Abstract: The present disclosure is directed to adaptive networking policy with user defined fields and includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause one or more components to perform operations including generating a user defined attribute (UDA) value corresponding to a set of attributes; receiving, at a network device, a packet having one or more packet conditions; determining that the one or more packet conditions of the packet match the set of attributes of the UDA value; assigning a UDA tag to the packet, wherein the UDA tag corresponds to the UDA value and is configured for chaining with one or more other UDA tags; and taking an action on the packet based on the UDA tag.

Abstract: The present disclosure is directed to adaptive networking policy with user defined fields and includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause one or more components to perform operations including generating a user defined attribute (UDA) value corresponding to a set of attributes; receiving, at a network device, a packet having one or more packet conditions; determining that the one or more packet conditions of the packet match the set of attributes of the UDA value; assigning a UDA tag to the packet, wherein the UDA tag corresponds to the UDA value and is configured for chaining with one or more other UDA tags; and taking an action on the packet based on the UDA tag.

Abstract: Route exchange in a plurality of network controller appliances on a per-tenant basis is disclosed. In one aspect, a method includes receiving, from a network management system and at a first network controller appliance, a designation of at least two tenants to be hosted on the first network controller appliance, the first network controller appliance being one of a plurality of network controller appliances in a SD-WAN; sending, from the first network controller appliance to other network controller appliances of the plurality of network controller appliances, a tenant list query message to obtain a corresponding tenant list of each of the other network controller appliances; and receiving a corresponding response from each of the other network controller appliances indicating the corresponding tenant list of each of the other network controller appliances, the corresponding response being used to update the tenant list on the first network controller appliance.

Abstract: Disclosed is a first device and a second device each sending BFD echo request packets in an initial stage of establishing communication between the two devices. A method can include determining that a certain mode is detected, such as a low bandwidth mode. The method can be practiced by one or both of the devices or a separate network controller. Based on the detection of the certain mode or the communication link being in a certain mode, the method includes the first device or the second device electing to be a master or a slave. Upon establishing that one of the devices is the master and the other of the devices is a slave, only the master will send BFD echo request packets.

Abstract: Route exchange in a plurality of network controller appliances on a per-tenant basis is disclosed. In one aspect, a method includes receiving, from a network management system and at a first network controller appliance, a designation of at least two tenants to be hosted on the first network controller appliance, the first network controller appliance being one of a plurality of network controller appliances in a SD-WAN; sending, from the first network controller appliance to other network controller appliances of the plurality of network controller appliances, a tenant list query message to obtain a corresponding tenant list of each of the other network controller appliances; and receiving a corresponding response from each of the other network controller appliances indicating the corresponding tenant list of each of the other network controller appliances, the corresponding response being used to update the tenant list on the first network controller appliance.

Abstract: The present disclosure is directed to adaptive networking policy with user defined fields and includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause one or more components to perform operations including generating a user defined attribute (UDA) value corresponding to a set of attributes; receiving, at a network device, a packet having one or more packet conditions; determining that the one or more packet conditions of the packet match the set of attributes of the UDA value; assigning a UDA tag to the packet, wherein the UDA tag corresponds to the UDA value and is configured for chaining with one or more other UDA tags; and taking an action on the packet based on the UDA tag.

Abstract: Route exchange in a plurality of network controller appliances on a per-tenant basis is disclosed. In one aspect, a method includes receiving, from a network management system and at a first network controller appliance, a designation of at least two tenants to be hosted on the first network controller appliance, the first network controller appliance being one of a plurality of network controller appliances in a SD-WAN; sending, from the first network controller appliance to other network controller appliances of the plurality of network controller appliances, a tenant list query message to obtain a corresponding tenant list of each of the other network controller appliances; and receiving a corresponding response from each of the other network controller appliances indicating the corresponding tenant list of each of the other network controller appliances, the corresponding response being used to update the tenant list on the first network controller appliance.

Abstract: A method for allocating resources of a virtual controller is disclosed. The method comprises: allocating resources of a virtual controller to a first tenant, wherein the first tenant is allocated a first tenant quantity of guaranteed resources of the virtual controller and a second tenant is allocated a second tenant quantity of guaranteed resources of the virtual controller; determining that resources requested by the first tenant are greater than the first tenant quantity of guaranteed resources; determining that the virtual controller has unutilized resources sufficient to at least partially provide additional resources beyond the first tenant quantity of guaranteed resources to the first tenant; and temporarily provisioning the additional resources to the first tenant, wherein the additional resources are greater than the first tenant quantity of guaranteed resources.

Abstract: In one embodiment, a method includes negotiating, by a networking device, a security association with a peer and receiving, by the networking device, an Internet Protocol (IP) packet from the peer. The IP packet includes an outer IP header, an ESP header, a protocol header, data, an ESP trailer, and ESP authentication data. The method further includes performing, using an IP Security (IPSec) authentication algorithm, authentication checks for the outer IP header, the ESP header, the protocol header, the data, the ESP trailer, and the ESP authentication data of the IP packet.

Abstract: The present disclosure is directed to adaptive networking policy with user defined fields and includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause one or more components to perform operations including generating a user defined attribute (UDA) value corresponding to a set of attributes; receiving, at a network device, a packet having one or more packet conditions; determining that the one or more packet conditions of the packet match the set of attributes of the UDA value; assigning a UDA tag to the packet, wherein the UDA tag corresponds to the UDA value and is configured for chaining with one or more other UDA tags; and taking an action on the packet based on the UDA tag.

Abstract: The present disclosure is directed to unified feature operations, and includes methods comprising receiving, for each of one or more actions that have been defined and downloaded to a data plane, registration information for registering each of the one or more actions, wherein the registration information includes an action handle for identifying a registered action of one or more registered actions; receiving a query from an application module having a composite action comprising at least one custom action to determine if the at least one custom action corresponds to at least one registered action; and in response to determining that the at least one custom action corresponds to at least one registered action, transmitting to the application module at least one action handle corresponding to the at least one registered action, wherein the at least one action handle is used to create a composite action package in the data plane.

Abstract: In one embodiment, a method includes negotiating, by a networking device, a security association with a peer and receiving, by the networking device, an Internet Protocol (IP) packet from the peer. The IP packet includes an outer IP header, an ESP header, a protocol header, data, an ESP trailer, and ESP authentication data. The method further includes performing, using an IP Security (IPSec) authentication algorithm, authentication checks for the outer IP header, the ESP header, the protocol header, the data, the ESP trailer, and the ESP authentication data of the IP packet.

Abstract: Disclosed is a first device and a second device each sending BFD echo request packets in an initial stage of establishing communication between the two devices. A method can include determining that a certain mode is detected, such as a low bandwidth mode. The method can be practiced by one or both of the devices or a separate network controller. Based on the detection of the certain mode or the communication link being in a certain mode, the method includes the first device or the second device electing to be a master or a slave. Upon establishing that one of the devices is the master and the other of the devices is a slave, only the master will send BFD echo request packets.

Abstract: A system, method, and computer-readable medium for emulating traffic shaping. The method includes pre-coloring a packet to provide a pre-colored packet. The pre-colored packet is policed to provide a policed packet. In an example embodiment, the pre-coloring of the packet is performed based on (i) a meterstate and (ii) a true color of the packet. In a further example embodiment, a connection identifier associated with the packet is retrieved from a header of the packet and the connection identifier is correlated with the meterstate. In another example embodiment, the policed packet is marked with a true color of the packet, to provide a marked packet and the marked packet is discarded or forwarded, based on the policed packet.