Cisco Technology, Inc.

Mark Denny

Siva S Jayasenan

Kaushik Pratap Biswas

Mahadev Somasundaram

Murali Venkateshaiah

Mike Sullenberger

Suresh Satapati

Senthil M Sivakumar

Ian Herbert Wilson

John Lautmann

Michael J Sullenberger

Michael Lee Sullenberger

Scott Allan Bales

Arunkumar Bhushappagala Thippeswamy

Andrew Joseph Mead

Yu-Cheng Shao

Douglas McLaggan

Rick L Williams

A technique for synchronizing NAT information stored on different network devices. Each of the network devices includes a respective NAT data structure configured to store NAT information. The NAT information includes at least one NAT entry relating to a network node engaged in a communication session with at least one other network node. At least one NAT entry in a first NAT data structure is modified. The first NAT data structure is associated with a first NAT network device. A first NAT transaction message is generated which includes information relating to the modifications performed on the first NAT data structure. The first NAT transaction message is transmitted to at least one other NAT network device causing that device to modify its respective NAT data structure using information from the first NAT transaction message. In this way, synchronization of NAT information stored on each of the network devices may be achieved.

Stateful network address translation protocol implemented over a data network

A technique is disclosed for synchronizing NAT information stored on different network devices that have been configured to implement a network address translation protocol. Each of the network devices includes a respective NAT data structure configured to store NAT information. The NAT information includes at least one NAT entry relating to a network node engaged in a communication session with at least one other network node. At least one NAT entry in a first NAT data structure is modified. The first NAT data structure is associated with a first NAT network device. A first NAT transaction message is generated which includes information relating to the modifications performed on the first NAT data structure. The first NAT transaction message is transmitted to at least one other NAT network device to thereby cause that device to modify its respective NAT data structure using information from the first NAT transaction message. In this way, synchronization of NAT information stored on each of the network devices may be achieved.

Disclosed are methods and apparatus for handling data having an embedded address (and port). In general terms, a host of a private network is operable to obtain from its corresponding edge router a global address (GA) and optionally an additional global port range (GPR). When the host then wishes to transmit data out of the private network, the obtained GA (and GPR) may then be used for an embedded address (and port) within data sent by the host to a public network. The obtained GA (and GPR) may also be used by the host to translate its own source address and port in its IP and/or TCP/UDP header if needed.

Method and apparatus for making end-host network address translation (NAT) global address and port ranges aware

Redundant gateway methods, apparatus and systems using more than one gateway device in a gateway device group for communications directed outside of a LAN. Failover services are thus provided in the event that an active router or other gateway device fails. Network address translation (NAT) services are provided simultaneously by having all gateway devices in the redundancy group create and maintain IP aliases and static NAT mappings, while disabling all gateway devices operating in a non-active mode from replying to address resolution protocol requests from hosts. A gateway device may be configured to operate in a redundancy group in an active operating mode or a non-active operating mode. The gateway device handles transmissions into and out of the network to which it is connected only when the gateway device is in the active operating mode so as to avoid system corruption due to ARP activity and message transmissions by non-active gateway devices.

Network address translation with IP redundancy

Methods and apparatus for initiating the release of an IP address allocated for use by a Mobile Node supporting Mobile IP are disclosed. The IP address may be a collocated care-of address or a dynamically assigned home address. The release of the IP address may be initiated by the Home Agent based upon information it has received in a registration request or, alternatively, may be initiated by the Home Agent in response to a de-registration request. In this manner, a Home Agent may initiate the release of an IP address that is no longer in use by a Mobile Node.

Optimized IP address use in a mobile IP environment

Disclosed are methods and apparatus for handling data sent from a first public network to a second or same public network via a private network. In general terms, network translation address mechanisms are provided within the edge routers of the private network. When a first processing node sends a request to an edge router to access another processing node which resides in a public network, the edge router forms a binding based on two addresses associated with the first processing node. A first private address is initially associated with the first processing node, and the first processing node uses this private address to communicate with the private network. A second public address is also allocated to the first processing node based on the first processing node's request to communicate with a public node. The first processing node uses the allocated second public address to communicate with the requested public node.

Apparatus and methods for forwarding data between public networks via a private network

Methods and apparatuses for distributing network address translation. By having a gateway inform inside devices of global addresses, the gateway can avoid performing many functions of a traditional NAT box. Specifically, an inside device is informed of a global address shared by all devices on the inside device's network segment. Each device on that segment would be assigned a range of ports to distinguish messages from separate devices that use the same global address.

Method and apparatus for distributed network address translation processing

The distribution of traffic flows in a load-sharing redundancy group that includes a first gateway device and a second gateway device includes assigning a first set of forwarding addresses to the first gateway device and a second set of forwarding addresses to the second gateway device. The redundancy group distributes forwarding addresses to hosts which in turn use the distributed forwarding addresses to send packets to the redundancy group. The traffic flow for each of the assigned forwarding addresses is measured and may be compared to a target traffic flow. The traffic flow is adjusted to close in on the target traffic flow. Adjustment of the traffic flow can be accomplished either by changing the existing measured traffic flow by re-assigning a forwarding address originally assigned to one gateway device to a different gateway device or by altering future distribution of forwarding addresses so that additional traffic is sent to one or more forwarding addresses having lower measured traffic. The gateway devices can be routers using virtual Media Access Control (MAC) addresses as forwarding addresses. The redundancy group may also be configured to provide failover services in the event that one of the gateway devices ceases operation.

Distributing and balancing traffic flow in a virtual gateway

Various techniques are described which may be used for improving traffic flows between private networks and public networks. According to one aspect of the present invention, a technique is described for implementing asymmetric routing in a NAT routing environment. Another aspect of the present invention provides a technique for implementing load balancing and resource allocation assignments among peers in a redundant, multiple NAT router environment.

Mechanisms for providing stateful NAT support in redundant and asymetric routing environments

A new directory service is established for a peer router receiving a data packet from an end station on a local area network connected to a port of the peer router, the peer router hereinafter being referred to as the source router. The data packet is addressed to a destination address. The source router determines that the data packet is to be encapsulated as an encapsulated packet, and the encapsulated packet routed by a peer-to-peer protocol to a destination router. The destination router then transmits the packet onto a local area network to the destination address. The source router locates the proper peer destination router by use of a database. The database is maintained on a server, where the database has entries for destination address, and an entry for a particular destination address gives the address of a peer router capable of routing a packet to that particular destination address. The database is populated by peer routers updating the database with information concerning the destination address which the peer routers can reach. The database on the server is interrogated by the source router to learn the address of a destination peer router, and an encapsulated packet is then transmitted onto a connectionless network for transmission to the destination router. The peer-to-peer routing protocol may be DLSw protocol. The database may be maintained in accordance with the X.500 directory standard. The database may be interrogated using the lightweight data access protocol (LDAP).

Growing community of inventors

San Jose, CA, United States of America

Mark Denny