Vmware, Inc.

Juniper Networks, Inc.

Velocloud Networks, LLC

Navaneeth Krishnan Ramaswamy

Gopa Kumar

Arun Kumar Srinivasan

Balaji Shanmugam

Ganesh Srinivasan

Sumit Mundhra

Saravanan Kandasamy

Stephen Craig Connors

Junxiao He

Jaspal Kohli

Kumar Narayanan

Gopakumar Choorakkot Edakkunni

Sivakumar Somasundaram

Varsha Venkata Krishnan

Shivaram Rammohan

Hari Narayan Gopalan

Murtaza Zafer

Vaibhav Diwakar Kulkarni

Ankit Kumar Sinha

Sasikumar Balasubramanian

Some embodiments of the invention provide a method for implementing an SD-WAN connecting multiple sites at multiple physical locations. The method is performed at a first route reflector for a first region of the SD-WAN. The method receives, from a hub router of the first region, a peer-connection notification regarding a newly connected first edge router located at a first site in a second region. The method determines that a routing table maintained by the first route reflector does not include routes of the first edge router and that the first route reflector does not have a direct connection to the first edge router. Based on said determining, the method requests routes of the first edge router from the hub router. After receiving from the hub router the requested routes of the first edge router, the method updates the routing table to include the routes of the first edge router.

Distributed gateways for multi-regional large scale deployments

Some embodiments provide a method for a software-defined wide area network (SD-WAN) connecting first and second sites, with the first site including an edge node and the second site including multiple forwarding hub nodes. At the edge node of the first site, the method receives a packet of a particular flow including a flow attribute. The method uses the flow attribute to identify a hub-selection rule from multiple hub-selection rules, each hub-selection rule identifying at least one forwarding hub node at the second site for receiving one or more flows from the first site, and at least one hub-selection rule identifying at least one forwarding hub node that is not identified by another hub-selection rule. The method uses the identified hub-selection rule to identify a forwarding hub node for the particular flow. The method then sends the packet from the edge node at the first site to the identified forwarding hub node at the second site.

Methods and apparatus for application aware hub clustering techniques for a hyper scale SD-WAN

Some embodiments of the invention provide a method for micro-segmenting traffic flows in a software defined wide area network (SD-WAN). At a first edge forwarding node of a first multi-machine site in the SD-WAN, the method receives, from a particular forwarding element, a first packet of a packet flow originating from a second multi-machine site that is external to the SD-WAN, the packet flow destined for a particular machine at the first multi-machine site. The method uses deep packet inspection (DPI) on the first packet to identify contextual information not provided by the particular forwarding element about the first packet and the packet flow. Based on the identified contextual information, the method applies one or more policies to the first packet before forwarding the first packet to the particular machine.

Methods for micro-segmentation in SD-WAN for virtual networks

Some embodiments of the invention provide a method for forwarding packets through an SD-WAN. The method is performed at a route reflector that advertises routes to facilitate forwarding of packets between first and second regions of the SD-WAN. The method advertises (1) to a first set of edge routers in the first region, a first route identifying a next-hop first hub router for initiating communications with a second set of edge routers in the second region, and (2) to the second set of edge routers, a second route identifying a next-hop second hub router for initiating communications with the first set of edge routers. When the second hub router loses connectivity to a first edge router of the first set of edge routers, the method advertises to the second set of edge routers a third route identifying the next-hop first hub router for initiating communications with the first edge router.

Forwarding packets in multi-regional large scale deployments with distributed gateways

Some embodiments provide a method for modifying an SD-WAN (software-defined wide-area network). The method collects, from a set of managed forwarding elements (MFEs), multiple metrics associated with multiple data message flows sent between the set of MFEs. The method analyzes the collected multiple metrics to group the data message flows according to multiple types and to identify a ranking of the multiple groups of data message flows according to traffic throughput. The method uses the ranking to identify a set of one or more groups of data message flows. The method modifies the SD-WAN to improve forwarding through the SD-WAN for the identified set of one or more groups of data message flows.

Modifying an SD-wan based on flow metrics

Some embodiments of the invention provide a method for forwarding packets through an SD-WAN. To facilitate the forwarding of packets between first and second regions of the SD-WAN, said first and second regions having respective first and second hub routers forwarding packets between respective first and second sets of edge routers of respective first and second sets of sites of the first and second regions, the method directs (1) the first set of edge routers to establish connections to the first and second hub routers, and to use the first hub router as a next-hop to initiate communications with the second set of edge routers, and (2) the second set of edge routers to establish connections to the first and second hub routers, and to use the second hub router as a next-hop to initiate communications with the first set of edge routers.

Some embodiments provide a method for dynamically deploying a managed forwarding element (MFE) in a software-defined wide-area network (SD-WAN) for a particular geographic region across which multiple SaaS applications is distributed. The method determines, based on flow patterns for multiple flows destined for the multiple SaaS applications distributed across the particular geographic region, that an additional MFE is needed for the particular geographic region. The method configures the additional MFE to deploy at a particular location in the particular geographic region for forwarding the multiple flows to the multiple SaaS applications. The method provides, to a particular set of MFEs that connect a set of branch sites to the SD-WAN, a set of forwarding rules to direct the particular set of MFEs to use the additional MFE for forwarding subsequent data messages belonging to the multiple flows to the multiple SaaS applications.

Method for modifying an SD-WAN using metric-based heat maps

Some embodiments provide a method of selecting data links for an application in a network. The method receives, from a machine implementing the application, a set of identifiers of required link characteristics. Based on at least one of the identifiers, the method selects a transport group that includes a set of optional links matching the identifiers. From the selected transport group, the method selects a link matching the set of identifiers.

Methods for application defined virtual network service among multiple transport in sd-wan

Some embodiments of the invention provide a method for network-aware load balancing for data messages traversing a software-defined wide area network (SD-WAN) (e.g., a virtual network) including multiple connection links between different elements of the SD-WAN. The method includes receiving, at a load balancer in a multi-machine site, link state data relating to a set of SD-WAN datapaths including connection links of the multiple connection links. The load balancer, in some embodiments, provides load balancing for data messages sent from a machine in the multi-machine site to a set of destination machines (e.g., web servers, database servers, etc.) connected to the load balancer over the set of SD-WAN datapaths. The load balancer selects, for the data message, a particular destination machine (e.g., a frontend machine for a set of backend servers) in the set of destination machines by performing a load balancing operation based on the received link state data.

Network-aware load balancing

Some embodiments provide a method for performing deep packet inspection (DPI) for an SD-WAN (software defined, wide area network) established for an entity by a plurality of edge nodes and a set of one or more cloud gateways. At a particular edge node, the method uses local and remote deep packet inspectors to perform DPI for a packet flow. Specifically, the method initially uses the local deep packet inspector to perform a first DPI operation on a set of packets of a first packet flow to generate a set of DPI parameters for the first packet flow. The method then forwards a copy of the set of packets to the remote deep packet inspector to perform a second DPI operation to generate a second set of DPI parameters. In some embodiments, the remote deep packet inspector is accessible by a controller cluster that configures the edge nodes and the gateways. In some such embodiments, the method forwards the copy of the set of packets to the controller cluster, which then uses the remote deep packet inspector to perform the remote DPI operation. The method receives the result of the second DPI operation, and when the generated first and second DPI parameters are different, generates a record regarding the difference.

Performing deep packet inspection in a software defined wide area network

Some embodiments of the invention provide a method of sending data messages from an edge router at a first location of an enterprise network to a SaaS (software as a service) application server provided by a third-party at a second location. The method receives, from a DNS (domain name system) first server, a resolution for a particular destination network address for the SaaS application server at the second location. From a second server, the method obtains an identifier for a first cloud gateway from multiple cloud gateways at multiple locations through which the particular destination address for the SaaS application server can be reached, the first cloud gateway farther from the first location than a second cloud gateway in the multiple cloud gateways but closer to the second location than the second cloud gateway. The method uses an optimized SD-WAN connection to the first cloud gateway to forward data messages for the first cloud gateway to the SaaS application at the second location.

DNS-based GSLB-aware SD-WAN for low latency SaaS applications

The method of some embodiments selects a set of links to forward packets of a data flow from an application running on a machine connected to an SD-WAN that has multiple exits. The method, based on computed sets of attributes for a first set of links and a second set of links, selects between the first set of links and the second set of links. At least the first set of links has multiple links and at least one attribute of the first set of links is an attribute that is computed by aggregating an attribute of each of the links in the first set of links. The method uses the selected set of links to forward the packets of the data flow of the application to an egress managed forwarding element of the SD-WAN.

Methods for smart bandwidth aggregation based dynamic overlay selection among preferred exits in SD-WAN

Some embodiments provide a method of transmitting data in a logical network that includes multiple hubs in a hub cluster and multiple branches. Each branch connects to a hub of the cluster through a virtual private network (VPN) tunnel. The method is performed by a network controller. The method assigns one of the hubs as a master hub. The method then sends a command to each of the other hubs in the hub cluster to establish a VPN tunnel between the other hub and the master hub. The method then advertises, to the other hubs, routes between the other hubs through the master hub. Each branch, in some embodiments is connected to only one hub in the hub cluster.

Methods to support dynamic transit paths through hub clustering across branches in SD-WAN

Some embodiments of the invention provide a method of dynamically scaling a hub cluster in a software-defined wide area network (SD-WAN) based on particular traffic statistics, the hub cluster being located in a datacenter of the SD-WAN and allowing branch sites of the SD-WAN to access resource of the datacenter by connecting to the hub cluster. A controller of the SD-WAN receives, from the hub cluster, traffic statistics centrally captured at the hub cluster. The controller then analyzes these statistics to identify traffic load fluctuations, and determines that a number of hubs in the hub cluster should be adjusted based on the identified fluctuations. The controller adjusts the number of hubs in the hub cluster based on the determination.

Dynamic SD-WAN hub cluster scaling with machine learning

Described herein are systems, methods, and software to manage communication path configurations between edge gateways in a computing environment. In at least one implementation, a controller monitors network characteristics associated with routes from a first edge gateway to a second edge gateway and determines whether a first route configuration for the first edge gateway to communicate with the second edge gateway fails to satisfy criteria based on the network characteristics. If the first route configuration fails to satisfy the criteria, the controller determines a second route configuration and applies the second route configuration for the first edge gateway to communicate with the second edge gateway.

Growing community of inventors

Chennai, India

Navaneeth Krishnan Ramaswamy