Abstract: A flow identifier is described for packet sequences through a secure tunnel of an SD-WAN and an error message for recovering the flow. A method includes receiving a sequence of packets, facilitating a first secure tunnel between a first hub and a second hub, assigning a first flow identifier to the sequence of packets, encapsulating a first start packet, the wrapper including the first flow identifier, sending the encapsulated first start packet to the second hub through the first secure tunnel, receiving an error message from the second hub, the error message including the first flow identifier and an error code, facilitating a second secure tunnel, assigning a second flow identifier, encapsulating a second start packet, the wrapper including the second flow identifier, and sending the encapsulated second start packet through the second secure tunnel.

Abstract: Embodiments herein disclose path selection for data traffic within a software-defined wide area network using traffic metrics. Some embodiments relate to a method that includes polling peers of the SD-WAN for traffic metrics, receiving traffic metrics from at least a portion of the peers, combining the received traffic metrics, calculating performance of a plurality of possible paths from a source node to a destination node, the nodes being within the SD-WAN topology, and selecting a path from the source node to the destination node based on the calculated performance.

Abstract: End-to-end data packet flow control is described for an overlay environment of a wide area network. A method includes detecting an active session of a specific application with a source node and a destination node within an overlay environment, detecting a traffic flow from the source node to the destination node associated with the active session, mapping the traffic flow to a dedicated service processing thread of a network services appliance, mapping an identifier to the dedicated service processing thread, and forwarding the traffic flow to the destination node through the dedicated service processing thread by applying the identifier to the traffic flow.

Abstract: A non-transitory computer readable medium, a system, and a method for displaying a remote browser isolation (RBI) configuration window are disclosed. In an embodiment, a non-transitory computer readable medium includes instructions to be executed in a computer system, where the instructions when executed in the computer system perform a method comprising displaying an RBI configuration window, displaying an on/off activation feature within the RBI configuration window, and displaying an RBI profile selection menu within the RBI configuration window, where the RBI profile selection menu includes a plurality of spatially grouped sets that include an RBI profile selector, RBI profile identifier text, and selectable RBI protected browsing action icons that indicate to a user whether a corresponding RBI protected browsing action is included in an RBI policy.

Abstract: Embodiments herein disclose conditioning traffic through multiple data paths of a Software-Defined Wide Area Network (SD-WAN). Some embodiments include monitoring a path through an SD-WAN to reach a destination node, determining a quality score for packets to the destination node on the path, determining a link utilization for the path, sending a data packet sequence to the destination node on the path, generating a forward error correction (FEC) packet for the data packet sequence, and sending the FEC packet to the destination node on the path in response to the quality score being less than a quality threshold and the link utilization being less than a high utilization threshold.

Abstract: Malware can be automatically detected and countermeasures automatically generated. A virtual machine (VM) is run with an operating system configured with a monitoring subsystem. The monitoring subsystem is configured to generate event data based on events occurring on the virtual machine. The monitoring subsystem can run within the operating system kernel. Kernel drivers can register to receive specific events. The events are therefore sent to the drivers, which can send them to a classifier. The classifier can detect malware based on the events. When a sample is run on the VM, the classifier can detect malware in the sample. While running the sample, event data is collected. A countermeasure compiler can generate a countermeasure to the malware, the countermeasure based on the event data.

Abstract: Methods and system for providing network connectivity are disclosed. In an embodiment, a method for providing network connectivity involves receiving from a Mobile Network Operator (MNO) an access ID and an IP address at a SASE domain, wherein the access ID and the IP address correspond to a wireless device, generating an IP address-to-tenant mapping at the SASE domain by applying the access ID and the IP address to an access ID-to-tenant mapping, and forwarding traffic received at the SASE domain from the wireless device via the MNO according to the IP address-to-tenant mapping.

Abstract: Embodiments of methods and systems for managing traffic across a WAN are disclosed. A method for managing traffic across a WAN involves identifying incoming traffic as Direct Internet Access (DIA) traffic at a first node, identifying incoming traffic as SD-WAN traffic at the first node, policing the DIA traffic at the first node, and adapting the policing of the DIA traffic at the first node in response to a comparison between the SD-WAN traffic and an SD-WAN traffic threshold.

Abstract: End-to-end data packet flow control is described for an overlay environment of a wide area network. A method includes detecting an active session of a specific application with a source node and a destination node within an overlay environment, detecting a traffic flow from the source node to the destination node associated with the active session, mapping the traffic flow to a dedicated service processing thread of a network services appliance, mapping an identifier to the dedicated service processing thread, and forwarding the traffic flow to the destination node through the dedicated service processing thread by applying the identifier to the traffic flow.

Abstract: Embodiments herein disclose conditioning traffic through multiple data paths of a Software-Defined Wide Area Network (SD-WAN). Some embodiments include monitoring available paths through an SD-WAN to reach a destination node, determining a quality score for packets to the destination node on a first path of the available paths, sending a data packet sequence to the destination node on the first path, generating a forward error correction (FEC) packet for the packet sequence, and sending the FEC packet to the destination node on a second path of the available paths in response to the quality score being less than a quality threshold.

Abstract: Method and systems for transitioning a wireless device between client-less connectivity and client-based connectivity are disclosed. In an embodiment, a method for transitioning a wireless device between client-less connectivity and client-based connectivity involves forwarding traffic from a wireless device through a SASE domain, receiving a request for information related to a SASE gateway in the SASE domain from the wireless device, transmitting information related to the SASE gateway from the SASE domain to the wireless device in response to the request, and transitioning the wireless device between client-less connectivity to the SASE gateway and client-based connectivity to the SASE gateway.

Abstract: Method and systems for transitioning a wireless device between client-less connectivity and client-based connectivity are disclosed. In an embodiment, a method for transitioning a wireless device between client-less connectivity and client-based connectivity involves forwarding traffic from a wireless device through a SASE domain, receiving a request for information related to a SASE gateway in the SASE domain from the wireless device, transmitting information related to the SASE gateway from the SASE domain to the wireless device in response to the request, and transitioning the wireless device between client-less connectivity to the SASE gateway and client-based connectivity to the SASE gateway.

Abstract: Methods and system for providing network connectivity are disclosed. In an embodiment, a method for providing network connectivity involves receiving from a Mobile Network Operator (MNO) an access ID and an IP address at a SASE domain, wherein the access ID and the IP address correspond to a wireless device, generating an IP address-to-tenant mapping at the SASE domain by applying the access ID and the IP address to an access ID-to-tenant mapping, and forwarding traffic received at the SASE domain from the wireless device via the MNO according to the IP address-to-tenant mapping.

Abstract: Embodiments herein disclose conditioning traffic through multiple data paths of a Software-Defined Wide Area Network (SD-WAN). Some embodiments include monitoring a first and a second path through an SD-WAN to reach a destination node, comparing the link utilization for the first and the second path to generate an allocation ratio of the first and the second path, allocating a sequence of data packets to the first and the second path using the allocation ratio to generate a first path data sequence and a second path data sequence, generating a forward error correction (FEC) packet for first path sequence, sending the first path data sequence to the destination node on the first path, sending the second path data sequence to the destination node on the second path, and sending the FEC packet on at least one of the first and the second path.

Abstract: Embodiments of methods and systems for managing traffic across a WAN are disclosed. A method involves advertising an input rate limit across a WAN from a first node, advertising an input distribution array across the WAN from the first node, wherein the input distribution array includes forwarding class-specific weights, and adapting at least one of the input rate limit and the input distribution array in response to an error between a target forwarding class distribution and an observed input traffic distribution.

Abstract: A system and a method are described for data packet fragmentation for replicated packet traffic through an SD-WAN. In an example a first packet has an internet protocol identification (IP-ID). The first packet is replicated to create a second packet. The first packet and the second packet are fragmented into fragments for transmission through a tunnel in one or more paths between the source address and the destination address. The IP-ID of the second packet is modified. The fragments of the first packet and the second packet are separately encapsulated. The first and second packet fragments are received through the tunnel at a second node. The second node reassembles the first packet using the first packet fragments and reassembles the second packet using the second packet fragments. The IP-ID of the reassembled second packet is restored to be the IP-ID of the first packet.

Abstract: An advancement over previous techniques uses push notifications to inform users of actions by a security appliance or network gateway. The network gateway provides network gateway services to a user device and enforces security policies on the communications to and from the user device. When a security policy blocks a communication, the user may know network traffic is being lost but does not know why. The user device can subscribe to a push server using a public encryption key provided by the security appliance. The security appliance can thereafter send push notifications via the push server to the user. The push notifications can inform the user of security policies being applied to communications to and from the user device.

Abstract: A WI-FI access point can be configured to communicate with a service set using a service set identifier (SSID) and to respond to, or not respond to, probe requests based on whether the WI-FI access point is a preferred access point for the SSID. The WI-FI access point can have a probe suppression indicator that indicates suppressive when the access point is not preferred and that indicates responsive when the access point is preferred. Transmitting a WI-FI beacon having a SSID value equaling the SSID can inform WI-FI clients of the service set. The WI-FI clients can transmit probe requests having SSID values equaling the SSID. The WI-FI access point can suppress sending probe responses responsive to the probe requests when the probe suppression indicator indicates suppressive. The WI-FI access point can send probe responses responsive to the probe requests when the probe suppression indicator indicates responsive.

Abstract: High availability router switchover decision are described using monitoring and policies. In one example, available network routing parameters are monitored. A change of one of the network routing parameters is detected. A parameter matrix of network routing parameters is updated in response to the detected change. The changed network routing parameters are applied to a policy in response to updating the parameter matrix and a switchover request is sent to a standby network node when the policy is mite by the changed network routing parameter.

Abstract: An advancement over previous techniques uses push notifications to provide users with proxied communications to outside devices reachable using a security appliance or network gateway. Encrypted direct communication between a user device with the outside device is blocked and the user device is provided with a proxy URL at which indirect proxied communications can be provided. A proxy at the proxy URL can read the communications between the user device and the outside device. The proxy can thereby apply security policies to the indirect proxied communications. The security appliance can provide the proxy URL to the user device via a push server.