Distributed Service Processing of Network Gateways Using Virtual Machines

Abstract

A network gateway device includes an ingress interface, an egress interface, and a load balancing module coupled to the ingress and egress interfaces. The load balancing module configured to receive a packet from the ingress interface, determine a set of a plurality of processes corresponding to a connections session associated with the packet based on a policy. For each of the identified processes, the load balancing module is to identify a service processing module executed by a virtual machine that is capable of handling the identified process, and to send the packet to the identified service processing module to perform the identified process on the packet. The packet is then transmitted to the egress interface of the gateway device to be forwarded to a destination.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 receiving a packet at an ingress interface of a gateway device communicatively coupled to a local area network (LAN) and an external network;   determining a first service and a second service corresponding to a connections session, the first service and the second service determined using a policy;   identifying a first service processing module associated with the first service, the first service processing module executed by a first virtual machine capable of handling the first service;   sending the packet to the first service processing module, the first service processing module performing the first service on the packet to produce a first processed packet;   identifying a second service processing module associated with the second service, the second service processing module executed by a second virtual machine capable of handling the second service;   sending the first processed packet to the second service processing module, the second service processing module performing the second service on the first processed packet to produce a second processed packet; and   forwarding the second processed packet to an egress interface of the gateway device to a destination.   
     
     
         2 . The method of  claim 1 , wherein at least one of the first service processing module and the second service processing module is located external to the gateway device and communicatively coupled to the gateway device. 
     
     
         3 . The method of  claim 1 , wherein at least one of the first service processing module and the second service processing module is located in a public cloud associated with the external network. 
     
     
         4 . The method of  claim 1 , wherein the first service includes at least one of a network address translation (NAT) process, a virtual private network (VPN) process, and a deep packet inspection (DPI) process. 
     
     
         5 . The method of  claim 1 , further comprising:
 determining whether the first service processing module has sufficient bandwidth to handle the first service.   
     
     
         6 . The method of  claim 5 , further comprising:
 in response to the first service processing module not having sufficient bandwidth to perform the first service on the packet:   allocating and launching a third service processing module; and   alternatively sending the packet to the third service processing module, the third service processing module performing the first service on the packet to produce the first processed packet.   
     
     
         7 . The method of  claim 1 , further comprising:
 determining whether the second service processing module has sufficient bandwidth to handle the second service.   
     
     
         8 . A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method, the method comprising:
 receiving a packet at an ingress interface of a gateway device communicatively coupled to a local area network (LAN) and an external network;   determining a first service and a second service corresponding to a connections session, the first service and the second service determined using a policy;   identifying a first service processing module associated with the first service, the first service processing module executed by a first virtual machine capable of handling the first service;   sending the packet to the first service processing module, the first service processing module performing the first service on the packet to produce a first processed packet;   identifying a second service processing module associated with the second service, the second service processing module executed by a second virtual machine capable of handling the second service;   sending the first processed packet to the second service processing module, the second service processing module performing the second service on the first processed packet to produce a second processed packet; and   forwarding the second processed packet to an egress interface of the gateway device to a destination.   
     
     
         9 . The non-transitory computer-readable storage medium of  claim 8 , wherein at least one of the first service processing module and the second service processing module is located external to the gateway device and communicatively coupled to the gateway device. 
     
     
         10 . The non-transitory computer-readable storage medium of  claim 8 , wherein at least one of the first service processing module and the second service processing module is located in a public cloud associated with the external network. 
     
     
         11 . The non-transitory computer-readable storage medium of  claim 8 , wherein the first service includes at least one of a network address translation (NAT) service, a virtual private network (VPN) service, and a deep packet inspection (DPI) service. 
     
     
         12 . The non-transitory computer-readable storage medium of  claim 8 , further comprising:
 determining whether the first service processing module has sufficient bandwidth to handle the first service.   
     
     
         13 . The non-transitory computer-readable storage medium of  claim 12 , further comprising:
 in response to the first service processing module not having sufficient bandwidth to perform the first service on the packet:
 allocating and launching a third service processing module; and 
 alternatively sending the packet to the third service processing module, the third service processing module performing the first service on the packet to produce the first processed packet. 
   
     
     
         14 . The non-transitory computer-readable storage medium of  claim 8 , wherein the method further comprises:
 determining whether the second service processing module has sufficient bandwidth to handle the second service.   
     
     
         15 . A gateway device, comprising:
 an ingress interface;   an egress interface; and   a load balancing module coupled to the ingress and egress interfaces, the load balancing module comprising:
 at least one processor; and 
 a memory coupled to the at least one processor, the memory storing instructions executable by the at least one processor to perform a method comprising:
 receiving a packet from the ingress interface, 
 determining a first service and a second service corresponding to a connections session, the first service and the second service determined using a policy, 
 identifying a first service processing module associated with the first service, the first service processing module executed by a first virtual machine capable of handling the first service; 
 sending the packet to the first service processing module, the first service processing module performing the first service on the packet to produce a first processed packet; 
 identifying a second service processing module associated with the second service, the second service processing module executed by a second virtual machine capable of handling the second service; 
 sending the first processed packet to the second service processing module, the second service processing module performing the second service on the first processed packet to produce a second processed packet; and 
 forwarding the second processed packet to the egress interface of the gateway device to a destination. 
 
   
     
     
         16 . The gateway device of  claim 15 , wherein at least one of the first service processing module and the second service processing module is located external to the gateway device and communicatively coupled to the gateway device. 
     
     
         17 . The gateway device of  claim 15 , wherein at least one of the first service processing module and the second service processing module is located in a public cloud associated with an external network. 
     
     
         18 . The gateway device of  claim 15 , wherein the first service includes at least one of a network address translation (NAT) service, a virtual private network (VPN) service, and a deep packet inspection (DPI) service. 
     
     
         19 . The gateway device of  claim 15 , wherein the method further comprises:
 determining whether the first service processing module has sufficient bandwidth to handle the first service.   
     
     
         20 . The gateway device of  claim 19 , wherein the method further comprises:
 in response to the first service processing module not having sufficient bandwidth to perform the first service on the packet:   allocating and launching a third service processing module; and   alternatively sending the packet to the third service processing module, the third service processing module performing the first service on the packet to produce the first processed packet.   
     
     
         21 . The gateway device of  claim 15 , further comprising:
 determining whether the second service processing module has sufficient bandwidth to handle the second service.