Cisco Technology, Inc.

Laxmikantha Reddy Ponnuru

Samir D Thoria

Pritam Baruah

Ram Dular Singh

Satish Mahadevan

Arul Murugan Manickam

Anubhav Gupta

Satyajit Das

Avinash Shah

Hamzah Kardame

Managa Sunitha Arun Kumar

Ramanathan Lakshmikanthan

Praveen Raju Kariyanahalli

Michael David Tracy

Kannan Kumar

Gowri Mahendran Lingam Chandramohan

Ajay Kumar Mishra

Vivek Agarwal

Balaji Sundararajan

Alfred C Lindem, Iii

Naiming Shen

Steven W Wood

Prabahar Radhakrishnan

Ramakumara Kariyappa

Jun Zhuang

Ganesh Devendrachar

Venkatesh Nataraj

Jigar Dinesh Parekh

Sourav Sen

Sireesha Yeruva

Jean-Marc Barozet

Vishali Somaskanthan

Prithvi Sharan

Mahesh Eknath Bhole

Veeranjaneyulu Pendyala

Jai Prakash Agrawal

Latika Ahuja

A system facilitates communication between branches of an SD-WAN and a service chain element. A hub node receives a data packet of a flow from a source branch over a VPN segment to be transmitted to a destination branch, extracts flow information from the data packet including VPN segment information to be stored in a flow table before transmitting the data packet to the service chain element over a service chain VPN. Upon return of the data packet from the service chain element, the hub node uses packet tuple information to retrieve the flow information with VPN segment information from the flow table. The hub node can then forward the data packet to the destination branch over the VPN segment. The hub node can generate and store an Auto Service Chaining Key that connects bidirectional flows so that the hub node can apply service-chaining to bidirectional traffic.

Sharing service chains across user VPNs by segment preservation

Systems and methods are provided for receiving bandwidth metrics from a plurality of routers on respective link routes in a network, compiling a link database including the bandwidth metrics of each respective link route in the network, selecting a first designated link path from the link database between a first router and a second router based on an application routing policy, the application routing policy being based on a routing metric, providing a first multiprotocol label switching label based on the first designated link path to the first router of the plurality of routers in the network, and restricting network traffic of the first router to the first designated link path provided in the first multiprotocol label switching label.

Optimizing application performance in hierarchical SD-WAN

Generally, Software-Defined Wide Area Networks (SD-WAN) generally do not support network segmentation. The concepts disclosed herein connects IPSec SD-WAN fabric to a Virtual Routing and Forwarding (VRF) router and make use of a Software Defined Cloud Interconnect (SDCI) Router to route traffic from IPSec SD-WAN to various cloud services from the SDCI Router in the fabric. The concepts disclosed herein also provides for tunnel multi-plexing that takes incoming and outgoing traffic and maps VPNs to any service VRF associated with the cloud based services.

Mapping of IPSec tunnels to SD-WAN segmentation

The subject matter of this disclosure relates in general to the field of computer networking, and more particularly, to systems and methods for discovery of a tunnel for wide area network. Certain aspects provide a method for network path analysis. The method includes sending a first probe packet configured to identify a network tunnel, wherein the first probe packet includes an identifier of the first probe packet and a first time to live (TTL) value that corresponds to a first network hop; receiving a first response message from the first network hop in the network tunnel, wherein the first response message corresponds to the first probe packet and includes the identifier of the first probe packet; and analyzing the network tunnel based on the first response message including the identifier of the first probe packet.

Underlay path discovery for a wide area network

Present disclosure includes determining, at two or more gateway nodes that each communicate with a plurality of branch nodes and a plurality of resources, dynamically a path between each of the plurality of branch nodes and each of the plurality of resources, wherein the path includes one or more virtual routers; generating, at the two or more gateways, dynamically a path length based upon a number of virtual routers each path traverses; automatically translating the path length to an overlay management protocol route preference for each of the plurality of resources.

Systems and methods for optimizing access to cloud resources using preferential localization

In one embodiment, a method includes determining, by a network node, that a first plurality of tunnel interfaces resides in a core region of a network and determining, by the network node, that a second plurality of tunnel interfaces resides in an access region of the network. The method also includes configuring, by the network node, a first tunnel interface as a core regional fallback path for the core region of the network and configuring, by the network node, a second tunnel interface as an access regional fallback path for the access region of the network.

Ultimate regional fallback path for hierarchical SD-WAN

In one embodiment, a method includes receiving, by a first node of a node cluster in a software-defined wide area network (SD-WAN), traffic from a wide area network (WAN), assigning, by the first node of the node cluster, flow ownership of the traffic to the first node, and communicating, by the first node of the node cluster, the traffic to a local area network (LAN). The method also includes receiving, by the first node of the node cluster, return traffic from a second node of the node cluster and detecting, by the first node of the node cluster, a diversion of the return traffic. The method further includes relinquishing, by the first node of the node cluster, the flow ownership and assigning, by the first node of the node cluster, the flow ownership to the second node of the node cluster.

Systems and methods for asymmetrical peer forwarding in an SD-WAN environment

Techniques for enabling service insertion using dynamic service path selection are described herein. In some aspects, the techniques described herein relate to avoiding a service route that passes through a service router when the second-leg path from the service router to a destination router is unreachable. In some cases, the techniques described herein relate to avoiding a route that includes a service router that does not have a path to a viable target in a core service region.

Service insertion in a computer network using dynamic service path selection

According to some embodiments, a method is performed by a software defined wide area network (SD-WAN) edge router in a hierarchical SD-WAN network comprising a plurality of edge routers and a plurality of border routers. The method comprises: originating a SD-WAN system route for advertising reachability to the edge router, the system route comprising an encryption key associated with the edge router; and transmitting the system route to one or more SD-WAN border routers. The method may further comprise: receiving a packet destined for the edge router from one of the one or more SD-WAN border routers, wherein the packet is at least partially encrypted with the encryption key associated with the edge router; and decrypting the received packet.

Optimizing IPSec for hierarchical SD-WAN

An efficient method to handle fragmented packets in multi-node all-active clusters. In one particular embodiment, a method includes receiving an initial fragment packet at a node in a cluster, creating a secondary flow table, linking the secondary flow table to a primary flow table, determining the primary flow owner of the initial fragment packet, and transmitting initial and succeeding fragment packets out of the cluster through, if possible, the primary flow owner.

Efficient handling of fragmented packets in multi-node all-active clusters

Techniques for ensuring symmetric forwarding between disparate networks. The techniques may include receiving a gateway preference order associated with a route advertised by an edge node, the edge node associated with a first network. The techniques may also include determining, based at least in part on the gateway preference order, that a gateway node is a more preferred gateway for the route than another gateway node, the gateway node configured to facilitate communications between the first network and a second network. In some examples, the techniques may also include converting the gateway preference order into a metric associated with an IP routing protocol that is in use in the second network. In some examples, the route including the metric may be distributed within the second network such that the gateway node is the more preferred gateway for return traffic of the route.

Symmetric routing in software-defined networks

According to some embodiments, a software defined wide area network (SD-WAN) includes a first region and a second region. The first region includes multiple first routing controllers and multiple first SD-WAN edge routers. The second region includes multiple second routing controllers and multiple second SD-WAN edge routers. Each first SD-WAN edge router of the first region is configured to establish Overlay Management Protocol (OMP) peering connections with the plurality of first routing controllers of the first region but to avoid establishing OMP peering connections with the plurality of second routing controllers of the second region. Each second SD-WAN edge router of the second region is configured to establish OMP peering connections with the plurality of second routing controllers of the second region but to avoid establishing OMP peering connections with the plurality of first routing controllers of the first region.

Distributed routing controllers for multi-region SDWAN

Disclosed is a first device and a second device each sending BFD echo request packets in an initial stage of establishing communication between the two devices. A method can include determining that a certain mode is detected, such as a low bandwidth mode. The method can be practiced by one or both of the devices or a separate network controller. Based on the detection of the certain mode or the communication link being in a certain mode, the method includes the first device or the second device electing to be a master or a slave. Upon establishing that one of the devices is the master and the other of the devices is a slave, only the master will send BFD echo request packets.

Growing community of inventors

Santa Clara, CA, United States of America

Laxmikantha Reddy Ponnuru