Cisco Technology, Inc.

Ian Herbert Wilson

Siva S Jayasenan

Mark Denny

Suresh Satapati

Douglas McLaggan

Kaushik Pratap Biswas

Bhaskar Bhupalam

Arghya T Mukherjee

Scott Thomas Fanning

Thomas John Nosella

Sepehr Safari

Venkatanarayana Muppala

Keith Collier Wilson

Natalie Timms

Rick L Williams

Barry Wilson

Douglas Mclaggan

Mark A Denny

Deck clip

Redundant gateway methods, apparatus and systems using more than one gateway device in a gateway device group for communications directed outside of a LAN. Failover services are thus provided in the event that an active router or other gateway device fails. Network address translation (NAT) services are provided simultaneously by having all gateway devices in the redundancy group create and maintain IP aliases and static NAT mappings, while disabling all gateway devices operating in a non-active mode from replying to address resolution protocol requests from hosts. A gateway device may be configured to operate in a redundancy group in an active operating mode or a non-active operating mode. The gateway device handles transmissions into and out of the network to which it is connected only when the gateway device is in the active operating mode so as to avoid system corruption due to ARP activity and message transmissions by non-active gateway devices.

Network address translation with IP redundancy

Gateway load balancing and failover methods, apparatus and systems use more than one gateway device in a gateway device group for communications directed outside of a LAN. In the load balancing arrangement, hosts that send ARP messages to a shared virtual IP address receive replies from one of the gateway devices in the gateway device group, directing the host to address outgoing communications to a virtual MAC address assigned to one of the gateway devices. Hosts are assigned virtual MAC addresses for the gateway devices according to a prescribed algorithm or methodology. In the event that one member of the gateway device group fails, the outgoing communications that would have been handled by the failed gateway device are re-assigned to another member of the gateway device group. A master gateway device controls address assignment and failover features. In the event that the master fails, additional steps are taken to appoint or elect a new master and ensure continuity in the load balancing function.

Gateway load balancing protocol

Gateway and NAT services to a single host or large number of hosts on a local network using a redundancy group having gateway devices. A pool of unique IP addresses are partitioned into address blocks, one of which is assigned to a gateway device. Using the unique IP addresses in its assigned address block, the gateway device translates local IP addresses of hosts on a local network to unique IP addresses from the gateway device's assigned address block for host packets destined for outside networks and creates a mapping of the translation. The gateway device notifies other gateway devices in the redundancy group of the mapping. A master mapping database or a local mapping database is updated whenever one of the gateway devices performs a translation. In the event that one of the gateway devices ceases forwarding of outgoing packets for a host using the gateway device's virtual MAC address, that virtual MAC address is re-assigned to an operating gateway device in the redundancy group to permit continued forwarding of the host's packets destined for outside networks.

Network address translation with gateway load distribution

Methods and apparatus are provided for enhancing security and fault tolerance for VPN gateways connecting clients in a public network with entities in a private network. According to various embodiments, primary and standby VPN gateways serving the same private network are configured with the same virtual IP address to allow public network clients the ability to efficiently switchover to a standby VPN gateway upon failure of the primary VPN gateway. Cryptography operations are executed using the virtual IP address. Routes can also be injected into the private network to enhance failover efficiency.

Methods and apparatus for virtual private network fault tolerance

The invention relates to a method for switchover from an active node to a standby node wherein when a standby network node restarts, designation of the standby node as a new active node is delayed according to 1) the period of a delay timer and 2) a counter indicating the number of data messages the standby node will be receiving from the active network node. The active node sends a notification to the standby node identifying a number of data messages that the active network node needs to send to the standby node. The standby node stores the number in a counter and decrements the counter upon receiving data messages. When the delay timer expires, the standby network node transitions to become the new active node only when the counter has reached zero. If the counter is not yet zero, then the switchover delay timer is restarted and the cycle repeats.

Dynamically controlling HSRP preemption dependent on stateful NAT convergence

The distribution of traffic flows in a load-sharing redundancy group that includes a first gateway device and a second gateway device includes assigning a first set of forwarding addresses to the first gateway device and a second set of forwarding addresses to the second gateway device. The redundancy group distributes forwarding addresses to hosts which in turn use the distributed forwarding addresses to send packets to the redundancy group. The traffic flow for each of the assigned forwarding addresses is measured and may be compared to a target traffic flow. The traffic flow is adjusted to close in on the target traffic flow. Adjustment of the traffic flow can be accomplished either by changing the existing measured traffic flow by re-assigning a forwarding address originally assigned to one gateway device to a different gateway device or by altering future distribution of forwarding addresses so that additional traffic is sent to one or more forwarding addresses having lower measured traffic. The gateway devices can be routers using virtual Media Access Control (MAC) addresses as forwarding addresses. The redundancy group may also be configured to provide failover services in the event that one of the gateway devices ceases operation.

Distributing and balancing traffic flow in a virtual gateway

Methods and apparatus to transition between four states that include a new state, a listening state, a standby state, and an active state. A router includes a plurality of virtual ports. The virtual ports include a master virtual port and one or more client virtual ports. In general, a selected one of the transitions is initiated after occurrence of an event, wherein the initiating of the selected transition is performed only with respect to the master virtual port. When a selected one of the transitions is initiated with respect to the master virtual port of the router, the selected transition is mimicked with respect to the one or more client virtual port(s) of the router.

Multiple virtual router group optimization

Redundant gateway methods, apparatus and systems use more than one gateway device in a gateway device group for communications directed outside of a LAN. Failover services in the event that an active router or other gateway device fails. In determining the priority of members of the group to become the active router/device for the group, a route metric is used as the priority value in elections held to determine the operating mode of each group member. This route metric is a numerical value representing the optimality of a route available between the router and a destination such as a remote network. By comparing the members' respective route metrics from time to time and in the event of a trigger event, the active router/device in a group is guaranteed to be the router with the optimal route to that remote network.

Standby router protocol using optimal route metric

Methods and apparatus for sending a redirect packet to a host are disclosed. In a first router that supports a virtual router protocol, a method of sending a redirect packet to a host, the redirect packet notifying the host that specific packets are to be redirected to a second router, includes receiving a packet from a host, the packet including a source address identifying the host and a destination address identifying a destination network. The first router ascertains the destination network of the packet from the destination address and obtains from a routing table an address of a next router to the packet's destination network. The first router then determines whether to send a redirect packet to the host. In accordance with one embodiment, this is performed by determining whether the next router and the host identified by the source address of the packet are on the same network. When it is determined that the next router and the host are on the same network, the first router composes and sends the redirect packet to the host. The redirect packet serves to notify the host that packets addressed to the destination network are to be redirected to a virtual address of the next router.

Redirection to a virtual router

Methods and apparatus for sending a redirect packet to a host by a first router that supports a virtual router protocol are disclosed. Specifically, the redirect packet notifies the host that specific packets are to be redirected to a second router. First, the first router receives a packet from a host, where the packet includes a source address identifying the host and a destination address identifying a destination network. The first router ascertains the destination network of the packet from the destination address and obtains from a routing table an address of a next router that is coupled to the packet's destination network. The first router then determines whether to send a redirect packet to the host. In accordance with one embodiment, this is performed by determining whether the next router and the host identified by the source address of the packet are on the same network. When it is determined that the next router and the host are on the same network, the first router composes and sends the redirect packet to the host. The redirect packet serves to notify the host that packets addressed to the destination network are to be redirected to a virtual address of the next router.

Growing community of inventors

Edinburgh, United Kingdom

Ian Herbert Wilson