Method and system of resiliency in cloud-delivered SD-WAN

Patent metadata

Field	Value
Publication number	US-10523539-B2
Application number	US-201715701115-A
Country	US
Kind code	B2
Filing date	Sep 11, 2017
Priority date	Jun 22, 2017
Publication date	Dec 31, 2019
Grant date	Dec 31, 2019

Abstract

In one aspect, a computerized method includes the step of providing process monitor in a Gateway. The method includes the step of, with the process monitor, launching a Gateway. Daemon (GWD). The GWD runs a GWD process that implements a Network Address Translation (NAT) process. The NAT process includes receiving a set of data packets from one or more Edge devices and forwarding the set of data packets to a public Internet. The method includes the step of receiving another set of data packets from the public Internet and forwarding the other set of data packets to the one or more Edge devices. The method includes the step of launching a Network Address Translation daemon (NATD). The method includes the step of detecting that the GWD process is interrupted; moving the NAT process to the NATD.

First claim

What is claimed as new and desired to be protected by Letters Patent of the United States is:

1. A system comprising:
a first device at an edge of a branch first network;
a second device operating as an access point to a second network; and

at least two links between the first device and the second device, wherein (i) a tunnel is established on an active first link of the at least two links, (ii) no tunnel is established on a backup second link of the at least two links, and (iii) probe packets are used to monitor a state of the backup second link in order to ensure that the second link can become active when needed to replace the first link;
wherein if the first link becomes inactive, a second tunnel is established on the second link and the second link becomes the active link.

2. The system of claim 1 , wherein the first device is an edge device and the second device is a gateway device.

3. The system of claim 1 further comprising a cloud web security service in the second network.

4. The system of claim 3 , wherein the cloud web security service performs security scanning for data traffic from the enterprise first network prior to the data traffic being sent to the public Internet.

5. The system of claim 3 , wherein the cloud web security service performs service insertion for data traffic from the enterprise first network prior to the data traffic being sent to the public Internet.

6. The system of claim 3 further comprising a tunnel from the second device to the cloud web service.

7. The system of claim 1 , wherein the second device performs network address translation for data traffic sent from the first device to the second network.

8. The system of claim 1 , wherein the probe packets are ICMP probe packets.

9. The system of claim 1 , wherein states of the active first link and the backup second link are both included in a link state machine.

10. The system of claim 9 , wherein the link state machine determines availability of links for failover.

11. The system of claim 10 , wherein the availability is reported as a link status by a centralized configuration and management application.

12. The system of claim 9 , wherein the link state machine establishes a set of flags to determine eligibility of the links.

13. The system of claim 1 , wherein using probe packets without an established tunnel on the backup second link saves bandwidth consumption on the second link.

14. The system of claim 1 , wherein the first device executes in a virtual machine located in a branch office.

15. The system of claim 1 , wherein the first link uses a first Internet service provider and the second link uses a second Internet service provider.

16. A system comprising:
a first device at an edge of a branch location of an enterprise network;
a second device operating as an access point to a public cloud network; and
at least two links between the first device and the second device, wherein (i) a tunnel is established on an active first link of the at least two links, (ii) no tunnel is established on an inactive backup second link of the at least two links, and (iii) probe packets are used to monitor a state of the inactive backup second link in order to ensure that the second link can become active when needed to replace the first link;
wherein if the first link becomes inactive, a second tunnel is established on the second link and the second link becomes the active link.

17. The system of claim 16 , wherein the first device is an edge device and the second device is a gateway device.

18. The system of claim 16 , wherein using probe packets without an established tunnel on the backup second link saves bandwidth consumption on the second link.

Assignees

• Nicira Inc

Inventors

• Mayya Ajit Ramachandra
• Thakore Parag Pritam
• Connors Stephen Craig
• Woo Steven Michael
• Mukundan Sunil
• Speeter Thomas Harold

Classifications

• H04L12/2856

  Access arrangements, e.g. Internet access (asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W) · CPC title

• H04L45/125

  based on throughput or bandwidth · CPC title

• H04L45/124

  using a combination of metrics · CPC title

• H04L45/123

  Evaluation of link metrics (techniques for monitoring network metrics H04L43/08) · CPC title

• H04L41/5032

  Generating service level reports · CPC title