Cisco Technology, Inc.

Venkatesh Nataraj

Balaji Sundararajan

Kannan Kumar

Saravanan Radhakrishnan

Laxmikantha Reddy Ponnuru

Pritam Baruah

Srilatha Tangirala

Kushal A Patel

Steven W Wood

Padmanabha Nallur

Ganesh Devendrachar

Avinash Shah

Gowri Mahendran Lingam Chandramohan

Pradeepan Kannawadi

Kartik Katti

Ambika Basappa Chandrappa

Faizan Amjad Mohammed

Abha Jain

Sasi Veera

Techniques for automatically integrating SD-WAN constructs to security policies are described. The techniques may include defining, by a security cloud provider, a security policy for an entity, the entity represented by a VPN security policy label and the security policy absent source and destination CIDR IP addresses. The security cloud provider notifies an SD-WAN controller of the security policy. The SD-WAN controller maps the VPN security policy label to an IP address pool and a VPN ID. The SD-WAN controller generates an enhanced security policy by automatically adding source and destination CIDR IP addresses to the security policy. The SD-WAN controller deploys the enhanced security policy to an SD-WAN branch router and generates a VPN segment between the SD-WAN branch router and the security cloud provider to establish a common secure internet gateway tunnel for the IP address pool.

Integrating SD-WAN constructs with SASE security policies

Generally, Software-Defined Wide Area Networks (SD-WAN) generally do not support network segmentation. The concepts disclosed herein connects IPSec SD-WAN fabric to a Virtual Routing and Forwarding (VRF) router and make use of a Software Defined Cloud Interconnect (SDCI) Router to route traffic from IPSec SD-WAN to various cloud services from the SDCI Router in the fabric. The concepts disclosed herein also provides for tunnel multi-plexing that takes incoming and outgoing traffic and maps VPNs to any service VRF associated with the cloud based services.

Mapping of IPSec tunnels to SD-WAN segmentation

This disclosure describes techniques for orchestrating implementation of a security solution among network devices. The techniques include determining capabilities of routers of the network and capabilities of a cloud security service to perform security features of a security solution. Based at least in part on the capabilities, the techniques include configuring a router of the network to execute a first subset of the security features on data traffic of the network, and configuring the cloud security service to execute a second subset of the security features on the data traffic. The techniques may also include causing the security solution to be presented to a security administrator via a display, the display providing representations of the first subset and the second subset of the security features.

Security solution orchestration

This disclosure describes techniques and mechanisms for disclosure describes techniques and mechanisms for optimizing firewall enforcement. The techniques may implement a dynamic detection of Layer 7 processing at one end of the network, alleviating the need to enforce another layer 7 firewall inspection at the other end, thereby saving processing and network resources. The techniques enable firewalls and policies to be statically defined and located in one place.

Service optimization in networks and cloud interconnects

In one embodiment, a method includes receiving, by a network controller, network characteristics from a network component. The network characteristics are associated with one or more nodes of a network. The method also includes analyzing, by the network controller, the network characteristics to generate configuration parameters for the one or more nodes of the network. The method further includes communicating, by the network controller, the configuration parameters to the one or more nodes of the network.

Systems and methods for dynamically optimizing TCP flow in WAN networks

Growing community of inventors

Union City, CA, United States of America

Venkatesh Nataraj