Abstract: Techniques for ensuring symmetric forwarding between disparate networks. The techniques may include receiving a gateway preference order associated with a route advertised by an edge node, the edge node associated with a first network. The techniques may also include determining, based at least in part on the gateway preference order, that a gateway node is a more preferred gateway for the route than another gateway node, the gateway node configured to facilitate communications between the first network and a second network. In some examples, the techniques may also include converting the gateway preference order into a metric associated with an IP routing protocol that is in use in the second network. In some examples, the route including the metric may be distributed within the second network such that the gateway node is the more preferred gateway for return traffic of the route.

Abstract: In one embodiment, a method includes receiving, by a first node of a node cluster in a software-defined wide area network (SD-WAN), traffic from a wide area network (WAN), assigning, by the first node of the node cluster, flow ownership of the traffic to the first node, and communicating, by the first node of the node cluster, the traffic to a local area network (LAN). The method also includes receiving, by the first node of the node cluster, return traffic from a second node of the node cluster and detecting, by the first node of the node cluster, a diversion of the return traffic. The method further includes relinquishing, by the first node of the node cluster, the flow ownership and assigning, by the first node of the node cluster, the flow ownership to the second node of the node cluster.

Abstract: According to some embodiments, a software defined wide area network (SD-WAN) includes a first region and a second region. The first region includes multiple first routing controllers and multiple first SD-WAN edge routers. The second region includes multiple second routing controllers and multiple second SD-WAN edge routers. Each first SD-WAN edge router of the first region is configured to establish Overlay Management Protocol (OMP) peering connections with the plurality of first routing controllers of the first region but to avoid establishing OMP peering connections with the plurality of second routing controllers of the second region. Each second SD-WAN edge router of the second region is configured to establish OMP peering connections with the plurality of second routing controllers of the second region but to avoid establishing OMP peering connections with the plurality of first routing controllers of the first region.

Abstract: Systems and methods are provided for receiving bandwidth metrics from a plurality of routers on respective link routes in a network, compiling a link database including the bandwidth metrics of each respective link route in the network, selecting a first designated link path from the link database between a first router and a second router based on an application routing policy, the application routing policy being based on a routing metric, providing a first multiprotocol label switching label based on the first designated link path to the first router of the plurality of routers in the network, and restricting network traffic of the first router to the first designated link path provided in the first multiprotocol label switching label.

Abstract: A system of one embodiment that provides stateless symmetric forwarding of packets in a computer network. The system includes a memory and a processor. The system is operable to determine a cluster state of a plurality of border routers in a cluster. The system is operable to communicate the cluster state to at least one branch node in the computer network. The system is operable to generate a network level consistent hash based on the cluster state. The system is operable to route a first packet through a first border router of the plurality of border routers in the cluster using the network level consistent hash. After the first packet is sent through a first border router, the system is further operable to route a second packet through the first border router of the plurality of border routers in the cluster using the network level consistent hash.

Abstract: According to some embodiments, a method is performed by a software defined wide area network (SD-WAN) edge router in a hierarchical SD-WAN network comprising a plurality of edge routers and a plurality of border routers. The method comprises: originating a SD-WAN system route for advertising reachability to the edge router, the system route comprising an encryption key associated with the edge router; and transmitting the system route to one or more SD-WAN border routers. The method may further comprise: receiving a packet destined for the edge router from one of the one or more SD-WAN border routers, wherein the packet is at least partially encrypted with the encryption key associated with the edge router; and decrypting the received packet.

Abstract: In one embodiment, a method includes receiving, by a first node of a node cluster in a software-defined wide area network (SD-WAN), traffic from a wide area network (WAN), assigning, by the first node of the node cluster, flow ownership of the traffic to the first node, and communicating, by the first node of the node cluster, the traffic to a local area network (LAN). The method also includes receiving, by the first node of the node cluster, return traffic from a second node of the node cluster and detecting, by the first node of the node cluster, a diversion of the return traffic. The method further includes relinquishing, by the first node of the node cluster, the flow ownership and assigning, by the first node of the node cluster, the flow ownership to the second node of the node cluster.

Abstract: In one embodiment, a method includes receiving traffic and identifying one or more attributes associated with the traffic. The method also includes dynamically selecting a load balancing algorithm based on the one or more attributes in accordance with a load balancing scheme. The method further includes performing load balancing on the traffic in accordance with the load balancing algorithm and communicating the traffic from a first network element to a second network element in accordance with the load balancing.

Abstract: In one embodiment, a method includes receiving, by a network node, traffic within a hierarchical software-defined wide area network (SD-WAN) network. The method also includes determining, by the network node, a destination region of the traffic. The destination region is within the hierarchical SD-WAN network. The method further includes classifying, by the network node, the traffic based on a destination match condition. The destination match condition is associated with two or more destination regions.

Abstract: An efficient method to handle fragmented packets in multi-node all-active clusters. In one particular embodiment, a method includes receiving an initial fragment packet at a node in a cluster, creating a secondary flow table, linking the secondary flow table to a primary flow table, determining the primary flow owner of the initial fragment packet, and transmitting initial and succeeding fragment packets out of the cluster through, if possible, the primary flow owner.

Abstract: Systems and methods are provided for receiving bandwidth metrics from a plurality of routers on respective link routes in a network, compiling a link database including the bandwidth metrics of each respective link route in the network, selecting a first designated link path from the link database between a first router and a second router based on an application routing policy, the application routing policy being based on a routing metric, providing a first multiprotocol label switching label based on the first designated link path to the first router of the plurality of routers in the network, and restricting network traffic of the first router to the first designated link path provided in the first multiprotocol label switching label.

Abstract: The subject matter of this disclosure relates in general to the field of computer networking, and more particularly, to systems and methods for discovery of a tunnel for wide area network. Certain aspects provide a method for network path analysis. The method includes sending a first probe packet configured to identify a network tunnel, wherein the first probe packet includes an identifier of the first probe packet and a first time to live (TTL) value that corresponds to a first network hop; receiving a first response message from the first network hop in the network tunnel, wherein the first response message corresponds to the first probe packet and includes the identifier of the first probe packet; and analyzing the network tunnel based on the first response message including the identifier of the first probe packet.

Abstract: In one embodiment, a method includes receiving, by a first node of a node cluster in a software-defined wide area network (SD-WAN), traffic from a wide area network (WAN), assigning, by the first node of the node cluster, flow ownership of the traffic to the first node, and communicating, by the first node of the node cluster, the traffic to a local area network (LAN). The method also includes receiving, by the first node of the node cluster, return traffic from a second node of the node cluster and detecting, by the first node of the node cluster, a diversion of the return traffic. The method further includes relinquishing, by the first node of the node cluster, the flow ownership and assigning, by the first node of the node cluster, the flow ownership to the second node of the node cluster.

Abstract: In one embodiment, a method includes determining, by a network node, that a first plurality of tunnel interfaces resides in a core region of a network and determining, by the network node, that a second plurality of tunnel interfaces resides in an access region of the network. The method also includes configuring, by the network node, a first tunnel interface as a core regional fallback path for the core region of the network and configuring, by the network node, a second tunnel interface as an access regional fallback path for the access region of the network.

Abstract: Disclosed is a first device and a second device each sending BFD echo request packets in an initial stage of establishing communication between the two devices. A method can include determining that a certain mode is detected, such as a low bandwidth mode. The method can be practiced by one or both of the devices or a separate network controller. Based on the detection of the certain mode or the communication link being in a certain mode, the method includes the first device or the second device electing to be a master or a slave. Upon establishing that one of the devices is the master and the other of the devices is a slave, only the master will send BFD echo request packets.

Abstract: According to some embodiments, a software defined wide area network (SD-WAN) includes a first region and a second region. The first region includes multiple first routing controllers and multiple first SD-WAN edge routers. The second region includes multiple second routing controllers and multiple second SD-WAN edge routers. Each first SD-WAN edge router of the first region is configured to establish Overlay Management Protocol (OMP) peering connections with the plurality of first routing controllers of the first region but to avoid establishing OMP peering connections with the plurality of second routing controllers of the second region. Each second SD-WAN edge router of the second region is configured to establish OMP peering connections with the plurality of second routing controllers of the second region but to avoid establishing OMP peering connections with the plurality of first routing controllers of the first region.

Abstract: The present disclosure is directed to a mechanism for optimized application performance in SD-WAN, and includes the steps of receiving initial traffic packets at a first site for transmission to a second site; determining whether a direct tunnel is established between the first site and the second site based on a state of the second site, the state comprising an active state indicating that a direct tunnel is established between the first and second sites or an inactive state indicating that the direct tunnel is not established between the first and second sites; and in response to determining that the direct tunnel is not established, determining that the initial packets satisfy a configured trigger; forwarding the initial packets to the second site via a backup path; establishing the direct tunnel between the first and second sites; and forwarding subsequent traffic packets to the second site via the established direct tunnel.

Abstract: The present disclosure is directed to systems and methods for transport resource allocation using a centralized control policy, the methods including the steps of receiving node characteristics associated with a plurality of nodes; receiving a centralized policy configuration associated with at least one control policy to be applied based on a set of match conditions; identifying a one or more nodes from the plurality of nodes that satisfy, or that are associated with one or more tunnels that satisfy, the set of match conditions; and applying the at least one control policy to the one or more nodes that satisfy, or to the one or more tunnels that satisfy, the set of match conditions, wherein the at least one control policy is configured to override at least one locally-configured bidirectional forwarding detection (BFD) timer; and/or set a maximum number of tunnels for provisioning at the identified one or more nodes.

Abstract: Systems and methods are provided for receiving bandwidth metrics from a plurality of routers on respective link routes in a network, compiling a link database including the bandwidth metrics of each respective link route in the network, selecting a first designated link path from the link database between a first router and a second router based on an application routing policy, the application routing policy being based on a routing metric, providing a first multiprotocol label switching label based on the first designated link path to the first router of the plurality of routers in the network, and restricting network traffic of the first router to the first designated link path provided in the first multiprotocol label switching label.

Abstract: A WAN controller can configure a first WAN interface on a first WAN edge device to connect to a first transport network. The WAN controller can configure a second WAN interface on a second WAN edge device to connect to a second transport network. The WAN controller or the first WAN edge device, connected to a first access device of an access network, can determine the first WAN edge device has no Layer 2 connectivity to the second WAN edge device, connected to a second access device of the access network. The WAN controller or the first WAN edge device can establish a tunnel between the first WAN edge device and the second WAN interface. The WAN controller can route a specified class of WAN traffic received by the first WAN edge device from the access network through the tunnel.