Microsoft Technology Licensing, LLC

Ashok Kumar Nandoori

Mohit Kumar Garg

Vikrant Arora

Abhishek Tiwari

Ning Wei

Nalin Raj Gupta

Abhishek Gupta

Abhishek Agarwal

Lihua Yuan

Pradeepkumar Mani

Shivakumar Thangapandi

Paresh Verma

Sankalp Soni

Rohit Tripathi

Vijay Nag

A method for distributed flow steering in a cloud-based architecture includes assigning, by a first server, connection IDs to each of multiple data flows owned by the first server. The connection IDs each include a server ID that uniquely identifies the first server and that is included in a data packet header of each of the multiple data flows owned by the first server. The method further includes identifying, by the first server, a data flow characterized by a data packet header including a connection ID uniquely identifying a second server as the owner of the data flow, and redirecting the data flow to the second server.

Distributed flow steering in cloud architecture

Techniques are disclosed for managing gateway switchovers. An indication is received that a primary gateway will be switched to a backup gateway. In response to the indication, a response is made to a periodic health probe that a gateway switchover has been initiated. Incoming data traffic is forwarded from the primary gateway to the backup gateway. Subsequent to an elapsed time delay, a response is made to the periodic health probe that the primary gateway will no longer accept incoming data traffic. The time delay may be based at least in part on one or more of a time interval of the periodic poll and a time to effect the gateway switchover. The forwarding of the incoming data traffic from the primary gateway to the backup gateway is terminated.

Fast failover for gateway instances

A Top of Rack (TOR) switch operating with a Software for Open Networking in the Cloud (SONiC) platform is implemented using commodity switch hardware and is configured to maintain or retrieve flow state information for incoming data flows in a load balancer. In one embodiment, an application-specific integrated circuit (ASIC) informs a user mode container flow state information for each incoming data flow. The user mode container informs the ASIC of any affected flows that may result pursuant to a modified distributed system (e.g., added, updated, or removed servers). In other embodiments, the ASIC may utilize remote direct memory access (RDMA) to retrieve flow state information maintained by a remote device or may utilize the RDMA to retrieve network address translation (NAT) information for incoming traffic. In each of the implementations, the integrity of the load balancing system is maintained when the distributed system of servers changes.

Hardware load balancer gateway on commodity switch hardware

Techniques for intelligently managing a virtual private network (VPN) gateway in a cloud computing system are disclosed herein. In one embodiment, an instance of a VPN gateway can query whether a logic lock on a network address is maintained by another instance via periodic renewal. In response to receiving a query result indicating that a logic lock on the network address is lost by the another instance, the instance can migrate a VPN connection originally handled by the another instance from the another instance to the instance such that a private network is connected to the instance via the migrated VPN connection to reduce downtime for accessing computing resources in the cloud computing system.

Virtual private network gateway management

Techniques for dynamically scaling instances of virtual private network (VPN) gateway in a cloud computing system are disclosed herein. In one embodiment, a method includes determining whether a number of packets processed by a first instance of the VPN gateway exceeds a preset threshold. In response to determining that the number of packets exceeds the preset threshold, a new security association (SA) corresponding to a portion of the VPN network traffic is created. Upon completion of creating the SA, a load balancing policy at a load balancer is modified to forward a portion of the network traffic to a second instance of the VPN gateway when an incoming packet contains a security parameter index (SPI) corresponding to the created SA in its EPS header.

Dynamic scaling of virtual private network connections

To reduce network connectivity downtime while connections are established or re-established after maintenance, a connection request that would be rejected is instead accepted, even though a corresponding outgoing request is still pending. In some cases, the connection request is a secure connection request, such as an INIT phase request or an AUTH phase request during an Internet Key Exchange protocol exchange. Single-ended and double-ended configurations are both presented. When colliding INIT attempts succeed, two results are produced, after which one may be selected and the other discarded. Alternately, both INIT results may be used in producing two security associations during a subsequent AUTH phase. Incoming traffic and outgoing traffic may then use respective security associations.

Growing community of inventors

Sammamish, WA, United States of America

Ashok Kumar Nandoori