Service optimization in networks and cloud interconnects

Patent metadata

Field	Value
Publication number	US-2024179125-A1
Application number	US-202218072374-A
Country	US
Kind code	A1
Filing date	Nov 30, 2022
Priority date	Nov 30, 2022
Publication date	May 30, 2024
Grant date	—

Abstract

This disclosure describes techniques and mechanisms for disclosure describes techniques and mechanisms for optimizing firewall enforcement. The techniques may implement a dynamic detection of Layer 7 processing at one end of the network, alleviating the need to enforce another layer 7 firewall inspection at the other end, thereby saving processing and network resources. The techniques enable firewalls and policies to be statically defined and located in one place.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a first network device located at a first site, a data packet, wherein the data packet corresponds to a data flow between the first network device and a second network device over a network; identifying a first firewall policy associated with the first network device; inspecting, based at least in part on the first firewall policy and by a first firewall, the data packet by the first network device; adding, by the first network device, a marker to the data packet to indicate inspection by the first firewall; transmitting, via the network, the data packet to the second network device at a second site; identifying a second firewall policy associated with a second network device; and determining, by the second network device, based at least in part on the second firewall policy and the marker, to refrain from inspecting the data packet.

2 . The method of claim 1 , wherein the data packet comprises UTD metadata.

3 . The method of claim 1 , wherein refraining from inspecting the data packet comprises refraining from processing a Layer 7 Firewall inspection by the second network device.

4 . The method of claim 1 , wherein the first network device comprises a SDCI router and the second network device comprises a SDCI headend device.

5 . The method of claim 1 , wherein adding the marker comprises adding UTD metadata to a SDWAN header of the data packet in a TLV format.

6 . The method of claim 1 , wherein the data packet comprises a header, wherein data included in the header of the data packet is encrypted.

7 . The method of claim 1 , wherein the marker comprises a flag included in UTD metadata in a header of the data packet, wherein the flag is included as part of a security level TLV.

8 . The method of claim 1 , wherein the network comprises a SDCI WAN.

9 . A system comprising:
one or more processors; and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, by a first network device located at a first site, a data packet, wherein the data packet corresponds to a data flow between the first network device and a second network device over a network;
identifying a first firewall policy associated with the first network device,
inspecting, based at least in part on the first firewall policy and by a first firewall, the data packet by the first network device;
adding, by the first network device, a marker to the data packet to indicate inspection by the first firewall;
transmitting, via the network, the data packet to the second network device at a second site;
identifying a second firewall policy associated with a second network device; and
determining, by the second network device, based at least in part on the second firewall policy and the marker, to refrain from inspecting the data packet.

10 . The system of claim 9 , wherein the data packet comprises UTD metadata.

11 . The system of claim 9 , wherein refraining from inspecting the data packet comprises refraining from processing a Layer 7 Firewall inspection by the second network device.

12 . The system of claim 9 , wherein the first network device comprises a SDCI router and the second network device comprises a SDCI headend device.

13 . The system of claim 9 , wherein adding the marker comprises adding UTD metadata to a SDWAN header of the data packet in a TLV format.

14 . The system of claim 9 , wherein the data packet comprises a header, wherein data included in the header of the data packet is encrypted.

15 . The system of claim 9 , wherein the marker comprises a flag included in UTD metadata in a header of the data packet, wherein the flag is included as part of a security level TLV.

16 . The system of claim 9 , wherein the network comprises a SDCI WAN.

17 . One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, by a first network device located at a first site, a data packet, wherein the data packet corresponds to a data flow between the first network device and a second network device over a network; identifying a first firewall policy associated with the first network device; inspecting, based at least in part on the first firewall policy and by a first firewall, the data packet by the first network device; adding, by the first network device, a marker to the data packet to indicate inspection by the first firewall; transmitting, via the network, the data packet to the second network device at a second site; identifying a second firewall policy associated with a second network device; and determining, by the second network device, based at least in part on the second firewall policy and the marker, to refrain from inspecting the data packet.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein the marker comprises a flag included in UTD metadata in a header of the data packet, wherein the flag is included as part of a security level TLV.

19 . The one or more non-transitory computer-readable media of claim 17 , wherein refraining from inspecting the data packet comprises refraining from processing a Layer 7 Firewall inspection by the second network device.

20 . The one or more non-transitory computer-readable media of claim 17 , wherein the network comprises a SDCI WAN.

Assignees

• Cisco Tech Inc

Inventors

• Sundararajan Balaji
• Nataraj Venkatesh
• Kumar kannan
• Nallur Padmanabha
• Jain Abha
• Patel Kushal

Classifications

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title