Dynamic service chain with network address translation detection

Patent metadata

Field	Value
Publication number	US-9930008-B2
Application number	US-201414225279-A
Country	US
Kind code	B2
Filing date	Mar 25, 2014
Priority date	Mar 25, 2014
Publication date	Mar 27, 2018
Grant date	Mar 27, 2018

Abstract

In one embodiment, a method includes receiving a packet associated with a flow at a network device, classifying the packet at the network device based on information received from a policy layer, inserting a Network Address Translation (NAT) indicator for the flow into the packet, and transmitting the packet in a service chain comprising network address translation. The NAT indicator is associated with the flows before and after network address translation to provide symmetry between the service chain and a return traffic service chain. An apparatus and logic are also disclosed herein.

First claim

What is claimed is:

1. A method comprising:
receiving a packet associated with a flow at a network device comprising a head-end node of a service chain;
classifying the packet at the network device based on information received from a policy layer that binds a pre-NAT (Network Address Translation) flow to a post-NAT flow with a NAT indicator, wherein NAT translates a destination address;
inserting the NAT indicator for the flow into the packet, wherein the NAT indicator is inserted in a network service header comprising information used in service chaining;
transmitting the packet in a service chain comprising a service node performing network address translation in which an identity of the pre-NAT flow is transformed after passing through the service node; and
receiving a return packet associated with the flow, the packet comprising the NAT indicator inserted in the network service header of the packet by a head-end node of a return service chain based on information received from the policy layer, wherein the network service header is added to the packet to realize service function paths;
wherein the NAT indicator is associated with the flow before network address translation and the flow after network address translation at the policy layer to provide symmetry between the service chain and a return service chain after network address translation changes the destination address for the flow such that return traffic passes through a same set of service nodes in a reverse direction.

2. The method of claim 1 further comprising receiving a return packet associated with the flow, the packet comprising the NAT indicator inserted by a classifier based on information received from the policy layer.

3. The method of claim 1 wherein the NAT indicator is inserted in a network service header comprising information used in service chaining.

4. The method of claim 1 wherein the NAT indicator comprises a cookie.

5. The method of claim 1 wherein the network device comprises a classifier.

6. The method of claim 1 wherein the service chain is dynamically created at the network device.

7. The method of claim 1 wherein the NAT indicator is inserted in a data plane header.

8. The method of claim 1 further comprising creating a service path at the network device.

9. An apparatus comprising:
a processor for classifying a packet associated with a flow based on information received from a policy layer that binds pre-NAT (Network Address Translation) flow to a post-NAT flow with a NAT indicator, wherein NAT translates a destination address, inserting a Network Address Translation (NAT) indicator for the flow into a network service header comprising information used in service chaining in the packet, transmitting the packet in a service chain comprising a service node performing network address translation in which an identity of the pre-NAT flow is transformed after passing through the service node, and receiving a return packet associated with the flow, the packet comprising the NAT indicator inserted in the network service header of the packet by a head-end node of a return service chain based on information received from the policy layer, wherein the network service header is added to the packet to realize service function paths; and
a network interface for communication with a service node;
wherein the NAT indicator is configured for binding the flow before network address translation to a flow after network address translation at the policy layer to provide symmetry between the service chain and a return service chain after network address translation changes the destination address for the flow such that return traffic passes through a same set of service nodes in a reverse direction.

10. The apparatus of claim 9 wherein the NAT indicator is inserted in a network service header comprising information used in service chaining.

11. The apparatus of claim 9 wherein the NAT indicator comprises a cookie.

12. The apparatus of claim 9 wherein the apparatus comprises a classifier.

13. The apparatus of claim 9 wherein the apparatus is operable to dynamically create the service chain.

14. The apparatus of claim 9 wherein the NAT indicator is inserted in a data plane header.

15. The apparatus of claim 9 wherein the processor is further operable to create a service path at the apparatus.

16. A method comprising:
receiving at a network device comprising a head-end node of a service chain, a packet in a service chain comprising network address translation, the packet comprising a Network Address Translation (NAT) indicator associated with a flow before network address translation, wherein NAT translation of a destination address was performed in the service chain;
transmitting from the network device to a policy layer that binds a pre-NAT flow to a post-NAT flow with the NAT indicator, the NAT indicator and information identifying the flow after destination network address translation and used to classify the packet based on information received from the policy layer; and
transmitting a return packet on a return service chain using a binding of the pre-NAT flow to the post-NAT flow to direct the return packet to follow a reverse path of the received packet, the packet comprising the NAT indicator inserted in a network service header of the packet based on information received from the policy layer;
wherein the policy layer binds the flow before network address translation to the flow after network address translation using the NAT indicator to provide symmetry between the service chain and the return service chain after network address translation changes the destination address for the flow such that return traffic passes through a same set of service nodes in a reverse direction.

17. The method of claim 16 wherein the NAT indicator is inserted in a network service header comprising information used in service chaining.

18. The method of claim 16 wherein the service chain is dynamically created at the network device.

19. The method of claim 16 wherein the NAT indicator is inserted in a data plane header.

20. The method of claim 16 further comprising creating a return service path at the network device.

Assignees

• Cisco Tech Inc

Inventors

• Quinn Paul
• Guichard Jim
• Kumar Surendra
• Bosch Peter

Classifications

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L61/256 Primary

  NAT traversal · CPC title

• H04L61/2507

  Electricity · mapped topic

• H04L61/6068

  Electricity · mapped topic

• H04L41/0894

  Policy-based network configuration management · CPC title