Abstract: This disclosure describes techniques and mechanisms for optimizing configuration management in SD-WAN networks. The techniques may enable optimized configuration management, by maintaining a “single copy of config” that gets pushed across an enterprise network to different device models, consisting of different interface types and other nuances of hardware variations. The techniques also enable delivery of a cloud scale device type agnostic orchestration of network services intent. The techniques may also enable a controller to have the ability to identify the configuration intent of the user and generate a configuration based on what a network device can accept. Further the techniques may enable a controller to identify the relevance of a configuration expressed in user intent with regard to a network device, such that a user can be notified where the user intent cannot be met, thereby reducing configuration mistakes.

Abstract: In one embodiment, an illustrative method herein may comprise: receiving, at a device in a computer network, a packet having an unencrypted header and an encrypted segment list, wherein the device is an authorized segment hop device and wherein a destination address within the unencrypted header matches an address of the device; decrypting, by the device and in response to the destination address within the unencrypted header matching the address of the device, the encrypted segment list to expose at least a next segment hop address in the encrypted segment list; replacing, by the device, the destination address within the unencrypted header with the next segment hop address; and forwarding, from the device, the packet toward the next segment hop address along with the encrypted segment list.

Abstract: Techniques for ensuring symmetric forwarding between disparate networks are described herein. In active/standby hub architectures, hub nodes may be configured to convert a preference order (e.g., indicating a preferred hub node), specified by an endpoint on a wide-area network (WAN)-side of a network, into a local-area network (LAN)-side-routing-metric that is distributed to datacenter router(s) on the LAN-side of the network. When an active hub node loses connection to all of the available routing controllers, the active hub may automatically manipulate the LAN-side-routing-metric to make the metric worse than the standby hub to indicate that the routes being advertised by the active hub are “stale,” such that the datacenter routers prefer the standby hub, avoiding traffic asymmetry as a result of the lost connection.

Abstract: In one embodiment, an illustrative method herein may comprise: receiving, at a device in a computer network, a packet having an unencrypted header and an encrypted segment list, wherein the device is an authorized segment hop device and wherein a destination address within the unencrypted header matches an address of the device; decrypting, by the device and in response to the destination address within the unencrypted header matching the address of the device, the encrypted segment list to expose at least a next segment hop address in the encrypted segment list; replacing, by the device, the destination address within the unencrypted header with the next segment hop address; and forwarding, from the device, the packet toward the next segment hop address along with the encrypted segment list.

Abstract: This disclosure describes techniques and mechanisms for optimizing configuration management in SD-WAN networks. The techniques may enable optimized configuration management, by maintaining a “single copy of config” that gets pushed across an enterprise network to different device models, consisting of different interface types and other nuances of hardware variations. The techniques also enable delivery of a cloud scale device type agnostic orchestration of network services intent. The techniques may also enable a controller to have the ability to identify the configuration intent of the user and generate a configuration based on what a network device can accept. Further the techniques may enable a controller to identify the relevance of a configuration expressed in user intent with regard to a network device, such that a user can be notified where the user intent cannot be met, thereby reducing configuration mistakes.

Abstract: The present technology intelligently selects routes to be distributed to edge network device from SD-WAN controllers. Rather than indiscriminately distributing routes, the present technology utilizes logic to account for route viability conditions to determine whether a route between a first edge network device and a second edge network device is likely to be usable between the edge network devices.

Abstract: A method of creating a connection between a controller and plurality of edge devices may include reading, by a data plane development kit (DPDK) of the controller, a plurality of packets having a common destination port from the plurality of edge devices, and demuxing, by the DPDK, a number of frames of the plurality of packets based on a hash of the plurality of packets, the hash altering the common destination port of the plurality of packets with a corresponding number of sham destination ports. The method may also include, with a TUNTAP interface, injecting the plurality of packets into a network kernel, and with the network kernel, delivering the plurality of packets to a respective one of a plurality of daemon instances.

Abstract: Techniques for symmetric routing in a software-defined wide area network (SDWAN) are disclosed herein. In some aspects, the techniques described herein relate to a method including: determining a first device group, wherein the first device group includes a first router associated with a branch tag and a second router associated with a hub tag; determining a second device group, wherein the second device group includes a third router associated with and a fourth router associated with the hub tag; transmitting a first route advertisement associated with a first route from the first router to the second router to the first router; transmitting a second route advertisement associated with a second route from the first router to the third router to the first router; and preventing transmission of a third route advertisement associated with a third route from the first router to the fourth router to the first router.

Abstract: A method of creating a connection between a controller and plurality of edge devices may include reading, by a data plane development kit (DPDK) of the controller, a plurality of packets having a common destination port from the plurality of edge devices, and demuxing, by the DPDK, a number of frames of the plurality of packets based on a hash of the plurality of packets, the hash altering the common destination port of the plurality of packets with a corresponding number of sham destination ports. The method may also include, with a TUNTAP interface, injecting the plurality of packets into a network kernel, and with the network kernel, delivering the plurality of packets to a respective one of a plurality of daemon instances.

Abstract: The present technology intelligently selects routes to be distributed to edge network device from SD-WAN controllers. Rather than indiscriminately distributing routes, the present technology utilizes logic to account for route viability conditions to determine whether a route between a first edge network device and a second edge network device is likely to be usable between the edge network devices.

Abstract: This disclosure describes techniques and mechanisms for utilizing affinity routing in SDWAN networks. The techniques may enable network administrators to assign and/or configure affinity numbers to hub(s) and/or gateway(s), tunneling interface(s), service(s), etc., as well as affinity-preference-order(s) to edge device(s) within the network. Network administrators may also configure control polic(ies). The techniques enable a scalable and simplified way to automatically load-balance traffic across different gateways within a network, while reducing network resource usage. The techniques may utilize routing affinity to achieve a variety of networking related functionalities, including automatic load-balancing of traffic, provisioning of active and backup gateways, optimal route distribution to routers from routing controllers, optimized service placement for edge routers, without the need for any policy configuration at all, let alone complex policies.

Abstract: Techniques for ensuring symmetric forwarding between disparate networks are described herein. In active/standby hub architectures, hub nodes may be configured to convert a preference order (e.g., indicating a preferred hub node), specified by an endpoint on a wide-area network (WAN)-side of a network, into a local-area network (LAN)-side-routing-metric that is distributed to datacenter router(s) on the LAN-side of the network. When an active hub node loses connection to all of the available routing controllers, the active hub may automatically manipulate the LAN-side-routing-metric to make the metric worse than the standby hub to indicate that the routes being advertised by the active hub are “stale,” such that the datacenter routers prefer the standby hub, avoiding traffic asymmetry as a result of the lost connection.

Abstract: This disclosure describes techniques and mechanisms for utilizing affinity routing in SDWAN networks. The techniques may enable network administrators to assign and/or configure affinity numbers to hub(s) and/or gateway(s), tunneling interface(s), service(s), etc., as well as affinity-preference-order(s) to edge device(s) within the network. Network administrators may also configure control polic(ies). The techniques enable a scalable and simplified way to automatically load-balance traffic across different gateways within a network, while reducing network resource usage. The techniques may utilize routing affinity to achieve a variety of networking related functionalities, including automatic load-balancing of traffic, provisioning of active and backup gateways, optimal route distribution to routers from routing controllers, optimized service placement for edge routers, without the need for any policy configuration at all, let alone complex policies.

Abstract: This disclosure describes techniques and mechanisms for optimizing configuration management in SD-WAN networks. The techniques may enable optimized configuration management, by maintaining a “single copy of config” that gets pushed across an enterprise network to different device models, consisting of different interface types and other nuances of hardware variations. The techniques also enable delivery of a cloud scale device type agnostic orchestration of network services intent. The techniques may also enable a controller to have the ability to identify the configuration intent of the user and generate a configuration based on what a network device can accept. Further the techniques may enable a controller to identify the relevance of a configuration expressed in user intent with regard to a network device, such that a user can be notified where the user intent cannot be met, thereby reducing configuration mistakes.

Abstract: Techniques for symmetric routing in a software-defined wide area network (SDWAN) are disclosed herein. In some aspects, the techniques described herein relate to a method including: determining a first device group, wherein the first device group includes a first router associated with a branch tag and a second router associated with a hub tag; determining a second device group, wherein the second device group includes a third router associated with and a fourth router associated with the hub tag; transmitting a first route advertisement associated with a first route from the first router to the second router to the first router; transmitting a second route advertisement associated with a second route from the first router to the third router to the first router; and preventing transmission of a third route advertisement associated with a third route from the first router to the fourth router to the first router.

Abstract: The present technology intelligently selects routes to be distributed to edge network device from SD-WAN controllers. Rather than indiscriminately distributing routes, the present technology utilizes logic to account for route viability conditions to determine whether a route between a first edge network device and a second edge network device is likely to be usable between the edge network devices.

Abstract: This disclosure describes techniques and mechanisms for utilizing affinity routing in SDWAN networks. The techniques may enable network administrators to assign and/or configure affinity numbers to hub(s) and/or gateway(s), tunneling interface(s), service(s), etc., as well as affinity-preference-order(s) to edge device(s) within the network. Network administrators may also configure control polic(ies). The techniques enable a scalable and simplified way to automatically load-balance traffic across different gateways within a network, while reducing network resource usage. The techniques may utilize routing affinity to achieve a variety of networking related functionalities, including automatic load-balancing of traffic, provisioning of active and backup gateways, optimal route distribution to routers from routing controllers, optimized service placement for edge routers, without the need for any policy configuration at all, let alone complex policies.

Abstract: A method of creating a connection between a controller and plurality of edge devices may include reading, by a data plane development kit (DPDK) of the controller, a plurality of packets having a common destination port from the plurality of edge devices, and demuxing, by the DPDK, a number of frames of the plurality of packets based on a hash of the plurality of packets, the hash altering the common destination port of the plurality of packets with a corresponding number of sham destination ports. The method may also include, with a TUNTAP interface, injecting the plurality of packets into a network kernel, and with the network kernel, delivering the plurality of packets to a respective one of a plurality of daemon instances.