Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: A cloud-based network management system (NMS) stores path data from network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices. The NMS determines, for a logical path within a specified time window, a wireless signal quality and a link quality based at least in part on the path data. The NMS, in response to determining that the logical path is of a poor link quality, determine a correlation between a poor wireless quality and the poor link quality. The NMS may output a notification that indicates the correlation between the poor wireless quality and the poor link quality of the logical path.

Abstract: Techniques are described for determining one or more outlier logical paths in a computer network. A cloud-based network management system stores path data received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for one or more logical paths of a physical interface from the network device over a wide area network (WAN). The network management system compares the path data for the plurality of logical paths to determine one or more outlier logical paths out of the plurality of logical paths. The network management system, in response to determining the one or more outlier logical paths, output a notification indicative of the one or more outlier path data out of the plurality of logical paths.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: A first router generates session establishment metrics for use in network path selection. For example, a plurality of routers connect a client device to a network service instance hosted by a server. A first router is connected to the network service instance via first and second paths. The first router receives session performance requirements for a session between the client device and the network service instance. The first router forwards, along the first path, network traffic for the session by modifying a first packet of the session to include a session identifier for the session. The first router determines that session establishment metrics for the session do not satisfy the session performance requirements. In response, the first router forwards, along the second path, the network traffic for the session by modifying a second packet of the session to include the session identifier for the session.

Abstract: Techniques are disclosed for generating session-specific packet capture records. In one example, a first network device receives a first packet of a session between first and second client devices, the session comprising forward and reverse packet flows. The first network device modifies the first packet to include metadata comprising a packet capture indicator that indicates whether packet capture is to be performed for the session. The first network device stores at least a portion of the first packet and each subsequent packet of the session and forwards the modified first packet. A second network device receives the modified first packet and, based on the packet capture indicator, stores at least a portion of the first packet and each subsequent packet of the session in a session-specific packet capture record. The first and second network devices may generate, from the stored packet data, a packet capture record for the session.

Abstract: Techniques are disclosed for the identification of applications from communication sessions of network traffic between client devices and the generation of application-specific metrics for network traffic associated with the applications. In one example, a router obtains metrics for a plurality of packets. The router determines a session of a plurality of sessions associated with each packet. For each determined session, the router generates metrics for the session from the metrics of the packets associated with the session and determines an application of a plurality of applications associated with the session. For each determined application, the router generates metrics for the application from the metrics of the sessions associated with the application and transmits, to a device, the metrics for the application. In some examples, the router generates the metrics for each application on a per-client, per-next-hop, or per-traffic class basis.

Abstract: Techniques are described for monitoring application performance in a computer network. For example, a network management system (NMS) includes a memory storing path data received from a plurality of network devices, the path data reported by each network device of the plurality of network devices for one or more logical paths of a physical interface from the given network device over a wide area network (WAN). Additionally, the NMS may include processing circuitry in communication with the memory and configured to: determine, based on the path data, one or more application health assessments for one or more applications, wherein the one or more application health assessments are associated with one or more application time periods for a site, and in response to determining at least one failure state, output a notification including identification of a root cause of the at least one failure state.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: Techniques are disclosed for the identification of applications from communication sessions of network traffic between client devices and the generation of application-specific metrics for network traffic associated with the applications. In one example, a router obtains metrics for a plurality of packets. The router determines a session of a plurality of sessions associated with each packet. For each determined session, the router generates metrics for the session from the metrics of the packets associated with the session and determines an application of a plurality of applications associated with the session. For each determined application, the router generates metrics for the application from the metrics of the sessions associated with the application and transmits, to a device, the metrics for the application. In some examples, the router generates the metrics for each application on a per-client, per-next-hop, or per-traffic class basis.

Abstract: Techniques are described for monitoring application performance in a computer network. For example, a network management system (NMS) includes a memory storing path data received from a plurality of network devices, the path data reported by each network device of the plurality of network devices for one or more logical paths of a physical interface from the given network device over a wide area network (WAN). Additionally, the NMS may include processing circuitry in communication with the memory and configured to: determine, based on the path data, one or more application health assessments for one or more applications, wherein the one or more application health assessments are associated with one or more application time periods for a site, and in response to determining at least one failure state, output a notification including identification of a root cause of the at least one failure state.

Abstract: A first router generates session establishment metrics for use in network path selection. For example, a plurality of routers connect a client device to a network service instance hosted by a server. A first router is connected to the network service instance via first and second paths. The first router receives session performance requirements for a session between the client device and the network service instance. The first router forwards, along the first path, network traffic for the session by modifying a first packet of the session to include a session identifier for the session. The first router determines that session establishment metrics for the session do not satisfy the session performance requirements. In response, the first router forwards, along the second path, the network traffic for the session by modifying a second packet of the session to include the session identifier for the session.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: Techniques are disclosed for the identification of applications from communication sessions of network traffic between client devices and the generation of application-specific metrics for network traffic associated with the applications. In one example, a router obtains metrics for a plurality of packets. The router determines a session of a plurality of sessions associated with each packet. For each determined session, the router generates metrics for the session from the metrics of the packets associated with the session and determines an application of a plurality of applications associated with the session. For each determined application, the router generates metrics for the application from the metrics of the sessions associated with the application and transmits, to a device, the metrics for the application. In some examples, the router generates the metrics for each application on a per-client, per-next-hop, or per-traffic class basis.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: A cloud-based network management system (NMS) stores path data from network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices. The NMS determines, for a logical path within a specified time window, a wireless signal quality and a link quality based at least in part on the path data. The NMS, in response to determining that the logical path is of a poor link quality, determine a correlation between a poor wireless quality and the poor link quality. The NMS may output a notification that indicates the correlation between the poor wireless quality and the poor link quality of the logical path.

Abstract: Techniques are described for determining one or more outlier logical paths in a computer network. A cloud-based network management system stores path data received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for one or more logical paths of a physical interface from the network device over a wide area network (WAN). The network management system compares the path data for the plurality of logical paths to determine one or more outlier logical paths out of the plurality of logical paths. The network management system, in response to determining the one or more outlier logical paths, output a notification indicative of the one or more outlier path data out of the plurality of logical paths.

Abstract: An example method includes receiving, by a software-defined networking in a wide area network (SD-WAN) system having a first WAN link and a second WAN link for an SD-WAN service, WAN link characterization data for the first WAN link over a time period; determining, by the SD-WAN system based on processing the WAN link characterization data for the first WAN link using a machine learning model trained with historical WAN link characterization data for one or more WAN links, an indicator of a predicted performance metric of the first WAN link at a future time; and reassigning, by the SD-WAN system based on the indicator, an application from the first WAN link to the second WAN link.

Abstract: Techniques are described for onboarding virtualized network devices to a cloud-based WAN assurance system. For example, a virtualized network device receives, from a network device conductor that manages a plurality of network devices, a registration code for registering with the cloud-based WAN assurance system. In response to receiving the registration code and instructions, the network device sends the registration code to the cloud-based WAN assurance system. The cloud-based WAN assurance system verifies the network device based on the registration code, and assigns a distinct (e.g., unique) device identifier to the network device, and sends the distinct device identifier and a secret key to the network device. The network device uses the secret key to create a new secure connection with the cloud-based WAN assurance system, for streaming telemetry data to the WAN assurance system. The cloud-based WAN assurance system analyzes the network device telemetry data to provide WAN assurance.

Abstract: A first router generates session establishment metrics for use in network path selection. For example, a plurality of routers connect a client device to a network service instance hosted by a server. A first router is connected to the network service instance via first and second paths. The first router receives session performance requirements for a session between the client device and the network service instance. The first router forwards, along the first path, network traffic for the session by modifying a first packet of the session to include a session identifier for the session. The first router determines that session establishment metrics for the session do not satisfy the session performance requirements. In response, the first router forwards, along the second path, the network traffic for the session by modifying a second packet of the session to include the session identifier for the session.