Cloudflare, Inc.

Erich Alfred Heine

Nicholas Alexander Wondra

Nuno Miguel Lourenço Diegues

Michael John Vanderwater

Arég Harutyunyan

Yan Zhai

Adam Simon Chalmers

Igor Postelnik

A method of path MTU determination in Generic Routing Encapsulation (GRE) tunnel is presented. A source network device (ND) transmits, to a destination ND that is a second endpoint of the GRE tunnel, a first outer packet including a first inner packet, where the first inner packet includes a first inner header that is used to deliver the first inner packet to the source network device, a first inner GRE header, and a first payload. The source ND receives the first inner packet. The source ND transmits a second outer packet including a second inner packet that includes a second payload that has a size greater than a size of the first payload. The source ND determines that the second inner packet is not received and determines a path MTU between the source ND and the destination ND based on a size of the first and the second outer packets.

Method and system for determining a path maximum transmission unit (MTU) between endpoints of a generic routing encapsulation (GRE) tunnel

A unified network service that connects multiple disparate private networks and end user client devices operating on separate networks is described. The multiple disparate private networks and end user client devices connect to a distributed cloud computing network that provides routing services, security services, and performance services, and that can be controlled consistently regardless of the connection type. The unified network service provides uniform access control at the L3 layer (e.g., at the IP layer) or at a higher layer using user identity information (e.g., a zero-trust model). The disparate private networks are run on top of the distributed cloud computing network. The virtual routing layer of the distributed cloud computing network allows customers of the service to have private resources visible only to client devices (e.g., user devices of the customer and/or server devices of the customer) of the organization while using address space that potentially overlaps with other customers of the distributed cloud computing network.

Unified network service that connects multiple disparate private networks and end user client devices operating on separate networks

An IPSec tunnel request for establishing an IPSec tunnel from a customer router to an anycast IP address of a distributed cloud computing network is received. The same anycast IP address is shared among compute servers of the distributed cloud computing network. A handshake is performed with the customer router from a first compute server including generating security associations for encrypting and decrypting IPSec traffic. The security associations are propagated to each compute server and are used for encrypting and decrypting traffic.

Internet protocol security (IPSec) tunnel using anycast at a distributed cloud computing network

Path MTU determination in Generic Routing Encapsulation (GRE) tunnel is presented. A source network device transmits, to a destination network device that is a second endpoint of the GRE tunnel, multiple GRE encapsulated packets that include multiple inner packets respectively, where each inner packet has an inner header used to deliver that inner packet to the source network device and a different payload, and where each of these GRE encapsulated packets has a different size. The source network device receives a first portion of the inner packets from the destination network device and does not receive a second portion of the inner packets. The source network device determines a path MTU to the destination network device based on the size of the GRE encapsulated packet with a largest size for which a corresponding inner packet is received at the source network device from the destination network device.

Growing community of inventors

Champaign, IL, United States of America

Erich Alfred Heine