Abstract: Embodiments herein disclose methods for selecting one or more paths for routing application traffic based on application performance metrics for hosted applications. In an embodiment, to select the best path, the available paths can be monitored to understand the performance of specific applications through those paths. Subsequently, the performance data is used to derive an application link score (ALS) for any given combination of application and path. The ALS is then be used to determine the best path for a given application.

Abstract: In an embodiment, a method for providing automatic router assignment in a virtual environment involves receiving a gratuitous ARP packet and setting a default gateway MAC address to a sender hardware address of the received gratuitous ARP packet, wherein the sender hardware address of the received gratuitous ARP packet is a MAC address of a master virtual router elected from a plurality of virtual routers, wherein a virtual router in the plurality of virtual routers is configured to elect a master virtual router by receiving at least one priority value advertised by another virtual router in the plurality of virtual routers, comparing the at least one received priority value to a priority value local to the virtual router to determine which priority value is the highest, and electing the virtual router having the highest priority value as the master virtual router.

Abstract: In an embodiment, a method for providing automatic router assignment in a virtual environment involves receiving a gratuitous ARP packet and setting a default gateway MAC address to a sender hardware address of the received gratuitous ARP packet, wherein the sender hardware address of the received gratuitous ARP packet is a MAC address of a master virtual router elected from a plurality of virtual routers, wherein a virtual router in the plurality of virtual routers is configured to elect a master virtual router by receiving at least one priority value advertised by another virtual router in the plurality of virtual routers, comparing the at least one received priority value to a priority value local to the virtual router to determine which priority value is the highest, and electing the virtual router having the highest priority value as the master virtual router.

Abstract: A method for shaping traffic from an egress port in a software-defined wide-area network (SD-WAN) involves obtaining a stored network bandwidth measurement of the network bandwidth between a source endpoint and a destination endpoint, obtaining a current shaping rate used by the source endpoint when sending data to the destination endpoint, obtaining an updated measurement of the network bandwidth between the source endpoint and the destination endpoint, wherein the updated measurement of network bandwidth is obtained from an SD-WAN controller, determining a new shaping rate based on the stored network bandwidth measurement, the current shaping rate measurement, and the updated measurement of network bandwidth, and configuring the shaping rate used by the source endpoint when sending data to the destination endpoint with the new shaping rate.

Abstract: In accordance with an embodiment of the invention, a method for routing connections in an SD-WAN is disclosed. The method involves receiving TURN server performance metrics via Border Gateway Protocol (BGP) and receiving network performance metrics from calculations made using Service Level Agreement (SLA) protocol data units (PDUs) for TURN servers in an SD-WAN, generating a score for at least one TURN server in the SD-WAN based on the received TURN server performance metrics and received network performance metrics for the at least one TURN server, selecting a TURN server based on the score generated for the at least one TURN server, and routing a connection over the selected TURN server.

Abstract: A method and apparatus for connecting multiple customer sites over a wide area network (WAN) using an overlay network is described. In one embodiment of the invention, each one of multiple customer edge (CE) routers establishes a Border Gateway Protocol (BGP) session with one or more BGP route reflectors and announces their private IP network prefixes and one or more transport IP addresses to reach that CE router. The BGP route reflector(s) reflect those IP network prefixes and the one or more transport IP addresses to reach that specific CE router to the other CE routers. The CE routers receive those reflected IP network prefixes and the corresponding transport IP address(es) to reach that CE router in which those IP network prefixes belong and register them in their corresponding routing/forwarding data structures. In this way, the CE routers learn how to reach each other.

Abstract: A method for protecting data flows between pairs of branch nodes in a software-defined wide-area network (SD-WAN) is disclosed. In an embodiment, the method involves establishing secure connections between a SD-WAN controller and branch nodes in a plurality of branch nodes, wherein each branch node advertises a half-key to the SD-WAN controller via its secure connection, distributing advertised half-keys to branch nodes in the plurality of branch nodes via the established secure connections, wherein the advertised half-keys distributed to each branch node are the half-keys advertised by peer branch nodes of the branch node, and encrypting payloads for transmission from a first branch node in the plurality of branch nodes to a peer branch node in the plurality of branch nodes using a shared secret key, the shared secret key generated using the half-key of the first branch node and the distributed half-key of the peer branch node.

Abstract: A method for shaping traffic across a wide area network is disclosed. The method involves advertising a data rate limit across a wide area network (WAN) from a first node, measuring the rate of data received at a WAN interface of the first node, and, if the measured rate of data received at the WAN interface of the first node exceeds a maximum threshold, advertising a reduced data rate limit across the WAN, and, if the measured rate of data received at the WAN interface of the first node is below a minimum threshold, advertising an increased data rate limit across the WAN.

Abstract: A method for protecting data flows between pairs of branch nodes in a software-defined wide-area network (SD-WAN) is disclosed. In an embodiment, the method involves establishing secure connections between a SD-WAN controller and branch nodes in a plurality of branch nodes, wherein each branch node advertises a half-key to the SD-WAN controller via its secure connection, distributing advertised half-keys to branch nodes in the plurality of branch nodes via the established secure connections, wherein the advertised half-keys distributed to each branch node are the half-keys advertised by peer branch nodes of the branch node, and encrypting payloads for transmission from a first branch node in the plurality of branch nodes to a peer branch node in the plurality of branch nodes using a shared secret key, the shared secret key generated using the half-key of the first branch node and the distributed half-key of the peer branch node.

Abstract: A method for shaping traffic across a wide area network is disclosed. The method involves advertising a data rate limit across a wide area network (WAN) from a first node, measuring the rate of data received at a WAN interface of the first node, and, if the measured rate of data received at the WAN interface of the first node exceeds a maximum threshold, advertising a reduced data rate limit across the WAN, and, if the measured rate of data received at the WAN interface of the first node is below a minimum threshold, advertising an increased data rate limit across the WAN.

Abstract: A method involves setting a link aggregation control protocol (LACP) link state for all links in a first service node to STANDBY to put at least one multiplexer in the first service node in a WAITING state to disable frame collection at the redundant service node and setting the LACP link state for all links in a second service node to SELECTED to put at least one multiplexer in the second service node in a COLLECTING/DISTRIBUTING state to enable frame collection at the primary service node.

Abstract: In general, techniques for implementing a flow distribution service using a plurality of traffic nodes that may operate as processing nodes of a distributed computing system are described. In some examples, the traffic nodes in the aggregate form a virtual appliance configured to apply a network service to packet flows.

Abstract: In general, this disclosure describes techniques for applying, with a network device, subscriber-specific packet processing using an internal processing path that includes service objects that are commonly applied to multiple packet flows associated with multiple subscribers. In one example, a network device control plane creates subscriber records that include, for respective subscribers, one or more variable values that specify service objects as well as an identifier for a packet processing template. A forwarding plane of the network device receives and maps subscriber packets to an associated subscriber record and then processes the packet by executing the packet processing template specified by the subscriber record. When the forwarding plane reaches a variable while executing the specified packet processing template, the forwarding plane reads the associated variable value from the subscriber record to identify and then apply the subscriber-specific service object specified by the variable.

Abstract: A method and apparatus for connecting multiple customer sites over a wide area network (WAN) using an overlay network is described. In one embodiment of the invention, each one of multiple customer edge (CE) routers establishes a Border Gateway Protocol (BGP) session with one or more BGP route reflectors and announces their private IP network prefixes and one or more transport IP addresses to reach that CE router. The BGP route reflector(s) reflect those IP network prefixes and the one or more transport IP addresses to reach that specific CE router to the other CE routers. The CE routers receive those reflected IP network prefixes and the corresponding transport IP address(es) to reach that CE router in which those IP network prefixes belong and register them in their corresponding routing/forwarding data structures. In this way, the CE routers learn how to reach each other.

Abstract: In general, techniques are described for aggregating, within a network device, internal forwarding routes for multiple control protocols and allocating next hops for the routes among individual service units of a decentralized control plane for the network device. The techniques may also include aggregating internal forwarding routes for data protocols and allocating next hops for the routes among individual forwarding units of a decentralized data plane for the network device. In one example, a mobile gateway includes a plurality of subscriber management service units that present a uniform interface to nodes within a mobile service provider network. An allocation manager apportions a control protocol session identifier namespace into a plurality of contiguous, non-overlapping protocol session identifier ranges and allocates the ranges among the service units.

Abstract: A method and apparatus for connecting multiple customer sites over a wide area network (WAN) using an overlay network is described. In one embodiment of the invention, each one of multiple customer edge (CE) routers establishes a Border Gateway Protocol (BGP) session with one or more BGP route reflectors and announces their private IP network prefixes and one or more transport IP addresses to reach that CE router. The BGP route reflector(s) reflect those IP network prefixes and the one or more transport IP addresses to reach that specific CE router to the other CE routers. The CE routers receive those reflected IP network prefixes and the corresponding transport IP address(es) to reach that CE router in which those IP network prefixes belong and register them in their corresponding routing/forwarding data structures. In this way, the CE routers learn how to reach each other.

Abstract: In general, a mobile virtual private network (VPN) is described in which service provider networks cooperate to dynamically extend a virtual routing area of a home service provider network to the edge of a visited service provider network and thereby enable IP address continuity for a roaming wireless device. In one example, a home service provider network allocates an IP address to a wireless device and establishes a mobile VPN. The home service provider network dynamically provisions a visited service provider network with the mobile VPN, when the wireless device attaches to an access network served by the visited service provider network, to enable the wireless device to exchange network traffic with the visited service provider network using the IP address allocated by the home service provider network.

Abstract: A first and second thread-local counter is allocated to a first and second thread respectively, where the first thread-local counter is updatable only by or on behalf of the first thread and the second thread-local counter is updatable only by or on behalf of the second thread. The first and second thread-local counter are updated and the updated values are communicated to a central process. The central process updates a single counter in a central database by a value equal to the sum of the updated counter values.

Abstract: Techniques are described for performing inline NAT functions in a forwarding element of a mobile gateway router or other device in which subscriber sessions of a mobile access network are distributed across a plurality of session management cards. The session management cards pre-allocate a public network address and port range for subscribers at the time a network connection is established in response to connection request prior to receiving any data traffic associated with the subscriber. NAT profiles are programmed into hardware forwarding elements of the mobile gateway router for inline NAT when routing subscriber traffic for the mobile access network.

Abstract: In general, techniques for implementing a flow distribution service using a plurality of traffic nodes that may operate as processing nodes of a distributed computing system are described. In some examples, the traffic nodes in the aggregate form a virtual appliance configured to apply a network service to packet flows.