Abstract: Systems and methods are provided for effectuating overlay tunnels between software-defined wide area network (SD-WAN) end-point devices despite the use of IPSec passthrough in one or more network devices, such as modems or routers that exist between the end-point devices. In particular, the Internet Key Exchange (IKE) protocol can be allowed to progress until a modem/router is able to establish an IKE tunnel, after which overlay packets using cloud-managed keys can be allowed to pass through the modem/router. An overlay tunnel may then be established between the end-point devices, and the IKE tunnel can be taken down.

Abstract: Systems and methods are provided for effectuating overlay tunnels between software-defined wide area network (SD-WAN) end-point devices despite the use of IPSec passthrough in one or more network devices, such as modems or routers that exist between the end-point devices. In particular, the Internet Key Exchange (IKE) protocol can be allowed to progress until a modem/router is able to establish an IKE tunnel, after which overlay packets using cloud-managed keys can be allowed to pass through the modem/router. An overlay tunnel may then be established between the end-point devices, and the IKE tunnel can be taken down.

Abstract: One aspect can provide a system and method for configuring a plurality of branch gateway (BGW) devices coupled to a virtual private network concentrator (VPNC). The VPNC negotiates with a respective BGW device a transmission-bandwidth contract; receives, from the BGW device, a request for additional transmission bandwidth; analyzes traffic patterns to identify one or more BGW devices with unused bandwidth; allocates the requested additional transmission bandwidth to the respective BGW device by reducing transmission bandwidth allocated to the identified one or more BGW devices; and transmits contract-update notifications to the BGW devices to allow each BGW device to update a corresponding transmission-bandwidth contract, which comprises increasing the upper bandwidth limit at the respective BGW device while reducing the upper bandwidth limit at the identified BGW devices.

Abstract: Systems are methods are provided for implementing cloud survivability which mitigates the loss of secure communication via a cloud orchestrated IPsec tunnel, due to a loss of connectivity to a cloud service. For example, devices can establish IPsec tunnels which are orchestrated by a cloud service, such as SD-WAN Tunnel Orchestration. Then, according to the disclosed cloud survivability techniques, if the connection to the cloud service fails, a cloud survivability phase can be triggered which fails-over from IPsec tunnel to a survivability tunnel. In some implementations, a method includes: determining, by an initiator device, whether there is a loss of connectivity of the initiator device or the responder device with a cloud service. Further, in response to determining that there is a loss of connectivity, automatically establishing a survivability communication link between the initiator device and the responder device.

Abstract: Systems and methods are provided for effectuating overlay tunnels between software-defined wide area network (SD-WAN) end-point devices despite the use of IPSec passthrough in one or more network devices, such as modems or routers that exist between the end-point devices. In particular, the Internet Key Exchange (IKE) protocol can be allowed to progress until a modem/router is able to establish an IKE tunnel, after which overlay packets using cloud-managed keys can be allowed to pass through the modem/router. An overlay tunnel may then be established between the end-point devices, and the IKE tunnel can be taken down.

Abstract: In some examples, the validation controller may comprise a processing resource and a memory resource storing machine readable instructions to cause the processing resource to perform a number of actions. In some examples, the validation controller may determine functional capabilities for a topology that includes a plurality of devices to be configured by the validation controller. The validation controller may compare a configuration element for the plurality of devices to the functional capabilities for the plurality of devices. The validation controller may validate the configuration element based on the comparison. The validation controller may also push the configuration element to the plurality of devices when the configuration element is validated.

Abstract: Systems, methods, and computer-readable media are described for establishing an optimized geo-location based hub mesh network for a group of network controllers spanning multiple regions, where the optimized mesh network includes substantially fewer connections between network controllers than conventional hub mesh networks. Geo-location information is obtained for the group of network controllers, and the network controllers are categorized into various physical regions based on the geo-location information. Then, within each region, a particular network controller is selected to serve as a primary regional hub for that region. Tunnel connections are then established between each non-hub network controller in each region and the primary regional hub for that region. In addition, tunnel connections are established between each non-hub network controller in a region and each other non-hub network controller within the same region.

Abstract: Systems are methods are provided for implementing cloud survivability which mitigates the loss of secure communication via a cloud orchestrated IPsec tunnel, due to a loss of connectivity to a cloud service. For example, devices can establish IPsec tunnels which are orchestrated by a cloud service, such as SD-WAN Tunnel Orchestration. Then, according to the disclosed cloud survivability techniques, if the connection to the cloud service fails, a cloud survivability phase can be triggered which fails-over from IPsec tunnel to a survivability tunnel. In some implementations, a method includes: determining, by an initiator device, whether there is a loss of connectivity of the initiator device or the responder device with a cloud service. Further, in response to determining that there is a loss of connectivity, automatically establishing a survivability communication link between the initiator device and the responder device.

Abstract: Systems, methods, and computer-readable media are described for establishing an optimized geo-location based hub mesh network for a group of network controllers spanning multiple regions, where the optimized mesh network includes substantially fewer connections between network controllers than conventional hub mesh networks. Geo-location information is obtained for the group of network controllers, and the network controllers are categorized into various physical regions based on the geo-location information. Then, within each region, a particular network controller is selected to serve as a primary regional hub for that region. Tunnel connections are then established between each non-hub network controller in each region and the primary regional hub for that region. In addition, tunnel connections are established between each non-hub network controller in a region and each other non-hub network controller within the same region.

Abstract: Examples relates to a method for selecting headend gateway for routing subnets of branch gateways of a geographic region in a software defined wide area network (SD-WAN). In some examples, an analyzer issues a subnet to each branch gateway of a first geographic region from a pool of contiguous IP addresses, selects a first set of headend gateways suited to be assigned to the branch gateways, ranks each of the first set of headend gateways based on a parameter that includes dynamic loading of each headend gateway or link health information between each of the headend gateways and the branch gateways, and forwards the information including the ranking of headend gateways of the first set to a network orchestrator of the SD-WAN to cause the network orchestrator to assign the branch gateways to the highest ranking gateway based on information including the ranking of the first set of headend gateways.

Abstract: Disclosed is a network infrastructure device including processing circuitry and a non-transitory, computer-readable medium including instructions that, when executed by the processing circuitry, cause the network infrastructure device to perform certain actions. The actions include receiving first information indicating resource utilization of headend gateways for forwarding data of a first application, receiving second information indicating resource utilization of branch gateways for forwarding data of a second application, forwarding data of the first application across a WAN link to a first headend gateway best suited to forward data of the first application, and forwarding data of the second application across a WAN link to a second headend gateway best suited to forward data of the second application.

Abstract: Systems and methods are provided for redistributing virtual private network tunnels among a plurality of virtual private network concentrators. The method includes receiving, from each of the virtual private network concentrators, a respective utilization indicator; selecting a source one of the virtual private network concentrators according to the utilization indicators; selecting a destination one of the virtual private network concentrators according to the utilization indicators; selecting one of the virtual private network tunnels connected to the source one of the virtual private network concentrators; and transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators.

Abstract: In some examples, the validation controller may comprise a processing resource and a memory resource storing machine readable instructions to cause the processing resource to perform a number of actions. In some examples, the validation controller may determine functional capabilities for a topology that includes a plurality of devices to be configured by the validation controller. The validation controller may compare a configuration element for the plurality of devices to the functional capabilities for the plurality of devices. The validation controller may validate the configuration element based on the comparison. The validation controller may also push the configuration element to the plurality of devices when the configuration element is validated.