Abstract: Systems and methods are provided for automatically grouping branch devices based on device information (e.g., IPSec tunnel connectivity, etc.). The devices with similar branch gateways which would customarily receive similar route information and/or properties (e.g., AS-PATH, cost, MED, Metric1, Metric2, community/extended community) and/or devices with similar connectivity graphs can be grouped together. This can reduce the number of electronic communications transmitted throughout the network and increase computational efficiency for the controller and devices.

Abstract: An example network infrastructure device of a software defined wide area network (SD-WAN) comprises processing circuitry and a memory including instructions that cause the network infrastructure device to advertise a set of SD-WAN overlay tunnels terminating at the network infrastructure device, receive a network connectivity graph including a categorized set of network infrastructure devices that are members of an advertisement area and links between the set of network infrastructure devices, receive data traffic intended for a destination device of the set of network infrastructure devices, determine, based on the network connectivity graph, a preferred path to the destination device, and transmit the data traffic via an interface associated with the preferred path.

Abstract: Systems and methods of software-defined wide area network (SDWAN) device routing are provided using a cloud-based overlay routing service that utilizes, a cloud-BGP service (CBS), and a path computation module (PCM), and overlay agents (OAs) implemented on the tenant side. The Oas, CBS, and PCM may interact with each other, e.g., publish/update local states, route prefixes, etc. to create/maintain routing in the SDWAN.

Abstract: Systems and methods of software-defined wide area network (SDWAN) device routing are provided using a cloud-based overlay routing service that utilizes, a cloud-BGP service (CBS), and a path computation module (PCM), and overlay agents (OAs) implemented on the tenant side. The Oas, CBS, and PCM may interact with each other, e.g., publish/update local states, route prefixes, etc. to create/maintain routing in the SDWAN.

Abstract: Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a private domain name system (DNS) receives a DNS lookup request from a computing system of a plurality of computing systems associated with a private communication group, and forwards the DNS lookup request to a public DNS. The private DNS further receives a public address associated with the DNS lookup request from the public DNS, translates the public address to a private address, and transfers the private address to the requesting computing system.

Abstract: Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a communication service identifies a communication request from an application on the computing system to transfer data to a second application on a second computing system. In response to the communication request, the communication service identifies a communication group of a plurality of communication groups associated with the application and the second application. Once the communication group is identified, the communication service identifies a communication quality of service based on the identified communication group, and transfers the data associated with the communication request to the second computing system in accordance with the communication quality of service.

Abstract: The present disclosure envisages establishing a virtual overlay network between the source computer and the destination computer (in addition to a typical, unsecured, public computer network already connecting the source computer and the destination computer), and designating the source computer and destination computer to be identified on the virtual overlay network only by the corresponding source private IP address and destination private IP address. The present disclosure envisages an intermediary server for creating and subsequently managing the virtual overlay network. The intermediary server renders the virtual overlay network accessible only to the source computer and the destination computer to communicate with one another and to exchange data packets using the source private IP address and destination private address and the corresponding private ports, while ensuring that the virtual overlay network remains inaccessible to any other computer on the underlying public computer network.

Abstract: Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a communication service identifies a communication request for a first application on a first computing system to transfer data to a second application on a second computing system. In response to the request, the communication service generates a packet, wherein the packet includes an encrypted portion for the data and private addressing associated with the first and second applications, and an unencrypted portion for group identifier information and public addressing information. Once the packet is generated, the packet is transferred to the second computing system.

Abstract: Described herein are systems, methods, and software to enhance gateway security for multiple communication groups. In one implementation, a method of operating a gateway service includes identifying a data packet received from a first computing system, wherein the data packet comprises a first destination port value. The method further includes, identifying a group identifier within the data packet, wherein the group identifier associated with a communication group of the plurality of communication groups, translating the first destination port value to a second destination port value based on the group identifier, and forwarding the data packet with the translated second destination port value.

Abstract: Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a private domain name system (DNS) receives a DNS lookup request from a computing system of a plurality of computing systems associated with a private communication group, and forwards the DNS lookup request to a public DNS. The private DNS further receives a public address associated with the DNS lookup request from the public DNS, translates the public address to a private address, and transfers the private address to the requesting computing system.

Abstract: Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a communication service identifies a communication request from an application on the computing system to transfer data to a second application on a second computing system. In response to the communication request, the communication service identifies a communication group of a plurality of communication groups associated with the application and the second application. Once the communication group is identified, the communication service identifies a communication quality of service based on the identified communication group, and transfers the data associated with the communication request to the second computing system in accordance with the communication quality of service.

Abstract: Described herein are systems, methods, and software to enhance gateway security for multiple communication groups. In one implementation, a method of operating a gateway service includes identifying a data packet received from a first computing system, wherein the data packet comprises a first destination port value. The method further includes, identifying a group identifier within the data packet, wherein the group identifier associated with a communication group of the plurality of communication groups, translating the first destination port value to a second destination port value based on the group identifier, and forwarding the data packet with the translated second destination port value.

Abstract: Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a communication service identifies a communication request for a first application on a first computing system to transfer data to a second application on a second computing system. In response to the request, the communication service generates a packet, wherein the packet includes an encrypted portion for the data and private addressing associated with the first and second applications, and an unencrypted portion for group identifier information and public addressing information. Once the packet is generated, the packet is transferred to the second computing system.

Abstract: The present disclosure envisages establishing a virtual overlay network between the source computer and the destination computer (in addition to a typical, unsecured, public computer network already connecting the source computer and the destination computer), and designating the source computer and destination computer to be identified on the virtual overlay network only by the corresponding source private IP address and destination private IP address. The present disclosure envisages an intermediary server for creating and subsequently managing the virtual overlay network. The intermediary server renders the virtual overlay network accessible only to the source computer and the destination computer to communicate with one another and to exchange data packets using the source private IP address and destination private address and the corresponding private ports, while ensuring that the virtual overlay network remains inaccessible to any other computer on the underlying public computer network.