Abstract: Some embodiments of the invention provide a method for forwarding packets through an SD-WAN. To facilitate the forwarding of packets between first and second regions of the SD-WAN, said first and second regions having respective first and second hub routers forwarding packets between respective first and second sets of edge routers of respective first and second sets of sites of the first and second regions, the method directs (1) the first set of edge routers to establish connections to the first and second hub routers, and to use the first hub router as a next-hop to initiate communications with the second set of edge routers, and (2) the second set of edge routers to establish connections to the first and second hub routers, and to use the second hub router as a next-hop to initiate communications with the first set of edge routers.

Abstract: Some embodiments provide a method for dynamically deploying a managed forwarding element (MFE) in a software-defined wide-area network (SD-WAN) for a particular geographic region across which multiple SaaS applications is distributed. The method determines, based on flow patterns for multiple flows destined for the multiple SaaS applications distributed across the particular geographic region, that an additional MFE is needed for the particular geographic region. The method configures the additional MFE to deploy at a particular location in the particular geographic region for forwarding the multiple flows to the multiple SaaS applications. The method provides, to a particular set of MFEs that connect a set of branch sites to the SD-WAN, a set of forwarding rules to direct the particular set of MFEs to use the additional MFE for forwarding subsequent data messages belonging to the multiple flows to the multiple SaaS applications.

Abstract: Some embodiments of the invention provide a method for implementing an SD-WAN connecting multiple sites at multiple physical locations. The method is performed at a first hub router of the SD-WAN. The method establishes, with a first edge router located at a first site in a first region, a new connection for the first hub router to use to connect the first edge router to a second edge router of a second site in the first region. The method determines that a peer-connection notification regarding a set of other routers of which the first hub router has been notified has to be sent to the first edge router. The method sends the peer-connection notification to the first edge router for the first edge router to analyze in order to determine whether the first edge router needs to obtain routes associated with each other router in the set of other routers.

Abstract: Some embodiments of the invention provide a method of detecting and remediating anomalies in an SD-WAN implemented by multiple forwarding elements (FEs) located at multiple sites connected by the SD-WAN. The method receives, from the multiple FEs, multiple sets of flow data associated with application traffic that traverses the multiple FEs. The method uses a first set of machine-trained processes to analyze the multiple sets of flow data in order to identify at least one anomaly associated with at least one particular FE in the multiple FEs. The method uses a second set of machine-trained processes to identify at least one remedial action for remediating the identified anomaly. The method implements the identified remedial action by directing an SD-WAN controller deployed in the SD-WAN to implement the identified remedial action.

Abstract: Some embodiments of the invention provide a method for forwarding packets through an SD-WAN. To facilitate the forwarding of packets between first and second regions of the SD-WAN, said first and second regions having respective first and second hub routers forwarding packets between respective first and second sets of edge routers of respective first and second sets of sites of the first and second regions, the method directs (1) the first set of edge routers to establish connections to the first and second hub routers, and to use the first hub router as a next-hop to initiate communications with the second set of edge routers, and (2) the second set of edge routers to establish connections to the first and second hub routers, and to use the second hub router as a next-hop to initiate communications with the first set of edge routers.

Abstract: Some embodiments of the invention provide a method for implementing an SD-WAN connecting multiple sites at multiple physical locations. The method is performed at a first route reflector for a first region of the SD-WAN. The method receives, from a hub router of the first region, a peer-connection notification regarding a newly connected first edge router located at a first site in a second region. The method determines that a routing table maintained by the first route reflector does not include routes of the first edge router and that the first route reflector does not have a direct connection to the first edge router. Based on said determining, the method requests routes of the first edge router from the hub router. After receiving from the hub router the requested routes of the first edge router, the method updates the routing table to include the routes of the first edge router.

Abstract: Some embodiments of the invention provide a method for providing asymmetric route resolutions in an SD-WAN. The method is performed at a first edge router at a first site in a first region connected by the SD-WAN. From a first hub router of a first cluster, the method receives a flow sent by a second edge router at a second site in a second region via a first route that points to a next-hop second hub router of a second cluster. The method identifies a default second route from the first edge router to the second edge router pointing to a next-hop third hub router of the second cluster. When the first route includes secure overlay tunnels, and source addresses of the first packet flow and the first route match, the method uses the first route to send a return flow to the second edge router to ensure symmetric routing.

Abstract: Some embodiments of the invention provide a method for providing dynamic edge-to-edge support across multi-hops in an SD-WAN connecting multiple regions. The method is performed at a first route reflector for a first of the multiple regions. The method receives, from a first edge router at a first site of the first region, a first request for endpoint information associated with a second edge router at a second site of a second region. After determining that the first route reflector does not have a direct connection to the second edge router, the method identifies a next-hop hub router for reaching the second edge router. The method sends a second request to the identified next-hop hub router to request the identified next-hop hub router to forward endpoint information for the second edge router to the first edge router for use in establishing a dynamic edge-to-edge connection with the second edge router.

Abstract: Some embodiments of the invention provide a method for interconnecting hub router clusters in an SD-WAN. The method is performed for each hub router of a first cluster and located in a first of multiple regions connected by the SD-WAN. The method establishes a connection with a respective hub router of a second cluster and located in a second of the multiple regions. The method sends, to a route reflector for the first region connected to the first cluster, a first peer-connection notification identifying the hub router as a next-hop for reaching the respective hub router. For each other hub router of the first cluster, the method receives from the route reflector a second peer-connection notification identifying the other hub router as a next-hop for reaching the other hub router's respective second cluster hub router for use in reaching edge routers connected to each other hub router's respective hub router.

Abstract: Some embodiments of the invention provide a method for using route filtering to relay routes between members of hub router clusters in an SD-WAN to reduce redundant route notifications to route reflectors (RRs) that advertise routes to hub routers in multiple regions connected by the SD-WAN and multiple edge routers at sites across the multiple regions. The method is performed at a first hub router of a first cluster. From a first edge router at a first site in a first region, the method receives routes of the first edge router. The method distributes the routes of the first edge router to a particular RR directly connected to the first cluster. The method distributes, to each other hub router of the first cluster, the routes of the first edge router along with an identifier that indicates that the routes should not be redistributed to the particular RR.

Abstract: Some embodiments of the invention provide a method for forwarding packets through an SD-WAN. The method is performed at a route reflector that advertises routes to facilitate forwarding of packets between first and second regions of the SD-WAN. The method advertises (1) to a first set of edge routers in the first region, a first route identifying a next-hop first hub router for initiating communications with a second set of edge routers in the second region, and (2) to the second set of edge routers, a second route identifying a next-hop second hub router for initiating communications with the first set of edge routers. When the second hub router loses connectivity to a first edge router of the first set of edge routers, the method advertises to the second set of edge routers a third route identifying the next-hop first hub router for initiating communications with the first edge router.

Abstract: Some embodiments provide a method for dynamically deploying a managed forwarding element (MFE) in a software-defined wide-area network (SD-WAN) for a particular geographic region across which multiple SaaS applications is distributed. The method determines, based on flow patterns for multiple flows destined for the multiple SaaS applications distributed across the particular geographic region, that an additional MFE is needed for the particular geographic region. The method configures the additional MFE to deploy at a particular location in the particular geographic region for forwarding the multiple flows to the multiple SaaS applications. The method provides, to a particular set of MFEs that connect a set of branch sites to the SD-WAN, a set of forwarding rules to direct the particular set of MFEs to use the additional MFE for forwarding subsequent data messages belonging to the multiple flows to the multiple SaaS applications.

Abstract: Some embodiments provide a method for using a heat map to modify an SD-WAN (software-defined wide-area network) deployed for a set of geographic locations. From a set of managed forwarding elements (MFEs) that forward multiple data message flows through the SD-WAN to a set of destination clusters, the method collects multiple metrics associated with the multiple data message flows. Based on the collected multiple metrics, the method generates a heat map that accounts for (1) the multiple data message flows, (2) locations of the set of MFEs, and (3) locations of the one or more destination clusters. The method uses the generated heat map to identify at least one modification to make to the SD-WAN to improve forwarding of the multiple data message flows.

Abstract: Some embodiments provide a method for modifying an SD-WAN (software-defined wide-area network). The method collects, from a set of managed forwarding elements (MFEs), multiple metrics associated with multiple data message flows sent between the set of MFEs. The method analyzes the collected multiple metrics to group the data message flows according to multiple types and to identify a ranking of the multiple groups of data message flows according to traffic throughput. The method uses the ranking to identify a set of one or more groups of data message flows. The method modifies the SD-WAN to improve forwarding through the SD-WAN for the identified set of one or more groups of data message flows.

Abstract: A network device receives, from a client device, a client request associated with a connection with a server device, where the client request identifies requested content. The network device determines connection information that identifies the connection with the server device, transmits, to a proxy server, a connection transfer request that identifies the connection information and the requested content, and receives, from the proxy server, an indication that the proxy server is capable of providing the requested content. Based on receiving the indication, the network device provides, from the proxy server to the client device, a response to the client request, and provides, from the proxy server and to the server device, information that causes the server device to terminate the connection. The network device may use a connection request transfer protocol to transmit the connection transfer request, and the client request may be an HTTP request.