Patent ID: 12218839

Like reference characters refer to like elements throughout the figures and description.

DETAILED DESCRIPTION

FIG.1is a block diagram illustrating an example computer network system2in accordance with the techniques of the disclosure. In the example ofFIG.1, computer network system2includes service provider networks150A-150D (collectively, “service provider networks150”) configured to provide Wide Area Network (WAN) connectivity to disparate customer networks140A-140B (collectively, “customer networks140”). Routers110A-110I (collectively, “routers110”) of service provider networks150provide client devices100A-100B (collectively, “client devices100”) associated with customer networks140with access to service provider networks150. While the example ofFIG.1is described with respect to routers110, in other examples, network devices of other types, such as switches, routers, gateways, or other suitable network devices that may send and receive network traffic, may perform the operations described herein with respect to routers110.

In some examples, customer networks140are enterprise networks. Customer network140A is depicted as having a single client device100A and customer network140B is depicted as having a single client device100B for ease of illustration, but each of customer networks140may include any number of client devices. Typically, customer networks140include many client devices100, each of which may communicate across service provider networks150with one another as described in more detail below. Communication links16A-16G (collectively, links “16”) may be Ethernet, ATM or any other suitable network connections.

Routers110are illustrated as routers in the example ofFIG.1. However, techniques of the disclosure may be implemented using any network device, such as switches, routers, gateways, or other suitable network devices that may send and receive network traffic. Customer networks140may be networks for geographically separated sites of an enterprise, for example. Each of customer networks140may include additional customer equipment, such as, one or more non-edge switches, routers, hubs, gateways, security devices such as firewalls, intrusion detection, and/or intrusion prevention devices, servers, computer terminals, laptops, printers, databases, wireless mobile devices such as cellular phones or personal digital assistants, wireless access points, bridges, cable modems, application accelerators, or other routers not depicted inFIG.1. The configuration of computer network system2illustrated inFIG.1is merely an example. For example, computer network system2may include any number of customer networks140. Nonetheless, for ease of description, only customer networks140A-140B are illustrated inFIG.1.

Service provider networks150represent one or more publicly accessible computer networks that are owned and operated by one or more service providers. Although computer network system2is illustrated in the example ofFIG.1as including multiple interconnected service provider networks150, in other examples computer network system2may alternatively include a single service provider network that provides connectivity between customer networks140. A service provider is usually a large telecommunications entity or corporation. Each of service provider networks150is usually a large L3 computer network. Each service provider network150is an L3 network in the sense that it natively supports L3 operations as described in the OSI model. Common L3 operations include those performed in accordance with L3 protocols, such as the Internet Protocol (IP). L3 is also known as a “network layer” in the OSI model and the term L3 may be used interchangeably with the phrase “network layer” throughout this disclosure.

Although not illustrated, each service provider network150may be coupled to one or more networks administered by other providers, and may thus form part of a large-scale public network infrastructure, e.g., the Internet. Consequently, customer networks140may be viewed as edge networks of the Internet. Each service provider network150may provide computing devices within customer networks140, such as client devices100, with access to the Internet, and may allow the computing devices within customer networks140to communicate with each other.

Although additional routers are not shown for ease of explanation, it should be understood that system2may comprise additional network and/or computing devices such as, for example, one or more additional switches, routers, hubs, gateways, security devices such as firewalls, intrusion detection, and/or intrusion prevention devices, servers, computer terminals, laptops, printers, databases, wireless mobile devices such as cellular phones or personal digital assistants, wireless access points, bridges, cable modems, application accelerators, or other routers. Moreover, although the elements of system2are illustrated as being directly coupled, it should be understood that one or more additional network elements may be included along any of network links16, such that the network elements of system2are not directly coupled.

Each service provider network150typically provides a number of residential and business services for customer networks140, including residential and business class data services (which are often referred to as “Internet services” in that these data services permit access to the collection of publicly accessible networks referred to as the Internet), residential and business class telephone and/or voice services, and residential and business class television services.

In some examples, network service instances104A-104N (collectively, “network service instances104”) may apply one or more network services to traffic of client devices100. Each network service instance104may be, e.g., a virtualized network service instantiated by a virtual machine executed by processing circuitry of a server. In some examples, network service instances104A are a plurality of firewall instances that provide stateful firewall services to traffic of client devices100. In some examples, network service instances104A are a plurality of deep packet inspection instances that provide deep packet inspection services to traffic of client devices100.

Session-Based Routing

In some examples, routers110may implement a stateful, session-based routing scheme that enables each router110to independently perform path selection and traffic engineering. The use of session-based routing may enable routers110to eschew the use of a centralized controller, such as a Software-Defined Networking (SDN) controller to perform path selection and traffic engineering. In this way, routers110may be more efficient and scalable for large networks where the use of an SDN controller would be infeasible. Furthermore, the use of session-based routing may enable routers110to eschew the use of tunnels, thereby saving considerable network resources by obviating the need to perform encapsulation and decapsulation at tunnel endpoints. In some examples, routers110implement session-based routing as Secure Vector Routing (SVR), provided by Juniper Networks, Inc.

In the example ofFIG.1, client device100A of system2establishes session40with client device100B. Routers110facilitate establishment of session40by transporting network traffic between client device100A and client device100B. In some examples, client device100A may be considered a “source” device and client device100B may be considered a “destination device” in that client device100A originates session40between client device100A and client device100B, e.g., client device100A is the “source” of a packet of a forward packet flow of the session while client device100B is the “destination” of the packet of the forward packet flow of the session. Client device100A may be referred to as a “source device” and client device100B may be referred to as a “destination device” through the disclosure. Session40includes a forward packet flow originating from client device100A and destined for client device100B and a reverse packet flow originating from client device100B and destined for client device100A. A forward packet flow for session40traverses a first path including, e.g., client device100A, routers110A-110I, and client device100B. As described in more detail below, routers110enable the exchange of traffic between customer network140A, across service provider networks150, to customer network140B.

Client device100A (e.g., a source device) may establish session40with client device100B (e.g., a destination device) according to one or more L2 or L3 communication session protocols, including Ethernet, TCP, or UDP. As described in more detail below, customer network140A may form a first network and customer network140B may form a second network. Routers110operate to extend customer network140A across service provider networks150to customer network140B. In this fashion, customer network140A and customer network140B may operate as if they were both part of the same network, even though customer network140A and customer network140B may be logically isolated and geographically separate from one another. Furthermore, routers110may operate such that the existence of service provider networks150between customer network140A and customer network140B is transparent to client devices100.

In some examples, routers110may extend session40across service provider networks150according to one or more communication session protocols, including TCP or UDP, etc. For example, to establish session40according to TCP such that data may be exchanged according to TCP, router110A and router110B perform a three-way handshake. Router110A sends a first packet comprising a “SYN” flag to router110B. Router110B acknowledges receipt of the first packet by responding to router110A with a second packet comprising a “SYN-ACK” flag. Router110A acknowledges receipt of the second packet by responding to router110B with a third packet comprising an “ACK” flag. After sending the third packet, session40is established according to TCP and routers110A,110B may exchange data with one another (e.g., by exchanging data packets of client device100A and client device100B) via session40. Additional example information regarding TCP is described in “TRANSMISSION CONTROL PROTOCOL,” Request for Comments (RFC) 793, Internet Engineering Task Force (IETF), September 1981, available at https://tools.ietf.org/html/rfc793, the entire contents of which are incorporated herein by reference.

UDP is a connectionless protocol in that router110A does not verify that router110B is capable of receiving data prior to transmitting data. To establish session40according to UDP, router110A transmits a first packet to router110B. Session40may be considered “established” according to UDP upon receipt by router110A of any packet from router110B, which implies that router110B successfully received the first packet from router110A, responded, and router110A was able to receive the response from router110B. Additional example information regarding UDP is described in “User Datagram Protocol,” RFC 768, IETF, Aug. 28, 1980, available at https://tools.ietf.org/html/rfc768, the entire contents of which are incorporated herein by reference.

In the example ofFIG.1, when router110A receives a packet for the forward packet flow originating from client device100A and destined for client device100B, router110A determines whether the packet belongs to a new session (e.g., is the “first” packet or “lead” packet of session40). In some examples, router110A determines whether a source address, source port, destination address, destination port, and protocol of the first packet matches an entry in a session table.

If no such entry exists, router110A determines that the packet belongs to a new session and creates an entry in the session table. Furthermore, if the packet belongs to a new session, router110A may generate a session identifier for session40. The session identifier may comprise, e.g., a source address and source port of client device100A, a destination address and destination port of client device100B, and a protocol used by the first packet. Router110A may use the session identifier to identify subsequent packets as belonging to the same session.

In some examples, routers110perform stateful routing for session40. For example, routers110may forward each packet of the forward packet flow of session40sequentially and along the same forward network path. As described herein, the “same” forward path may mean the same routers110that form a segment or at least a portion between a device originating the packet and a device to which the packet is destined (and not necessarily the entire network path between the device originating the packet and the device to which the packet is destined). Further, routers110forward each packet of the return flow of session40sequentially and along the same return network path. The forward network path for the forward packet flow of session40and the return network path of the return packet flow of session40may be the same path, or different paths. By ensuring that each packet of a flow is forwarded sequentially and along the same path, routers110maintain the state of the entire flow at each router110, thereby enabling the use of stateful packet services, such as Deep Packet Inspection (DPI) or stateful firewall services.

In the example ofFIG.1, a stateful routing session may be established from ingress router110A through intermediate routers110B-110H to egress router110I. In this example, router110A determines that the first packet is an unmodified packet and the first packet of new session40. Router110A modifies the first packet to include metadata specifying the session identifier (e.g., the original source address, source port, destination address, and destination port). Router110A replaces the header of the modified first packet to specify a source address that is an address of router110A, a source port that is a port via which router110A forwards the modified first packet toward client device100B, a destination address that is an address of the next hop to which router110A forwards the first packet (e.g., an address of router110B), and a destination port that is a port of the next hop to which router110A forwards the first packet (e.g., a port of router110B).

Router110A may further identify a network service associated with session40. For example, router110A may compare one or more of a source address, source port, destination address, or destination port for the session to a table of service address and port information to identify a service associated with the session. Examples of network services include Hypertext Transfer Protocol (HTTP), a firewall service, a proxy service, packet monitoring or metrics services, etc. For example, router110A may determine that the forward packet flow of session40specifies a destination address and destination port assigned to client device100B. Router110A may thereafter store an association between session40with the identified network service. As another example, if the source port and/or destination port for session40is80, router110A may determine that session40is associated with an HTTP service. In other examples, router110A may determine that one or more of a source address, source port, destination address, or destination port for session40belong to a block of address or ports indicative that a particular service is associated with session40.

In some examples, router110A uses the determined network service for session40to select a forward path for forwarding the first packet and each subsequent packet of the forward packet flow of session40toward client device100B. In this fashion, router110A may perform service-specific path selection to select a network path that best suits the requirements of the service. In contrast to a network topology that uses an SDN controller to perform path selection, each router110performs path selection. Further, the use of session-based routing enables each router110to make routing decisions at the service- or application-level, in contrast to conventional routers that are only able to make routing decisions at the flow level.

Router110A forwards the modified first packet to router110B. Additionally, router110A stores the session identifier for session40such that, upon receiving subsequent packets for session40, router110A may identify the subsequent packets as belonging to the same session40and forward the subsequent packets along the same path as the first packet.

Intermediate router110B receives the modified first packet and determines whether the modified first packet includes metadata specifying the session identifier. In response to determining that the modified first packet includes metadata specifying the session identifier, intermediate router110B determines that router110B is not an ingress device such that router110B does not attach metadata specifying the session identifier.

As described above with respect to router110A, router110B determines whether the packet belongs to a new session (e.g., is the “first” packet or “lead” packet of the session) by determining whether a source address, source port, destination address, destination port, and protocol of the first packet matches an entry in a session table. If no such entry exists, router110B determines that the packet belongs to a new session and creates an entry in the session table. Furthermore, if the packet belongs to a new session, router110B generates a session identifier for the session. The session identifier used by router110B to identify the session for the first packet may be different from the session identifier used by router110A to identify the same session for the first packet, because each router110A,110B uses the header source address, source port, destination address, and destination port of the first packet to generate the session identifier, and this header information may be modified by each preceding router110as each router110forwards the first packet along the forward path. Furthermore, each router110may store this header information to identify a previous router110(or “waypoint”) and a next router110(or “waypoint”) such that each router110may reconstruct the same forward path and reverse path for each subsequent packet of the session.

Router110B replaces the header of the modified first packet to specify a source address that is an address of router110B, a source port that is a port via which router110B forwards the modified first packet toward client device100B, a destination address that is an address of the next hop to which router110B forwards the first packet (e.g., an address of router110C for session40along the first path), and a destination port that is a port of the next hop to which router110B forwards the first packet (e.g., a port of router110C). Router110B forwards the modified first packet to router110C. Additionally, router110B stores the session identifier for the session such that, upon receiving subsequent packets for the session, router110B may identify subsequent packets as belonging to the same session and forward the subsequent packets along the same path as the first packet.

Subsequent intermediate routers110C-110H process the modified first packet in a similar fashion as routers110A and110B such that routers110forward the subsequent packets of the session along the same path as the first packet. Further, each router110stores a session identifier for the session, which may include an identification of the previous router110along the network path. Thus, each router110may use the session identifier to forward packets of the reverse packet flow for the session along the same network path back to client device100.

A router110that may forward packets for a forward packet flow of the session to a destination for the packet flow is an egress, or “terminus” router. In the foregoing example, router110I is a terminus router because router110I may forward packets to client device100B. Router110I receives the modified first packet that comprises the metadata specifying the session identifier (e.g., the original source address, source port, destination address, and destination port). Router110I identifies the modified first packet as destined for a service terminating at router110I by determining that the destination source address and destination source port specified in the metadata of the modified lead packet corresponds to a destination reachable by router110I (e.g., client device100B). Router110I recovers the original first packet by removing the metadata from the modified first packet and using the metadata to modify the header of the first packet to specify the original source address, source port, destination address, and destination port. Router110I forwards the recovered first packet to client device100B. The use of session-based routing may therefore form a series of waypoints (e.g., routers110) interconnected by path “segments” (e.g., end-to-end route vectors between each waypoint).

Additional information with respect to session-based routing and SVR is described in U.S. Pat. No. 9,729,439, entitled “COMPUTER NETWORK PACKET FLOW CONTROLLER,” and issued on Aug. 8, 2017; U.S. Pat. No. 9,729,682, entitled “NETWORK DEVICE AND METHOD FOR PROCESSING A SESSION USING A PACKET SIGNATURE,” and issued on Aug. 8, 2017; U.S. Pat. No. 9,762,485, entitled “NETWORK PACKET FLOW CONTROLLER WITH EXTENDED SESSION MANAGEMENT,” and issued on Sep. 12, 2017; U.S. Pat. No. 9,871,748, entitled “ROUTER WITH OPTIMIZED STATISTICAL FUNCTIONALITY,” and issued on Jan. 16, 2018; U.S. Pat. No. 9,985,883, entitled “NAME-BASED ROUTING SYSTEM AND METHOD,” and issued on May 29, 2018; U.S. Pat. No. 10,200,264, entitled “LINK STATUS MONITORING BASED ON PACKET LOSS DETECTION,” and issued on Feb. 5, 2019; U.S. Pat. No. 10,277,506, entitled “STATEFUL LOAD BALANCING IN A STATELESS NETWORK,” and issued on Apr. 30, 2019; U.S. Pat. No. 10,432,522, entitled “NETWORK PACKET FLOW CONTROLLER WITH EXTENDED SESSION MANAGEMENT,” and issued on Oct. 1, 2019; and U.S. Patent Application Publication No. 2020/0403890, entitled “IN-LINE PERFORMANCE MONITORING,” published on Dec. 24, 2020, the entire content of each of which is incorporated herein by reference in its entirety.

Exchanging Service and Topology State Information

In some examples, to implement session-based routing, each router110maintains a local repository of service and topology state information for each other router110. The service and topology state information includes services reachable from each router110, as well as a network topology from each router for reaching these services. Each router110may transmit changes in the services reachable from the router110and/or changes in the network topology for reaching the services from the router to a central repository, e.g., a server. Further, each router110may receive service and topology state information for each other router110in system2from the central repository.

In the foregoing example, router110A receives a packet, determines session40for the forward packet flow comprising the packet, determines a service associated with session40, and selects a network path for forwarding the packet. Router110A may use its local copy of the service and topology state information for each router110to select the network path for forwarding the packet. For example, router110A may use the identified service associated with the packet and a network topology for reaching the identified service to select a network path that comports with an SLA requirement or other session performance requirements for the service. Router110A may then forward the packet and subsequent packets for the forward packet flow of session40along the selected path. In this fashion, router110A may perform service-specific path selection in that router110may use criteria specific to the service associated with the packet to select a network path that best suits the requirements of the service.

In some examples, interfaces of routers110may be assigned to one or more “neighborhoods.” A “neighborhood” is defined as a label applied to an interface of a router110. The routers110within the same neighborhood are capable of forming a peering relationship with one another. For example, each router110having an interface to which a neighborhood label is applied is reachable over a Layer-3 network to each other router110having an interface to which the same neighborhood label is applied. In some examples, one or more neighborhoods may be aggregated into a “district.” A district is a logical grouping of one or more neighborhoods. Typically, an Autonomous System (AS) (also referred to herein as an “Authority”) may be divided into one or more districts, each district including one or more neighborhoods.

In some examples, each router110maintains a local repository of service and topology state information only for those other routers110within the same neighborhood. In some examples, each router110maintains a local repository of service and topology state information only for those other routers110within the same district of neighborhoods. As an example, each service provider network150may be considered to be a different “district,” wherein each subdomain within each service provider network150may be considered to be a neighborhood within that district. In this example, each router110A and110B within service provider network150A may maintain service and topology state information only for one another, and not for routers110C-110I. Similarly, each router110D and110C within service provider network150B may maintain service and topology state information only for one another, and not for routers110A-110B or110E-110I. In other examples, an administrator may assign one or more service provider networks150into one or more districts, one or more neighborhoods, or a combination of districts and neighborhoods as suits the needs of network system2.

Additional information with respect to the exchange of service and topology state information is described in U.S. Patent Application Publication No. 2020/0366590, entitled “CENTRAL AUTHORITY FOR SERVICE AND TOPOLOGY EXCHANGE,” published on Nov. 19, 2020; U.S. Patent Application Publication No. 2020/0366599, entitled “SOURCE-BASED ROUTING,” published on Nov. 19, 2020; U.S. Patent Application Publication No. 2020/0366598, entitled “SERVICE AND TOPOLOGY EXCHANGE PROTOCOL,” published on Nov. 19, 2020; U.S. Patent Application Publication No. 2020/0366589, entitled “ROUTING USING SEGMENT-BASED METRICS,” published on Nov. 19, 2020; and U.S. patent application Ser. No. 16/050,722, entitled “NETWORK NEIGHBORHOODS FOR ESTABLISHING COMMUNICATION RELATIONSHIPS BETWEEN COMMUNICATION INTERFACES IN AN ADMINISTRATIVE DOMAIN,” filed on Jul. 31, 2018, the entire content of each of which is incorporated herein by reference in its entirety.

Service Function Chaining with Session-Based Routing

In a conventional service-chaining environment, a router receives a plurality of packets from a source device. The router applies a load-balancing operation on a per-packet basis to forward each packet to an available instance of a network service. Each network service instance applies a network service to a received packet and forwards the serviced packet to a same or different router for forwarding to a destination device of the packet. While the use of per-packet load-balancing may be easily implemented and may enable efficient use of a plurality of network service instances, it is not guaranteed that a conventional router will send each packet of a forward packet flow received from the source device to the same network service instance.

With respect to session-based routing, it may be desirable to forward all traffic associated with the forward and reverse packet flows of a session to the same network instance for load-balancing purposes and to allow application of stateful services, such as stateful firewall services, to the traffic of the session. If a router selects a particular network service instance of a plurality of network service instances for servicing a packet of a forward packet flow of a session, the router may be able to forward subsequent packets of the forward packet flow to the selected network service instance. However, the router that selects the network service instance and forwards packets of the forward packet flow to the selected network service instance may be a different router than the router that receives packets of the reverse packet flow to be forwarded to the selected network service instance. Because the network service instance may not modify Internet Protocol (IP) information (or other types of Layer 3 information) of the packet, a conventional router receiving a serviced packet from the network service instance may be unable to identify the network service instance, and therefore may be unable to forward a packet of a reverse packet flow of the session to the same network service instance. Furthermore, where the network service instances are not within a subnet of the router, a conventional router is unable to use an ARP request to obtain a MAC address of a network service instance so as to forward the packet to a particular network service instance. Therefore, a conventional router is unable to implement service chaining for session-based routing because such a router is unable to forward packets of the reverse packet flow of the session to the same network service instance that applied a network service to packets of the forward packet flow of the session.

In accordance with the techniques of the disclosure, router110A of computer network system2performs session-based load-balancing of network traffic to network service instances104A-104N (collectively, “network service instances104”) to enable service-chaining within a session-based routing environment of computer network system2. As described above, in some examples a router performing session-based routing may model the flow of traffic between client devices100A,100B as a single session40comprising a forward packet flow originating from client device100A and destined for client device100B and a reverse packet flow originating from client device100B and destined for client device100A. With respect to the example ofFIG.1, in contrast to this approach, to assist the implementation of service chaining, router110A models the flow of traffic between client devices100A,100B as two sessions: session42A comprising a forward packet flow and reverse packet flow between client device100A and network service instance104A, and session42B comprising a forward packet flow and reverse packet flow between network service instance104A and client device100B.

As depicted in the example ofFIG.1, router110A receives a first packet of a forward packet flow from client device100A (e.g., a source device). Router110A performs a load balancing operation to select network service instance104A of a plurality of network service instances104with which to apply a network service to the first packet. Additionally, router110A defines first session42A comprising the forward packet flow comprising the first packet and a reverse packet flow between client device100A and selected network service instance104A. Router110A forwards the first packet to selected network service instance104A for application of the network service to the first packet. Network service instance104A applies the network service to the first packet and forwards the first packet back to the router110A.

Router110A receives, from network service instance104A, the first packet after application of the network service to the first packet. The first packet, as received from network service instance104A, specifies a source Media Access Control (MAC) address that is a MAC address of network service instance104A. Router110A defines second session42B comprising a forward packet flow comprising the first packet and a reverse packet flow between network service instance104A and client device100B (e.g., a destination device) to which the first packet is destined. Router110A stores an association between second session42B and the MAC address of network service instance104A and forwards the packet to client device100B.

Subsequently, router110A receives a second packet from client device100B. Router110A determines that the second packet is associated with the reverse packet flow of second session42B between network service instance104A and client device100B. Router110A forwards, based on the stored association between second session42B and the MAC address of network service instance104A, the second packet to network service instance104A and not other network service instances104such that the same network service instance104A may apply the network service to the second packet.

Network service instance104A applies the network service to the second packet and forwards the second packet to router110A. Router110A determines that the second packet is associated with the reverse packet flow of first session42A between client device100A and network service instance104A, and router110A forwards the second packet to client device100B.

Accordingly, as described above, router110A may learn a MAC address of network service instance104A from a first packet of a forward packet flow serviced by network service instance104A, and store an association between the MAC address of network service instance104A and session42B. Upon receiving a second packet, router110A may determine that the second packet belongs to a reverse packet flow of the same session42B. in response to determining that the second packet belongs to session42B, router110A may use the stored association between the MAC address of network service instance104A and session42B to forward the second packet of the reverse packet flow to network service instance104A for servicing. In this fashion, routers110A may implement service chaining while performing session-based routing.

FIG.2is a block diagram illustrating an example computing device200in accordance with the techniques of the disclosure. In general, computing device200may be an example implementation of one of routers110ofFIG.1.FIG.2illustrates a particular example of a server or other computing device200that includes processing circuitry202for executing any one or more of applications222, routing component250, or any other computing device described herein. Other examples of computing device200may be used in other instances.

Although shown inFIG.2as a stand-alone computing device200for purposes of example, a computing device that operates in accordance with the techniques of this disclosure may be any component or system that includes one or more processors or other suitable computing environment for executing software instructions and, for example, need not necessarily include one or more elements shown inFIG.2(e.g., communication units206; and in some examples, components such as storage device(s)208may not be co-located or in the same chassis as other components). In some examples, computing device200may be implemented as a virtualized network function (VNF). In some examples, one or more aspects of computing device200can be run as one or more containers or as one or more applications within virtual machines of a Network Functions Virtualization (NFV) platform using, e.g., VirtIO and SRIOV network virtualization technologies, or on bare-metal servers. In some examples, computing device200is a physical network device, such as a switch, router, gateway, or other device that sends and receives network traffic.

As shown in the example ofFIG.2, computing device200includes processing circuitry202, one or more input devices204, one or more communication units206, one or more output devices212, one or more storage devices208, and one or more user interface (UI) device(s)210. Computing device200, in one example, further includes one or more application(s)222and operating system216that are executable by computing device200. Each of components202,204,206,208,210, and212are coupled (physically, communicatively, and/or operatively) for inter-component communications. In some examples, communication channels214may include a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data. As one example, components202,204,206,208,210, and212may be coupled by one or more communication channels214.

Processing circuitry202, in one example, are configured to implement functionality and/or process instructions for execution within computing device200. In some examples, processing circuitry202comprises one or more hardware-based processors. For example, processing circuitry202may be capable of processing instructions stored in storage device208. Examples of processing circuitry202may include, any one or more of a microprocessor, a controller, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or equivalent discrete or integrated logic circuitry.

One or more storage devices208may be configured to store information within computing device200during operation. Storage device208, in some examples, is described as a computer-readable storage medium. In some examples, storage device208is a temporary memory, meaning that a primary purpose of storage device208is not long-term storage. Storage device208, in some examples, is described as a volatile memory, meaning that storage device208does not maintain stored contents when the computer is turned off. Examples of volatile memories include random access memories (RAM), dynamic random access memories (DRAM), static random access memories (SRAM), and other forms of volatile memories. In some examples, storage device208is used to store program instructions for execution by processing circuitry202. Storage device208, in one example, is used by software or applications running on computing device200to temporarily store information during program execution.

Storage devices208, in some examples, also include one or more computer-readable storage media. Storage devices208may be configured to store larger amounts of information than volatile memory. Storage devices208may further be configured for long-term storage of information. In some examples, storage devices208include non-volatile storage elements. Examples of such non-volatile storage elements include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories.

Computing device200, in some examples, also includes one or more communication units206. Computing device200, in one example, utilizes communication units206to communicate with external devices via one or more networks, such as one or more wired/wireless/mobile networks. Communication units206may include a network interface, such as an Ethernet card, an optical transceiver, a radio frequency transceiver, or any other type of device that can send and receive information. Other examples of such network interfaces may include 3G and WiFi radios. In some examples, communication units206my include a plurality of high-speed network interface cards. In some examples, computing device200uses communication unit206to communicate with an external device. For example, computing device200uses communication unit206to communicate with other routers110and/or client devices100ofFIG.1via links16ofFIG.1with which communication unit206is connected.

Computing device200, in one example, also includes one or more user interface devices210. User interface devices210, in some examples, are configured to receive input from a user through tactile, audio, or video feedback. Examples of user interface devices(s)210include a presence-sensitive display, a mouse, a keyboard, a voice responsive system, video camera, microphone or any other type of device for detecting a command from a user. In some examples, a presence-sensitive display includes a touch-sensitive screen. In some examples, a user such as an administrator of service provider networks150may enter configuration data for computing device200.

One or more output devices212may also be included in computing device200. Output device212, in some examples, is configured to provide output to a user using tactile, audio, or video stimuli. Output device212, in one example, includes a presence-sensitive display, a sound card, a video graphics adapter card, or any other type of device for converting a signal into an appropriate form understandable to humans or machines. Additional examples of output device212include a speaker, a cathode ray tube (CRT) monitor, a liquid crystal display (LCD), or any other type of device that can generate intelligible output to a user.

Computing device200may include operating system216. Operating system216, in some examples, controls the operation of components of computing device200. For example, operating system216, in one example, facilitates the communication of one or more applications222with processing circuitry202, communication unit206, storage device208, input device204, user interface devices210, and output device212. Applications222may also include program instructions and/or data that are executable by computing device200.

In some examples, processing circuitry202executes routing component250, which determines routes of received packets and forwards the packets accordingly. Routing component250communicates with other routers, e.g., such as routers110ofFIG.1, to establish and maintain a computer network, such as computer network system2ofFIG.1, for transporting network traffic between one or more customer devices. Routing protocol daemon (RPD)254of routing component250executes software instructions to implement one or more control plane networking protocols256. For example, protocols256may include one or more routing protocols, such as Internet Group Management Protocol (IGMP)221and/or Border Gateway Protocol (BGP)220, for exchanging routing information with other routing devices and for updating routing information base (RIB)252, Multiprotocol Label Switching (MPLS) protocol215, and other routing protocols. Protocols256may further include one or more communication session protocols, such as TCP, UDP, TLS, or ICMP.

Routing information252may describe a topology of the computer network in which computing device200resides, and may also include routes through the shared trees in the computer network. Routing information252describes various routes within the computer network, and the appropriate next hops for each route, i.e., the neighboring routing devices along each of the routes. Routing information252may be a radix tree programmed into dedicated forwarding chips, a series of tables, a complex database, a link list, a radix tree, a database, a flat file, or various other data structures.

Session information235stores information for identifying sessions. In some examples, session information235is in the form of a session table. For example, services information232comprises one or more entries that specify a session identifier. In some examples, the session identifier comprises one or more of a source address, source port, destination address, destination port, or protocol associated with a forward packet flow and/or a reverse packet flow of the session. As described above, when routing component250receives a packet for a forward packet flow originating from client device100A and destined for client device100B ofFIG.1, routing component250determines whether the packet belongs to a new session (e.g., is the “first” packet or “lead” packet of session40). To determine whether the packet belongs to a new session, routing component250determines whether session information235includes an entry corresponding to a source address, source port, destination address, destination port, and protocol of the first packet. If an entry exists, then the session is not a new session. If no entry exists, then the session is new and routing component250generates a session identifier for the session and stores the session identifier in session information235. Routing component250may thereafter use the session identifier stored in session information235for the session to identify subsequent packets as belonging to the same session.

Services information232stores information that routing component250may use to identify a service associated with a session. In some examples, services information232is in the form of a services table. For example, services information232comprises one or more entries that specify a service identifier and one or more of a source address, source port, destination address, destination port, or protocol associated the service. In some examples, routing component250may query services information232with one or more of a source address, source port, destination address, destination port, or protocol of a session for a received packet to determine a service associated with a session. For example, routing component250may determine a service identifier based on a correspondence of a source address, source port, destination address, destination port, or protocol in services information232to a source address, source port, destination address, destination port, or protocol specified by a session identifier. Routing component250retrieves, based on the service associated with the packet, one or more service policies234corresponding to the identified service. The service policies may include, e.g., a path failover policy, a Dynamic Host Configuration Protocol (DHCP) marking policy, a traffic engineering policy, a priority for network traffic associated with the session, etc. Routing component250applies, to the packet, the one or more service policies234that correspond to the service associated with the packet.

In accordance with the techniques of the disclosure, computing device200performs service function chaining with session-based routing. computing device200may operate as any of routers110ofFIG.1. In the example ofFIG.2, routing component250of computing device200performs session-based load-balancing of network traffic to network service instances104A-104N (collectively, “network service instances104”) to enable service-chaining within a session-based routing environment of computer network system2ofFIG.1. In the following example, computing device200is described as operating as router110A ofFIG.1.

As depicted in the example ofFIG.1, routing component250receives a first packet of a forward packet flow from client device100A ofFIG.1(e.g., a source device) via communication units206. In some examples, the first packet specifies a Layer-2 header comprising a source MAC address that is a MAC address of client device100A and a destination MAC address that is a MAC address of computing device200. The first packet further specifies a Layer-3 header comprising a source IP address and a source port that are an IP address and a port of client device100A, respectively, and a destination IP address and a destination port that are an IP address and a port of client device100B, respectively. Routing component250performs a load balancing operation to select network service instance104A of a plurality of network service instances104ofFIG.1with which to apply a network service to the first packet. For example, routing component250may select network service instance104A using a round-robin selection method or a least-utilization selection method, etc.

Routing component250defines, in session information235, first session42A comprising the forward packet flow comprising the first packet and a reverse packet flow between client device100A and selected network service instance104A. In some examples, routing component250defines, for first session42A, a first session entry in session information235comprising a first session identifier, a first forward packet flow key for the forward packet flow between client device100A and selected network service instance104A, and a first reverse packet flow key for the reverse packet flow between client device100A and selected network service instance104A. In some examples, the first forward packet flow key comprises a 7-tuple of a header of the first packet received from client device100A. The 7-tuple comprises, for example, a source IP address of the first packet (e.g., an IP address of client device100A), a source port (e.g., a port of client device100A), a destination IP address (e.g., an IP address of client device100B), a destination port (e.g., a port of client device100B), a network protocol used by the first packet (e.g., such as TCP or UDP), an interface identifier of an interface from which routing component250receives the first packet (e.g., an interface of client device100A), and a Virtual Local Area Network (VLAN) identifier of the first packet (e.g., a VLAN to which client device100A is assigned). In some examples, the first session identifier is the same as the first forward packet flow key.

In some examples, routing component250defines the first reverse packet flow key as the inverse of the first forward packet flow key. For example, routing component250defines the first reverse packet flow key based on a reverse packet flow to be received from client device100B. The first reverse packet flow key comprises a 7-tuple comprising, for example, a source IP address (e.g., an IP address of client device100B), a source port (e.g., a port of client device100B), a destination IP address (e.g., an IP address of client device100A), a destination port (e.g., a port of client device100A), a network protocol (e.g., such as TCP or UDP), an interface identifier of an interface from which routing component250is to receive packets of the reverse packet flow (e.g., an interface of network service instance104A), and a VLAN identifier (e.g., a VLAN to which client device100B is assigned).

RPD254of routing component250forwards the first packet to network service instance104A for application of the network service to the first packet. For example, RPD254modifies the Layer-2 header of the first packet to specify a source MAC address that is the MAC address of computing device200and a destination MAC address that is a MAC address of network service instance104A, and forwards the first packet to network service instance104A via communication units206. Network service instance104A applies the network service to the first packet and forwards the first packet back to computing device200.

Routing component250receives, from network service instance104A and via communication units206, the first packet after application of the network service to the first packet. The Layer-2 header of the first packet, as received from network service instance104A, specifies a source MAC address that is the MAC address of network service instance104A and a destination MAC address that is the MAC address of computing device200. Typically, the Layer-3 header of the first packet remains unchanged, e.g., the Layer-3 header comprises the source IP address and the source port that are the IP address and the port of client device100A, respectively, and the destination IP address and the destination port that are the IP address and the port of client device100B, respectively.

Routing component250defines, in session information235, second session42B comprising a forward packet flow comprising the first packet and a reverse packet flow between network service instance104A and client device100B (e.g., a destination device) to which the first packet is destined. In some examples, routing component250defines, for second session42B, a second session entry in session information235comprising a second session identifier, a second forward packet flow key for the forward packet flow between network service instance104A and client device100B, and a second reverse packet flow key for the reverse packet flow between network service instance104A and client device100B. In some examples, the second forward packet flow key comprises a 7-tuple of a header of the first packet received from network service instance104A. The 7-tuple comprises, for example, a source IP address of the first packet (e.g., an IP address of client device100A), a source port (e.g., a port of client device100A), a destination IP address (e.g., an IP address of client device100B), a destination port (e.g., a port of client device100B), a network protocol used by the first packet (e.g., such as TCP or UDP), an interface identifier of an interface from which routing component250receives the first packet (e.g., an interface of network service instance104A), and a Virtual Local Area Network (VLAN) identifier of the first packet (e.g., a VLAN to which client device100A is assigned). In some examples, the second session identifier is the same as the second forward packet flow key.

In some examples, routing component250defines the second reverse packet flow key as the inverse of the second forward packet flow key. For example, routing component250defines the second reverse packet flow key based on a reverse packet flow to be received from client device100B. The second reverse packet flow key comprises a 7-tuple comprising, for example, a source IP address (e.g., an IP address of client device100B), a source port (e.g., a port of client device100B), a destination IP address (e.g., an IP address of client device100A), a destination port (e.g., a port of client device100A), a network protocol (e.g., such as TCP or UDP), an interface identifier of an interface from which routing component250is to receive packets of the reverse packet flow (e.g., an interface of client device100B), and a VLAN identifier (e.g., a VLAN to which client device100B is assigned).

Notably, the first forward packet flow key and first session identifier differ from the second forward packet flow key and second session identifier primarily in that the first forward packet flow key and first session identifier include the interface identifier of the interface of client device100A, while the second forward packet flow key and second session identifier include the interface identifier of the interface of network service instance104A. Additionally, the first reverse packet flow key differs from the second reverse packet flow key primarily in that the first reverse packet flow includes the interface identifier of the interface of network service instance104A, while the second reverse packet flow key includes the interface identifier of the interface of client device100B.

Additionally, routing component250stores an association260between second session42B and the MAC address of network service instance104A. For example, routing component250obtains, from the Layer-2 header of the first packet received from network service instance104A after application of the network service to the first packet, the MAC address of network service instance104A. Routing component250includes, in the second session entry for second session42B in session information235, the MAC address of network service instance104A. RPD254of routing component250forwards the first packet to client device100B via communication units206.

Subsequently, routing component250receives, via communication units206, a second packet from client device100B. In some examples, the second packet specifies Layer-2 header comprising a source MAC address that is a MAC address of client device100B and a destination MAC address that is a MAC address of computing device200. The second packet further specifies a Layer-3 header comprising a source IP address and a source port that are an IP address and a port of client device100B, respectively, and a destination IP address and a destination port that are an IP address and a port of client device100A, respectively. The second packet may additionally specify an interface identifier for an interface of client device100B from which computing device200receives the second packet.

Routing component250determines, based on a correspondence between the Layer-3 header of the second packet and the second session entry for second session42B in session information235, that the second packet is associated with the reverse packet flow of second session42B between network service instance104A and client device100B. Based on the stored association between second session42B and the MAC address of network service instance104A, RPD254of routing component250forwards the second packet to network service instance104A for application of the network service to the second packet. For example, RPD254modifies the Layer-2 header of the second packet to specify a source MAC address that is the MAC address of computing device200and a destination MAC address that is the MAC address of network service instance104A, and forwards the second packet to network service instance104A via communication units106. Network service instance104A applies the network service to the second packet and forwards the second packet back to computing device200. In this fashion, routing component250enables computing device100to forward packets of the reverse packet flow from client device100B to the same network service instance (e.g., network service instance104A) for application of the network service as the network service instance which serviced packets of the forward packet flow from client device100A, and not to other network service instances.

Routing component250receives, from network service instance104A and via communication units206, the second packet after application of the network service to the second packet. The Layer-2 header of the second packet, as received from network service instance104A, specifies a source MAC address that is the MAC address of network service instance104A and a destination MAC address that is the MAC address of computing device200. Typically, the Layer-3 header of the second packet remains unchanged, e.g., the Layer-3 header comprises the source IP address and the source port that are the IP address and the port of client device100B, respectively, and the destination IP address and the destination port that are the IP address and the port of client device100A, respectively. The second packet may additionally specify an interface identifier for an interface of network service instance104A from which computing device200receives the second packet.

Routing component250determines, based on a correspondence between the Layer-3 header of the second packet and the first session entry for first session42A in session information235, that the second packet is associated with the reverse packet flow of first session42A between client device100A and network service instance104A. Based on the determination that the second packet is associated with the reverse packet flow of first session42A, RPD254of routing component250forwards the second packet to client device100A. For example, RPD254modifies the Layer-2 header of the second packet to specify a source MAC address that is the MAC address of computing device200and a destination MAC address that is the MAC address of client100A, and forwards the second packet to client100A via communication units106.

FIGS.3A-3Bare block diagrams illustrating example computer network system2ofFIG.1in further detail. Client devices100A and100B, router110, and network service instances104mayFIGS.3A-3Bbe similar to the like elements ofFIG.1. As depicted in the example ofFIG.3A, client devices100A and100B, router110, and network service instances104are interconnected by links316A-316E (collectively, “links316”). In some examples, link316A represents a Local Area Network (LAN) which provides interconnectivity between client device100A and router110. In some examples, link316B represents a Wide Area Network (WAN) which provides interconnectivity between router110and client device100B. In some examples, each network service104is not within a subnet of router110such that router110is unable to use an ARP request to obtain a MAC address of one or more network service instances104.

Client device100A (e.g., a source device) sends, to router110, first packet344A destined to client device100B (e.g., a destination device). In some examples, packet344A specifies a Layer-2 header comprising a source MAC address that is a MAC address of client device100A and a destination MAC address that is a MAC address of router110. Packet344A further specifies a Layer-3 header comprising a source IP address and a source port that are an IP address and a port of client device100A, respectively, and a destination IP address and a destination port that are an IP address and a port of client device100B, respectively.

Router110receives packet344A and selects network service instance104A of a plurality of network service instances104with which to apply a network service to the first packet. In some examples, router110performs a load balancing operation to assign traffic of a session associated with packet344(e.g., first session342) to network service instance104A. Router110defines first session342A associated with packet344A. First session342A comprises a forward packet flow and a reverse packet flow between client device100A and selected network service instance104A. In some examples, router110defines first session342A based at least in part on a first interface identifier of a first interface of client device100A from which router110receives packet344A.

Router110modifies packet344A to form packet344B, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of network service instance104A. Router110forwards packet344B to selected network service instance104A for application of the network service to packet344B.

Network service instance104A applies the network service to packet344B. Network service instance104A modifies packet344B to form packet344C, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of network service instance104A and a destination MAC address that is the MAC address of router110. Network service instance104A forwards packet344C to router110.

Router110receives, from network service instance104A, packet344C after application of the network service to the packet by network service instance104A. Router110defines second session342B associated with packet344C. Session342B comprises a forward packet flow and a reverse packet flow between network service instance104A and client device100B. In some examples, router110defines second session342B based at least in part on a second interface identifier of a second interface of network service interface104A from which router110receives packet344C.

Router110stores an association between second session342B and the MAC address of network service instance104A. Router110modifies packet344C to form packet344D, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of client device100B. Router110forwards packet344D to client device100B. Client device100B receives, from router110, packet344D.

As depicted in the example ofFIG.3B, client device100B subsequently sends, to router110, second packet346A destined to client device100A. In some examples, packet346A specifies a Layer-2 header comprising a source MAC address that is a MAC address of client device100B and a destination MAC address that is a MAC address of router110. Packet346A further specifies a Layer-3 header comprising a source IP address and a source port that are an IP address and a port of client device100B, respectively, and a destination IP address and a destination port that are an IP address and a port of client device100A, respectively.

Router110receives packet346A from client device100B. Router110determines that packet346A is associated with the reverse packet flow of second session342B between network service instance104A and client device100B. Based on the stored association between second session342B and the MAC address of network service instance104A, router110modifies packet346A to form packet346B, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of network service instance104A, and forwards packet346B to network service instance104A.

Network service instance104A applies the network service to packet346B. Network service instance104A modifies packet346B to form packet344C, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of network service instance104A and a destination MAC address that is the MAC address of router110. Network service instance104A forwards packet346C to router110.

Router110receives, from network service instance104A, packet346C after application of the network service to the packet by network service instance104A. Router110determines that packet346C is associated with the reverse packet flow of first session342A between client device100A and network service instance104A. Router110modifies packet346C to form packet346D, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of client device100A. Router110forwards packet346D to client device100A. Client device100A receives, from router110, packet346D.

Accordingly, using the techniques described above, router110may learn a MAC address of network service instance104A from a first packet344C serviced by network service instance104A, and store an association between the MAC address of network service instance104A and session342B associated with a forward packet flow comprising first packet344C. Upon receiving second packet346A, router110may determine that second packet346A belongs to a reverse packet flow of the same session342B. In response to determining that second packet346A belongs to the reverse packet flow of session342B, router110may use the stored association between the MAC address of network service instance104A and session342B to forward packet346A (depicted as packet346B inFIG.3B) to network service instance104A for servicing. In this fashion, router110may implement service chaining while performing session-based routing.

FIG.4is a flowchart illustrating an example operation in accordance with the techniques of the disclosure.FIG.4is described with respect toFIG.3for convenience.

As depicted in the example ofFIG.4, client device100A (e.g., a source device) sends, to router110, first packet344A destined to client device100B (e.g., a destination device) (402). In some examples, packet344A specifies a Layer-2 header comprising a source MAC address that is a MAC address of client device100A and a destination MAC address that is a MAC address of router110. Packet344A further specifies a Layer-3 header comprising a source IP address and a source port that are an IP address and a port of client device100A, respectively, and a destination IP address and a destination port that are an IP address and a port of client device100B, respectively.

Router110receives packet344A and selects network service instance104A of a plurality of network service instances104with which to apply a network service to the first packet (404). Router110defines first session342A associated with packet344A (406). First session342A comprises a forward packet flow and a reverse packet flow between client device100A and selected network service instance104A. Router110modifies packet344A to form packet344B, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of network service instance104A. Router110forwards packet344B to selected network service instance104A for application of the network service to packet344B (408).

Network service instance104A applies the network service to packet344B (410). Network service instance104A modifies packet344B to form packet344C, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of network service instance104A and a destination MAC address that is the MAC address of router110. Network service instance104A forwards packet344C to router110(412).

Router110receives, from network service instance104A, packet344C after application of the network service to the packet by network service instance104A. Router110defines second session342B associated with packet344C. Session342B comprises a forward packet flow and a reverse packet flow between network service instance104A and client device100B (414). Router110stores an association between second session342B and the MAC address of network service instance104A (416). Router110modifies packet344C to form packet344D, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of client device100B. Router110forwards packet344D to client device100B (418).

Client device100B receives, from router110, packet344D (420). Subsequently, client device100B sends, to router110, second packet346A destined to client device100A (422). In some examples, packet346A specifies a Layer-2 header comprising a source MAC address that is a MAC address of client device100B and a destination MAC address that is a MAC address of router110. Packet346A further specifies a Layer-3 header comprising a source IP address and a source port that are an IP address and a port of client device100B, respectively, and a destination IP address and a destination port that are an IP address and a port of client device100A, respectively.

Router110receives packet346A from client device100B. Router110determines that packet346A is associated with the reverse packet flow of second session342B between network service instance104A and client device100B (424). Based on the stored association between second session342B and the MAC address of network service instance104A, router110modifies packet346A to form packet346B, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of network service instance104A, and forwards packet346B to network service instance104A (426).

Network service instance104A applies the network service to packet346B (428). Network service instance104A modifies packet346B to form packet344C, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of network service instance104A and a destination MAC address that is the MAC address of router110. Network service instance104A forwards packet346C to router110(430).

Router110receives, from network service instance104A, packet346C after application of the network service to the packet by network service instance104A. Router110determines that packet346C is associated with the reverse packet flow of first session342A between client device100A and network service instance104A. Router110modifies packet346C to form packet346D, which specifies a Layer-2 header comprising a source MAC address that is a MAC address of router110and a destination MAC address that is a MAC address of client device100A. Router110forwards packet346D to client device100A (432). Client device100A receives, from router110, packet346D (434).

Accordingly, using the techniques described above, router110may learn a MAC address of network service instance104A from a first packet344C serviced by network service instance104A, and store an association between the MAC address of network service instance104A and session342B associated with a forward packet flow comprising first packet344C. Upon receiving second packet346A, router110may determine that second packet346A belongs to a reverse packet flow of the same session342B. In response to determining that second packet346A belongs to the reverse packet flow of session342B, router110may use the stored association between the MAC address of network service instance104A and session342B to forward packet346A (depicted as packet346B inFIG.3B) to network service instance104A for servicing. In this fashion, router110may implement service chaining while performing session-based routing.

FIG.5is an illustration of example user interface500for a router operating in accordance with the techniques of the disclosure. In some examples, any of routers110as described above with respect toFIG.1,2, or3A-3B may provide user interface500to enable a user or administrator to configure the router110. As depicted inFIG.5, user interface500provides toggle switch502to enable a user to enable or disable the functionality of a router110to use a source MAC address of a packet received from a device with an off-subnet source IP address to correlate reverse traffic to a session and enable the forwarding of such traffic to the off-subnet source IP address, as described herein.

The techniques described in this disclosure may be implemented, at least in part, in hardware, software, firmware or any combination thereof. For example, various aspects of the described techniques may be implemented within one or more processors, including one or more microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or any other equivalent integrated or discrete logic circuitry, as well as any combinations of such components. The term “processor” or “processing circuitry” may generally refer to any of the foregoing logic circuitry, alone or in combination with other logic circuitry, or any other equivalent circuitry. A control unit comprising hardware may also perform one or more of the techniques of this disclosure.

Such hardware, software, and firmware may be implemented within the same device or within separate devices to support the various operations and functions described in this disclosure. In addition, any of the described units, modules or components may be implemented together or separately as discrete but interoperable logic devices. Depiction of different features as modules or units is intended to highlight different functional aspects and does not necessarily imply that such modules or units must be realized by separate hardware or software components. Rather, functionality associated with one or more modules or units may be performed by separate hardware or software components, or integrated within common or separate hardware or software components.

The techniques described in this disclosure may also be embodied or encoded in a computer-readable medium, such as a computer-readable storage medium, containing instructions. Instructions embedded or encoded in a computer-readable storage medium may cause a programmable processor, or other processor, to perform the method, e.g., when the instructions are executed. Computer readable storage media may include random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM), flash memory, a hard disk, a CD-ROM, a floppy disk, a cassette, magnetic media, optical media, or other computer readable media.

Various examples have been described. These and other examples are within the scope of the following claims.