Abstract: In one embodiment, a method includes negotiating, by a networking device, a security association with a peer and receiving, by the networking device, an Internet Protocol (IP) packet from the peer. The IP packet includes an outer IP header, an ESP header, a protocol header, data, an ESP trailer, and ESP authentication data. The method further includes performing, using an IP Security (IPSec) authentication algorithm, authentication checks for the outer IP header, the ESP header, the protocol header, the data, the ESP trailer, and the ESP authentication data of the IP packet.

Abstract: A method may include transmitting a first public encryption key from to a control device and encrypting a first packet for a remote network device utilizing a first private encryption key correlated with the first public encryption key. The method may also include generating a second public encryption key and a second private encryption key and transmitting the second public encryption key to the control device. The method may additionally include receiving a first message from the remote network device that the remote network device received the second public encryption key from the control device, and after receiving the first message from the remote network device that the remote network device received the second public encryption key, encrypting a second packet utilizing the second private encryption key.

Abstract: According to some embodiments, a method performed by a first software defined wide area network (SD-WAN) edge router communicably coupled to a public network comprises: receiving a transport location (TLOC)-extension configuration for a known interface of the first edge router; detecting a second edge router attempting to connect to the known interface of the first edge router; and transmitting, to the second edge router, configuration information for the second edge router so that the second edge router is able to communicate with the public network through a TLOC-extension with the first edge router. In some embodiments, the second edge router receives device configuration information (e.g., PnP, ZTP, etc.) from the public network via the TLOC-extension.

Abstract: A system may include a first network device configured to communicate via an encrypted session, and a second network device configured to communicate with the first network device via the encrypted session, where the second network device may be configured to perform operations to facilitate communication via the encrypted session. The operations may include receive a first set of data from a device other than the first network device, where the first set of data is used to communicate via the encrypted session. The operations may also include combine peer-to-peer information to be used by the first network device to communicate via the encrypted session to an encrypted packet, where the peer-to-peer information is combined with the encrypted packet in an unencrypted form. The operations may additionally include send the encrypted packet with the peer-to-peer information to the first network device.

Abstract: In one embodiment, a method includes negotiating, by a networking device, a security association with a peer and receiving, by the networking device, an Internet Protocol (IP) packet from the peer. The IP packet includes an outer IP header, an ESP header, a protocol header, data, an ESP trailer, and ESP authentication data. The method further includes performing, using an IP Security (IPSec) authentication algorithm, authentication checks for the outer IP header, the ESP header, the protocol header, the data, the ESP trailer, and the ESP authentication data of the IP packet.

Abstract: According to some embodiments, a method performed by a first software defined wide area network (SD-WAN) edge router communicably coupled to a public network comprises: receiving a transport location (TLOC)-extension configuration for a known interface of the first edge router; detecting a second edge router attempting to connect to the known interface of the first edge router; and transmitting, to the second edge router, configuration information for the second edge router so that the second edge router is able to communicate with the public network through a TLOC-extension with the first edge router. In some embodiments, the second edge router receives device configuration information (e.g., PnP, ZTP, etc.) from the public network via the TLOC-extension.

Abstract: A system may include a first network device configured to communicate via an encrypted session, and a second network device configured to communicate with the first network device via the encrypted session, where the second network device may be configured to perform operations to facilitate communication via the encrypted session. The operations may include receive a first set of data from a device other than the first network device, where the first set of data is used to communicate via the encrypted session. The operations may also include combine peer-to-peer information to be used by the first network device to communicate via the encrypted session to an encrypted packet, where the peer-to-peer information is combined with the encrypted packet in an unencrypted form. The operations may additionally include send the encrypted packet with the peer-to-peer information to the first network device.

Abstract: A method may include transmitting a first public encryption key from to a control device and encrypting a first packet for a remote network device utilizing a first private encryption key correlated with the first public encryption key. The method may also include generating a second public encryption key and a second private encryption key and transmitting the second public encryption key to the control device. The method may additionally include receiving a first message from the remote network device that the remote network device received the second public encryption key from the control device, and after receiving the first message from the remote network device that the remote network device received the second public encryption key, encrypting a second packet utilizing the second private encryption key.