Replicating data over a public network

Abstract

A technique includes causing an agent device to setup a replication partnership between a first storage node and a second storage. Causing the agent device to setup the replication partnership includes configuring a proxy server that is associated with the second storage node to establish a secure communication channel for the replication partnership over a public network. Configuring the proxy server includes storing in the proxy server credentials for authenticating the first storage node to use the secure communication channel; and establishing port translations to be used in the secure communication channel in communicating replication data between the first storage node and the second storage node. Causing the agent device to setup the replication partnership may also include communicating replication partnership information to the second node.

What is claimed is: 
     
         1 . A method comprising:
 causing an agent device to set up a replication partnership between a first storage node and a second storage node, wherein causing the agent device to setup the replication partnership comprises:
 configuring a proxy server that is associated with the second storage node to establish a secure communication channel for the replication partnership over a public network, wherein configuring the proxy server comprises:
 storing in the proxy server credentials for authenticating the first storage node to use the secure communication channel; and 
 establishing port translations to be used in the secure communication channel in communicating replication data between the first storage node and the second storage node; and 
 
 communicating replication partnership information to the second storage node. 
   
     
     
         2 . The method of  claim 1 , wherein the proxy server and the second storage node comprise part of a private network;
 the private network comprises a plurality of storage nodes, including the second storage node; and   configuring the proxy server further comprises selecting the second storage node from among the plurality of storage nodes.   
     
     
         3 . The method of  claim 1 , wherein establishing the port translations comprises configuring local tunnel and reverse tunnel port translations associated with a public Internet Protocol (IP) address of the proxy server. 
     
     
         4 . The method of  claim 1 , wherein configuring the proxy server comprises configuring the proxy server to communicate with a tunnel endpoint associated with the first storage node. 
     
     
         5 . The method of  claim 1 , further comprising:
 providing a portal accessible through a public network to receive data representing the credentials of the first storage node.   
     
     
         6 . The method of  claim 5 , further comprising:
 using the portal to receive input identifying a geographic region for a replication partner for the first storage node;   selecting the second storage node based on the identified geographic region; and   communicating an identifier to the proxy server, wherein the identifier identifies the second storage node.   
     
     
         7 . The method of  claim 6 , further comprising:
 further basing selection of the second storage node on input identifying a storage tier associated with the replication partnership.   
     
     
         8 . The method of  claim 1 , wherein configuring the proxy server further comprises configuring the proxy server to select one of the first storage node and the second storage node to be a replication source or a replication target. 
     
     
         9 . The method of  claim 1 , wherein configuring the proxy server further comprises:
 communicating a key associated with the first storage node to the proxy server.   
     
     
         10 . The method of  claim 1 , wherein configuring the proxy server further comprises communicating data to the proxy server representing a replication partnership identification associated with the first storage node and a replication partnership credential associated with the first storage node. 
     
     
         11 . The method of  claim 1 , wherein configuring the proxy server further comprises communicating data representing an identification of the first storage node. 
     
     
         12 . An apparatus comprising:
 at least one processor; and   a memory that stores instructions that, when executed by the at least one processor, cause the at least one processor to:
 store in a proxy server credentials for authenticating a first storage node to use a secure communication channel, wherein the first storage node is associated with a replication partnership with a second storage node; 
 establish port translations to be used in the secure communication channel to communicate replication data between the first storage node and the second storage node; and 
 communicate replication partnership information to the second storage node. 
   
     
     
         13 . The apparatus of  claim 12 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
 provide a portal accessible through a public network to receive data representing a credential of the first storage node.   
     
     
         14 . The apparatus of  claim 13 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to:
 use the portal to receive input identifying a geographic region for a replication partner for the first storage node;   select the second storage node based on the identified geographic region; and   communicate an identifier to the proxy server, wherein the identifier identifies the second storage node.   
     
     
         15 . The apparatus of  claim 12 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to configure the proxy server to set up a network tunnel. 
     
     
         16 . The apparatus of  claim 15 , wherein the network tunnel comprises a Secure Shell (SSH) tunnel. 
     
     
         17 . A non-transitory storage medium storing instructions that, when executed by a machine, cause the machine to:
 provide an interface to receive input representing a credential associated with a first storage node and input representing criteria to select a replication partner storage node for the first storage node;   access a proxy server for the replication partner storage node;   communicate data representing the credential to the proxy server; and   communicate with the proxy server to set up port forwarding for a future secure network tunnel to communicate replication data between the first storage node and the replication partner storage node, wherein the proxy server forms an endpoint of the secure network tunnel and the first storage node forms another endpoint of the secure network tunnel.   
     
     
         18 . The non-transitory storage medium of  claim 17 , wherein the instructions, when executed by the machine, cause the machine to:
 provide access to the interface via a public network.   
     
     
         19 . The non-transitory storage medium of  claim 17 , wherein the instructions, when executed by the machine, cause the machine to communicate with the proxy server to reserve a public network port of the proxy server and map the public network port to a private network port of the replication partner storage node. 
     
     
         20 . The non-transitory storage medium of  claim 17 , wherein the instructions, when executed by the machine, cause the machine to select the replication partner based on a selection criteria.