Systems and methods for routing internet packets between enterprise network sites

Patent metadata

Field	Value
Publication number	US-10313241-B2
Application number	US-201615083003-A
Country	US
Kind code	B2
Filing date	Mar 28, 2016
Priority date	Mar 28, 2016
Publication date	Jun 4, 2019
Grant date	Jun 4, 2019

Abstract

This disclosure describes methods, devices, and systems related to routing packets over enterprise network sites. A method may be disclosed for routing packets between hosts at a first site and hosts at a second site in a network using a firewall. The method may comprise receiving a request, in a first packet, from a first router to send one or more packets to two or more hosts at the second site. The method may comprise receiving a first sub-network prefix, in a route advertisement, corresponding to two or more hosts at the first site from the first router, and receiving a first community value, in a first advertisement, associated with the first sub-network prefix. The method may comprise generating a first local preference value based at least in part on the first community value. And the method may comprise sending the request, first sub-network prefix, and first local preference value to a second router, in a second advertisement.

First claim

We claim:

1. A firewall comprising:
at least one memory for storing computer-executable instructions; and
at least one processor configured to access the at least one memory, wherein the at least one processor is configured to execute the computer-executable instructions to:
receive a request, in a first packet, from a first router to send at least one packet to two or more hosts at a second site,
receive, from the first router, a first sub-network prefix, in a route advertisement, corresponding to the two or more hosts at a first site, and
receive a first community value, in a first advertisement, associated with the first sub-network prefix;
determine a first local preference value based at least in part on the first community value;
send the request, first sub-network prefix, and first local preference value to a second router, in a second advertisement;
receive a second community value from the second router, in a third advertisement, associated with a second sub-network prefix;
generate a second local preference value based at least in part on the second community value and the first local preference value; and
send the second local preference value to the first router in a fourth advertisement.

2. The firewall of claim 1 , wherein the at least one processor is further configured to execute the computer-executable instructions to determine a route to the two or more hosts at the first site using the first sub-network prefix.

3. The firewall of claim 1 , wherein the request from the first router is a request received from the two or more hosts, on a first network, connected to the first router.

4. The firewall of claim 1 , wherein the request received from the first router comprises a second request received by the first router from the two or more hosts at a third site assigned to the first network requesting a route to the two or more hosts at the second site.

5. The firewall of claim 1 , wherein the at least one processor is further configured to execute the computer-executable instructions to:
receive a second sub-network prefix, in a second route advertisement, from the second router, wherein the second router is associated with the two or more hosts at the second site, and
wherein the second sub-network prefix provides a route to the two or more hosts at the second site.

6. The firewall of claim 5 , wherein the at least one processor is further configured to execute the computer-executable instructions to:
send the second sub-network prefix to the first router, in a third route advertisement, in response to the request from the first router, wherein the second sub-network prefix provides a route to the hosts at the second site from the first router.

7. A non-transitory computer-readable medium storing computer-executable instructions stored therein, which when executed by at least one processor of a firewall, cause the at least one processor to perform the operation of:
receiving a request, in a first packet, from a first router to send one or more packets to two or more hosts at the second site,
receiving a first sub-network prefix, in a route advertisement, corresponding to two or more hosts at the first site from the first router, and
receiving a first community value, in a first advertisement, associated with the first sub-network prefix;
generating a first local preference value based at least in part on the first community value;
sending the request, first sub-network prefix, and first local preference value to a second router, in a second advertisement;
receiving a second community value from the second router associated with the second sub-network prefix in a third advertisement;
generating a second local preference value based at least in part on the second community value and the first local preference value; and
sending the second local preference value to the first router in a fourth advertisement.

8. The non-transitory computer-readable medium of claim 7 , wherein the computer-executable instructions further cause the at least one processor to perform the operations of:
receiving a second sub-network prefix, in a second route advertisement, from the second router, wherein the second router is associated with the two or more hosts at the second site, and
wherein the second sub-network prefix provides a route to the two or more hosts at the second site; and
sending the second sub-network prefix to the first router.

9. The non-transitory computer-readable medium of claim 8 , wherein the computer-executable instructions further cause the at least one processor to perform the operations of:
sending the second sub-network prefix to the first router, in a fifth route advertisement, wherein the second sub-network prefix provides a route to the two or more hosts at the second site from the first router.

10. The non-transitory computer-readable medium of claim 7 , wherein the first sub-network prefix provides a route to the two or more hosts at the first site.

11. The non-transitory computer-readable medium of claim 7 , wherein the first and second local preference values are numerical values.

12. The non-transitory computer-readable medium of claim 7 , wherein the request from the first router is a request received from two or more hosts, on the first network, connected to the first router.

13. The non-transitory computer-readable medium of claim 7 , wherein the request received from the first router comprises a second request received by the first router from hosts at a third site assigned to the first network requesting a route to the two or more hosts at the second site.

14. A method of routing packets between hosts at a first site and hosts at a second site in a network using a firewall, the method comprising:
receiving a request, in a first packet, from a first router to send one or more packets to two or more hosts at the second site,
receiving a first sub-network prefix, in a route advertisement, corresponding to two or more hosts at the first site from the first router, and
receiving a first community value, in a first advertisement, associated with the first sub-network prefix;
generating a first local preference value based at least in part on the first community value;
sending the request, first sub-network prefix, and first local preference value to a second router, in a second advertisement;
receiving a second community value from the second router associated with the second sub-network prefix in a third advertisement;
generating a second local preference value based at least in part on the second community value and the first local preference value; and
sending the second local preference value to the first router in a fourth advertisement.

15. The method of claim 14 , further comprising:
receiving a second sub-network prefix, in a second route advertisement, from the second router, wherein the second router is associated with the two or more hosts at the second site, and
wherein the second sub-network prefix provides a route to the two or more hosts at the second site; and
sending the second sub-network prefix to the first router.

16. The method of claim 14 , further comprising:
sending the second sub-network prefix to the first router, in a fifth route advertisement, wherein the second sub-network prefix provides a route to the two or more hosts at the second site from the first router.

17. The method of claim 14 , wherein the request from the first router is a request received from two or more hosts, on the first network, connected to the first router.

18. The method of cl

Assignees

• Cox Communications Inc

Inventors

• Bethers Joel
• Eggert Michael

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L45/748 Primary

  using longest matching prefix · CPC title

• H04L45/026

  Details of "hello" or keep-alive messages · CPC title

• H04L63/0254

  Stateful filtering · CPC title