switch308. Also, the layer four source port may be mapped from 1000 to 5000 in the forward client to server direction in the switch308. In some examples, the NAT session may be set up dynamically in a context local to the switch206.

FIG.3illustrates a system diagram of network architecture of a distributed NAT configuration in forward direction. System architecture300includes switches306,308, and310. The switches306is connected with the client VM112, and the switch310is connected with the VM114. System architecture300further illustrates a spine switch116in the network architecture, which interconnects the switches306,308, and310to the other network devices.

The switches306,308,310may include one or more switches housed or located in one or more sever racks. The switches306,308,310may interconnect nodes in the network130to nodes in the network102. The switches306,308,310may be implemented in hardware and software, and may move the IP packet from the network130to the network102or vice versa. The switches306,308,310may use of a shared memory (e.g., RAM), and data buffers shared among different switches. The switches306,308,310may include a device deployable configuration including switch parameterized elements (variables) and control logic statements. The switch configuration may define the switch functionality, and enables to move the data packet between the different nodes of the network130and102. In some examples, the switch configuration may be configured via a user interface by the device132. In some examples, the switch configuration may be configured by the controller120.

In some examples, some of switches in a fabric (e.g., switch306,308,310) may be assigned to have double roles of being a service leaf and a switch in addition to their regular workload handling. For instance, the switches306and308may be selected to have double roles as service leaves, where the NAT pool address being split amongst themselves. As illustrated, switch306and308will have the same global address 30.30.30.30, while the four ports31K-61K are assigned to the switch306, and the ports1K-31K are assigned to switch308.

In some examples, the traffic received at the switch associated to an application, may include: (i) A source tag identifying the application or EPG requiring source address translation. (ii) A rule indicating that the traffic may be routed through the switch308. (iii) A destination tag indicating another application in another Virtual Routing and Forwarding (VRF) the application is communicating with (iv) Additional layer four parameters such as Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) specific ports.

Example rule312shows an example of the SNAT of the receiving traffic associated to an application. In this example, the traffic designated for the SNAT may distribute its load between switches306, and308, and may be serviced at the switch308. Once the forward direction traffic client to server traffic is received at the switch308, the NAT session may be established, and the SNAT can be effected by changing the layer three source address 10.10.10.10 to 30.30.30.30, and layer four source port from 1000 to 5000.

FIG.4illustrates a flow diagram of an example method for a network controller component to determine configuration changes in the configuration of the network devices and update configuration of the network devices. System architecture400includes switches406,408, and410. The switch406is connected with the client VM112, and the switch410is connected with the VM114. System architecture400further illustrates a spine switch116in the network architecture interconnects the switches406,408, and410to the other network devices.

The switches406,408,410may include one or more switches housed or located in one or more sever racks. The switches406,408,410may interconnect nodes in the network130to nodes in the network102. The switches406,408,410may be implemented in hardware and software, and may move the IP packet from the network130to the network102or vice versa. The switches406,408,410may use of a shared memory (e.g., RAM), and data buffers shared among different switches. The switches406,408,410may include a device deployable configuration including switch parameterized elements (variables) and control logic statements. The switch configuration may define the switch functionality, and enables to move the data packet between the different nodes of the network130and102. In some examples, the switch configuration may be configured via a user interface by the device132.

In some examples, the service switch410may be set up the NAT session for forward client to server traffic, and may install the reverse direction session to handle the return direction server to client traffic. For example, the reverse session for performing DNAT in the switch410can be presented as:

Layer 3 destination address 30.30.30.30, and layer four destination port5000may be mapped to Layer three destination address 10.10.10.10, and layer four destination port1000.

In order to route the traffic to the switch410, the switch410may be enforced as a switch with reverse direction traffic. Additionally, the traffic received at the switch associated to an application, may include: (i) A source tag identifying the application or EPG requiring source address translation. (ii) One or more rules indicating that the traffic may be routed through the switch408. (iii) A destination tag indicating another application in another Virtual Routing and Forwarding (VRF) the application is communicating with (iii) Additional layer four parameters such as Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) specific ports.

Rule412shows an example of the DNAT of the receiving traffic associated to an application. The rules R10, and R11illustrated in 412 determine how the traffic may be routed from the switch410to the switch408. For instance, the rule R10may match NAT pool assigned to the service switch408, i.e. 30.30.30.30/32, layer four ports1k-31k. Similarly, the rule R11may match the NAT pool configuration for the switch406. When the return server to client traffic arrives the switch410, the rule R10may match, and thus this traffic may be redirected to switch408, which may map change the DNAT of Layer 3 address from 30.30.30.30 to 10.10.10.10, and the layer four destination port from 5000 to 10000. Once the traffic is received at the switch408, the switch408may use a lookup table to send the traffic to the switch406.

It is noted that since the switch408performs both the forward direction and reverse direction, there may not be any need to synchronize the states outside of the switch. This in turn may reduce the complexity of the distributed solution. In addition, the VM114may be moved from behind switch408to behind switch410. The following items are the key factors that provide VM114mobility: (i) NAT-ing may not be affected in the switch406or switch410, but rather it may be performed in the third switch408, and it may be performed by the contract rules which may be installed in the switches406and408. (ii) If the VM or endpoint which belongs to the application or EPG which needs NAT-ing moves to another switch in the fabric, the contract rules (e.g., R1ofFIG.3) may also be moved to this switch. This in turn may move the traffic to the service switch410for SNAT-ing. (iii) In the reverse direction, the NAT pool may dictate where to send the traffic for DNAT-ing, and hence if the server VM belongs to the destination application or EPG which moves to another switch in the fabric, the related rules (e.g., R10& R1) may also move to this switch, and may send the traffic back to the service switch408for DNAT-ing.

In some examples the application may be categorized as business critical which are given the highest priority within data centers or other applications which are given lower priority. When a business critical (crown jewel) application is hosted with a regular application under the same subnet, and this subnet may need NAT-ing to communicate to another network, the techniques described above may be used to prioritize the business casual application, and NAT configuration may be performed as

(i) The switch406may pass some additional parameters included in the rule R1ofFIG.4, since the R1can clearly identify the source application as a crown jewel application/EPG.

(ii) The switch406may rewrite the layer two address destination mac address for client to server traffic to MAC1for higher priority applications EPGs and MAC2for other applications

(iii) The service switch408, may interpret the layer 2 destination mac address to decide to affect the NAT session setup.

In some examples, the service switch408may use an intelligent NAT session set up for configuring the switches. For examples, a heuristics approach may be used which may contains the following steps:

(i) If only 90% of available address/ports are used, fail NAT identified session may be requested for regular application, while the set up may be continued for crown-jewel applications. This can increase a guaranteed behavior in dynamic NAT for higher priority application.

(ii) If the 99% of available NAT address/ports are used, the switch408may run a timer to tear down sessions established for regular applications. This may be anticipated since a higher priority application may need an address/port to be processed.

(iii) Different sessions tear down timer may be required for different applications. Specifically, a higher timer may be used for higher priority application, and a lower aggress timer may be used for regular applications/EPGS.

FIG.5illustrates a component diagram of an example an example network switch501(e.g.,106,108,110,206,208,210,306,308,310,406,408,410,) that can be utilized to implement aspects the technologies disclosed herein. The switch501may be any type of computing device capable of receiving expressions of fabric configuration parameterization via device132and sending data to the network130via a suitable data communications network device such as, but not limited to, a laptop or desktop computer, a tablet computing device, a server computer, a television, or a mobile telephone.

As illustrated, the controller501may include one or more hardware processors502(processors), one or more devices, configured to execute one or more stored instructions. The processor(s)502may comprise one or more cores. Further, the switch501may include one or more network interfaces504configured to provide communications between the switch501and/or other systems or devices in the network architecture102and/or remote from the network architecture102. The network interfaces504may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), and so forth. For example, the network interfaces504may include devices compatible with Ethernet, Wi-Fi, and so forth.

The switch501can include one or more power supplies503, such as one or more batteries, connections to mains power, etc. The switch501can also include one or more inputs and outputs508for receiving and processing input from a number of input devices, such as a keyboard, a mouse, a touchpad, a touch screen, an electronic stylus, or other type of input device. Further, the input/outputs508can include a display, such as a computer monitor, a flat-panel display, a digital projector, a printer, or other type of output device. It will be appreciated that the user device controller501might not include all of the components shown inFIG.5, can include other components that are not explicitly shown inFIG.6, or might utilize an architecture completely different than that shown inFIG.6.

The switch501may also include memory506, such as computer-readable media, that stores various executable components (e.g., software-based components, firmware-based components, etc.). The memory506may generally store components to implement functionality described herein. The memory506may store an operating system510utilized to control the operation of components of the switch501. Further, the memory506may store a communication component518that comprises software (e.g., any protocol stack) to enable the switch501to communicate with other devices using the network interface504.

In some examples, the memory506may store a configuration-read component configured to enable the switch501to obtain the fabric configurations data. The fabric configuration data may include configuration data of fabric representing the switches functionality such as hardware settings, protocols, network service, accessibility, port configuration, etc. Additionally, the configuration data of each switch may represent the policies and rules of the switches. The read component may comprise a human readable code or binary machine code, when executed on the processor502, may enable the switch501to access switches configuration, and obtain the switches configurations data via the network interface504.

In some examples, the memory506may store a tag identifier component512configured to enable identify the group tag from the traffic arrived at the switch501. The tag identifier component comprises a human readable code or binary machine code, when executed on the processor502, may enable the switch501to identify group tag in the traffic associated to the application running on the switch501.

In some examples, the memory506may store an address translator component614configured to translate the private address of the incoming traffic at the switch501to a public address. The address translator component may comprise a human readable code or binary machine code, when executed on the processor502, may enable the switch501to establish a NAT session at switches (e.g.,10,108,110), and translate the private address and port number of the application related to the traffic to a public address. The NAT session may include a set of rules and look up tables specifying switches accessibility, private addresses, port numbers, public addresses, etc.

In some example, the memory506may store a rule identifier component515configured to identify from the incoming traffic at the switch501a rule indicating that how the traffic is to be routed the network. The rule identifier component may comprise a human readable code or binary machine code, when executed on the processor502, may enable the controller501to identify the rule from the traffic associated to an application running behind switch501, and route the traffic to the destination according to the rule. The rule identifier component515may include a source tag, destination tag, and some additional parameters indicating the routing path and parameters required to route the packet.

The switch501may further include a data store516, which may comprise any type of computer memory including long-term memory (e.g., Read Only Memory (ROM), Random Access Memory (RAM), caches, etc.). The data store516may include an EPG policies component520that includes a set of rules that are common in a set of endpoints devices such as NAT settings, NAT lookup tables, settings on hardware, protocols and network services, initially configured at the EPG or switch501. The data store516may include a contract policies component that includes policy rules that specify how an EPG communicates with whitelist models and other network devices. Further, the data store516, may include an forward/reverse traffic policies component that include policy rules enforced at the switches with VM mobility.

FIG.6illustrates a flow diagram of an example method for processing applications hosted in a network switch in a distributed NAT configuration.

At step602, a first switch may receive a first traffic. The first traffic may be associated to an application or EPG hosted behind the first switch. In some example the traffic may be client to server forward traffic, and the first switch may be enforced as an ingress switch.

At step604, the first switch may identify from the first traffic, a group tag associated with application. The group tag may be included in the first IP packet header carrying the traffic, and includes routing information for the traffic.

At step606, the first switch may identify a rule indicating that the first traffic is to be routed through an intermediate device that performs NAT. The rule may indicate the traffic path, where the NAT need to be performed, and a how to translate the private address to a public address, and which device the application wants to communicate.

At step608, the first switch may send the first traffic to the intermediate device based on the rule.

At step610, the intermediate device receives the first traffic from the first switch.

At step612, the network translates a source address of the first traffic from the first IP address associated with application to second IP address associated with the intermediate device. The first IP address can be private address in the local network architecture, and the second IP address can be a private address in another network. The first switch may use a lookup table to perform NAT. If it finds a match for the first IP address in the look up table, it may forward the packet, and if it cannot find a match it may reject the packet.

FIG.7shows an example computer architecture for a device capable of executing program components for implementing the functionality described above. The computer architecture shown inFIG.7illustrates any type of computer700, such as a conventional server computer, workstation, desktop computer, laptop, tablet, network appliance, e-reader, smartphone, or other computing device, and can be utilized to execute any of the software components presented herein. The computer700may, in some examples, correspond to a network switch116, and/or any other device described herein, and may comprise personal devices (e.g., smartphones, tables, wearable devices, laptop devices, etc.) networked devices such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, and/or any other type of computing device that may be running any type of software and/or virtualization technology.

The computer700includes a baseboard702, or “motherboard,” which is a printed circuit board to which a multitude of components or devices can be connected by way of a system bus or other electrical communication paths. In one illustrative configuration, one or more central processing units (“CPUs”)704operate in conjunction with a chipset706. The CPUs704can be standard programmable processors that perform arithmetic and logical operations necessary for the operation of the computer700.

The chipset706provides an interface between the CPUs704and the remainder of the components and devices on the baseboard702. The chipset706can provide an interface to a RAM708, used as the main memory in the computer700. The chipset706can further provide an interface to a computer-readable storage medium such as a read-only memory (“ROM”)710or non-volatile RAM (“NVRAM”) for storing basic routines that help to startup the computer700and to transfer information between the various components and devices. The ROM710or NVRAM can also store other software components necessary for the operation of the computer700in accordance with the configurations described herein.

The computer700can operate in a networked environment using logical connections to remote computing devices and computer systems through a network, such as the network130. The chipset706can include functionality for providing network connectivity through a NIC712, such as a gigabit Ethernet adapter. The NIC712is capable of connecting the computer700to other computing devices over the network130. It should be appreciated that multiple NICs712can be present in the computer700, connecting the computer to other types of networks and remote computer systems.

The computer700can be connected to a storage device714that provides non-volatile storage for the computer. The storage device714can store an operating system720, programs722, and data, which have been described in greater detail herein. The storage device718can be connected to the computer700through a storage controller714connected to the chipset706. The storage device718can consist of one or more physical storage units. The storage controller714can interface with the physical storage units through a serial attached SCSI (“SAS”) interface, a serial advanced technology attachment (“SATA”) interface, a fiber channel (“FC”) interface, or other type of interface for physically connecting and transferring data between computers and physical storage units.

In addition to the mass storage device718described above, the computer700can have access to other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. It should be appreciated by those skilled in the art that computer-readable storage media is any available media that provides for the non-transitory storage of data and that can be accessed by the computer700. In some examples, spine switch116, and or any components included therein, may be supported by one or more devices similar to computer700. Stated otherwise, some or all of the operations spine switch116, and or any components included therein, may be performed by one or more computer devices700.

As mentioned briefly above, the storage device718can store an operating system720utilized to control the operation of the computer700. According to one embodiment, the operating system comprises the LINUX operating system. According to another embodiment, the operating system comprises the WINDOWS® SERVER operating system from MICROSOFT Corporation of Redmond, Washington According to further embodiments, the operating system can comprise the UNIX operating system or one of its variants. It should be appreciated that other operating systems can also be utilized. The storage device718can store other system or application programs and data utilized by the computer700.

In one embodiment, the storage device718or other computer-readable storage media is encoded with computer-executable instructions which, when loaded into the computer800, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the embodiments described herein. These computer-executable instructions transform the computer700by specifying how the CPUs704transition between states, as described above. According to one embodiment, the computer700has access to computer-readable storage media storing computer-executable instructions which, when executed by the computer700, perform the various processes described above with regard toFIGS.1-6. The computer700can also include computer-readable storage media having instructions stored thereupon for performing any of the other computer-implemented operations described herein.

The computer700can also include one or more input/output controllers816for receiving and processing input from a number of input devices, such as a keyboard, a mouse, a touchpad, a touch screen, an electronic stylus, or other type of input device. Similarly, an input/output controller716can provide output to a display, such as a computer monitor, a flat-panel display, a digital projector, a printer, or other type of output device. It will be appreciated that the computer700might not include all the components shown inFIGS.1-6, can include other components that are not explicitly shown inFIG.7, or might utilize an architecture completely different than that shown inFIG.7.

As described herein, the computer700may comprise a spine switch116, and/or any other device. The computer700may include one or more hardware processors704(processors) configured to execute one or more stored instructions. The processor(s)704may comprise one or more cores. Further, the computer700may include one or more network interfaces configured to provide communications between the computer700and other devices, such as the communications described herein as being performed spine switch116. The network interfaces may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), and so forth. For example, the network interfaces may include devices compatible with Ethernet, Wi-Fi™, and so forth.

The programs722may comprise any type of programs or processes to perform the techniques described in this disclosure for performing NAT configuration in a fabric or endpoint devices in a local or public network.