Group-based policy for inter-zone traffic

Abstract

In one embodiment, a method includes: receiving a data packet from a first host located in a first site, wherein the data packet may be destined for a second host located in a second site that may be different from the first site; determining whether an identifier of a second group to which the second host belongs is available at a first network node; sending a request for the identifier of the second group to a second network node, wherein the request may include an address of the second host; receiving a response including the identifier of the second group from the second network node; determining that the second group is a destination group; applying one or more policies associated with the destination group to the data packet; and causing the data packet to be routed to the second host.

Description

Technical Field

[0001] The present disclosure relates generally to the field of data communications, and more particularly to building group-based policies for inter-domain traffic. Background Art

[0002] An enterprise software-defined (SD)-wide area network (WAN) (SD-WAN) structure consists of edge routers with multiple virtual private networks (VPNs) that utilize point-to-point encrypted overlay tunnels (e.g., IPsec). These tunnels traverse one or more underlying networks using various connection methods (e.g., dedicated MPLS links, broadband Internet, or cellular networks). Edge routers and intermediate routers within the SD-WAN can apply SD-WAN policies to data packets while routing data packets from source to destination. SD-WAN policies can be determined based on the source group to which the source node belongs and / or the destination group to which the destination node belongs. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Figure 1 An example architecture for an SD-WAN is shown.

[0004] Figure 2 An example authentication procedure for a host is shown.

[0005] Figure 3 An example flow for obtaining a destination group from a destination edge router is shown.

[0006] Figure 4 An example flow for obtaining destination groups from the SD-WAN fabric control plane is shown.

[0007] Figure 5 An example determination of a policy for a data packet is shown.

[0008] Figure 6 An example method for implementing policy based on a destination group identifier at an SD-WAN edge router is shown.

[0009] Figure 7 An example computer system is shown. DETAILED DESCRIPTION

[0010] Overview

[0011] Various aspects of the invention are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect may be applicable to any aspect alone or in combination with other aspects.

[0012] In a particular embodiment, a first network node configured to operate at a first site of a network may receive a data packet from a first host located in the first site. The data packet may be sent to a second host located in a second site that may be different from the first site. The first network node may determine that an identifier of a second group to which the second host belongs is not available at the first network node. In response to the determination, the first network node may send a request for an identifier of the second group to the second network node. The request may include an address of the second host. The first network node may receive a response including an identifier of the second group from the second network node. The first network node may determine that the second group is a destination group based on the received identifier. The first network node may apply one or more policies associated with the destination group to the data packet. The first network node may cause the data packet to be routed to the second host.

[0013] Example Embodiments

[0014] Figure 1 An example architecture of an SD-WAN is shown. In certain embodiments, network 100 may be a software defined (SD) wide area network (WAN), which is a virtual upper layer network based on tunnels that carry traffic between multiple sites through one or more lower layer networks 130. Figure 1 The example shown shows two sites: a first site 110 and a second site 120. Each site can be connected to the network 100 via one or more WAN edge routers. For example, the first site 110 is connected to the network 100 through an edge router 101, and the second site 120 is connected to the network 100 through an edge router 102. The sites connected to the network 100 can have data plane connections to each other site through Internet Protocol Security (IPSec) tunnels. Edge routers 101 and 102 can have data plane connections through an underlying network 130. The underlying network 130 can include multi-protocol label switching (MPLS), the Internet, and cellular networks. The SD-WAN control plane can include a controller 105, which can maintain centralized routing tables and routing policies to program the forwarding behavior of the data plane. The controller 105 can maintain a direct control plane connection to each edge router. The controller 105 can provide, maintain, and protect the entire upper network. The SD-WAN network 100 can also include a management / orchestration plane 107. Although this disclosure describes an SD-WAN network in a particular manner, this disclosure contemplates an SD-WAN network in any suitable manner.

[0015] In certain embodiments, the first site may include a first host. The first host may belong to a first group. A switch to which the first host is connected may learn an identifier of the first group. The switch may add an identifier of the first group as a source group to a data packet originating from the first host. In certain embodiments, the switch may learn the identifier of the first group using one of the one or more dynamic mechanisms. In certain embodiments, the first host may perform an authentication process. The switch may learn the identifier of the first group during authentication of the first host.

[0016] Figure 2 An example authentication procedure for a host is shown. By way of example and not by way of limitation, Figure 2As shown, the first host 111 can be activated in step 200. The switch 203 can detect the first host 111 and can put the port connected to the first host 111 in an "unauthorized" state. The "unauthorized" state may only allow 802.1X traffic, while other traffic may be discarded. In step 210, the switch 203 can initiate authentication by periodically transmitting an Extensible Authentication Protocol (EAP)-Request Identifier frame to a special Layer 2 address (01:80:C2:00:00:03) on the local network segment. The first host 111 can listen to the address. Upon receiving the EAP-Request Identifier frame, in step 215, the first host 111 can respond with an EAP-Response Identifier frame containing an identifier (e.g., a user ID) of the first host 111. In step 220, the switch 203 can encapsulate the identifier response received from the first host 111 in a RADIUS access request packet, and can forward the RADIUS access request packet to the authentication server 205. At step 225, the authentication server 205 may send a reply (encapsulated in a RADIUS access-challenge packet) to the switch 203. At step 230, the switch 203 may encapsulate the EAP request in an EAP OverLAN (EAPOL) frame and transmit the EAPOL frame to the first host 111. At step 235, the first host 111 may send an EAP response to the switch. At step 240, the switch may encapsulate the received EAP response in a RADIUS access-request packet and forward the RADIUS access-request packet to the authentication server 205. At step 245, the authentication server may respond with any EAP-Success message (encapsulated in a RADIUS access-accept data packet). The EAP-Success message may include an identifier of the first group to which the first host belongs. The switch 203 may learn the identifier of the first group from the EAP-Success message. At step 250, the switch 203 may forward the EAP-Success message to the first host 111. Upon receiving EAP-Success, the switch 203 may set the port to an "authorized" state and may allow normal traffic. The switch 203 may add an identifier of the first group to the data packet originating from the first host 111. In certain embodiments, the switch 203 may learn the identifier of the first group using one of the one or more static mechanisms. In certain embodiments, the switch 203 may maintain a mapping table between IP addresses and their corresponding groups. The switch 203 may learn the identifier of the first group based on the IP address associated with the first host 111. Although the present disclosure describes learning the identifier of the group to which the first host belongs in a particular manner, the present disclosure contemplates learning the identifier of the group to which the first host belongs in any suitable manner.

[0017] In a particular embodiment, the first network node 101 may receive a data packet from a first host 111 located in a first site 110. The data packet may be destined for a second host 121 located in a second site 120. The first site 110 may be separate from the second site 120. The first site 110 and the second site 120 may be connected through the SD-WAN network 100. The switch 203 connected to the first host 111 may add an identifier of the first group as a source group to the data packet, so the data packet may include an identifier of the first group. The first network node 101 may update a local database with a mapping of the IP address of the first host 111 and the identifier of the first group in the data packet. As an example and not limitation, the first host 111 located in the first site 110 may belong to the HR group in the enterprise. The group identifier of the HR group may be 1000. The first host 111 may send a data packet to the second host 121 located in the second site 120. The second host 121 may belong to the engineering group in the enterprise. The group identifier of the engineering group may be 2000. The switch 203 connected to the first host 111 may add the group identifier 1000 to the data packet. The data packet may arrive at a source edge router 101 connecting the first site 110 to the SD-WAN network 100. The source edge router 101 may update a local database with a mapping of the IP address of the first host 111 and the group identifier 1000 of the HR group. Although the present disclosure describes receiving a data packet including a source group identifier in a particular manner, the present disclosure contemplates receiving a data packet including a source group identifier in any suitable manner.

[0018] In a particular embodiment, first network node 101 may determine that an identifier of a second group is not available at first network node 101, wherein the second group is a group to which second host 121 belongs. In a particular embodiment, first network node 101 may determine whether the identifier of the second group is available at first network node 101 by searching a local database at first network node 101. As an example and not by way of limitation, continuing with the previous example, source edge router 101 may attempt to determine an identifier of the second group upon receiving a data packet from first host 111 to second host 121. Source edge router 101 may look up an IP address of second host 121 to identify the identifier of the second group. When there is no record of the IP address of the second host in the local database, source edge router 101 may determine that the identifier of the second group is not available. Although the present disclosure describes determining that an identifier of a destination group of a data packet is not available at a source edge router in a particular manner, the present disclosure contemplates determining that an identifier of a destination group of a data packet is not available at a source edge router in any suitable manner.

[0019] In certain embodiments, first network node 101 may, in response to the determination, send a request for an identifier of the second group to the second network node. The request may include an address of the second host. Although this disclosure describes sending a request for an identifier of the destination group in a particular manner, this disclosure contemplates sending a request for an identifier of the destination group in any suitable manner.

[0020] Figure 3 An example process for obtaining a destination group from a destination edge router is shown. Figure 3 In the example shown, the first host 111 may send a data packet to the second host 121. The first host 111 may be located in the first site 110. The second host 121 may be located in the second site 120. The first host 111 may belong to an HR group in the enterprise. The group identifier of the HR group may be 1000. The second host 121 may belong to an engineering group in the enterprise. The group identifier of the engineering group may be 2000. In step 310, the data packet may be forwarded to the switch 203 connected to the first host 111. The switch 203 may add the identifier 1000 of the HR group to the data packet. The switch 203 may have learned the identifier of the HR group during the authentication procedure of the first host 111. In step 320, the switch 203 may forward the data packet to the source edge router 101 that connects the first site 110 to the SD-WAN network 100. The data packet may include the identifier 1000 of the HR group.

[0021] In certain embodiments, the second network node may be a WAN edge router 102 configured to operate at the second site 120. The second network node may determine the identifier of the second group by communicating with a local fabric control plane 307 associated with the second site 120. The source edge router 101 may receive a response including the identifier of the second group from the second edge router 102. The source edge router 101 may determine that the second group is the destination group based on the received identifier. By way of example and not by way of limitation, Figure 3In the previous example shown, the source edge router 101 can send a control message to the destination side WAN edge router 102. At step 330, the control message can include the destination IP address of the data packet. The destination edge router 102 can look up its local database to find the identifier of the destination group to which the second host 121 belongs. If the destination group is not available in the local database, the destination edge router 102 can query the local fabric control plane controller 307 at step 340. The local fabric control plane controller 307 may have learned the destination group identifier 2000 of the engineering group from the authentication server 305 located in the second site 120. At step 350, the local fabric control plane controller 207 can send a response to the destination edge router 102. At step 360, the destination edge router can send a control message to the source edge router 101, wherein the control message can include the identifier 2000 of the engineering group. Upon receiving the control message, the source edge router 101 can determine that the engineering group is the destination group. Since the source edge router 101 knows both the source group identifier and the destination group identifier, the source edge router 101 can apply one or more appropriate policies to the data packet. Source edge router 101 may forward the data packet to destination edge router 102 through lower layer network 130. At step 380, destination edge router 102 may forward the data packet to switch 303 connected to second host 121. At step 390, switch 303 may forward the data packet to second host 121. Although this disclosure describes obtaining a destination group identifier from a destination edge router in a particular manner, this disclosure contemplates obtaining a destination group identifier from a destination edge router in any suitable manner.

[0022] In a particular embodiment, the request sent at step 330 and the response sent at step 360 may be a control message sent via an Ordered Management Protocol (OMP). OMP is a newly introduced protocol that forms the core of the lower layer network. OMP is a protocol that runs within a Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS) tunnel formed between an edge router and a control plane controller. OMP is a control protocol for exchanging routing, policy, and management information between a controller and an edge router in the lower layer network. Although the present disclosure describes sending control messages in a particular manner, the present disclosure contemplates sending control messages in any suitable manner.

[0023] In a particular embodiment, the request sent at step 330 and the response sent at step 360 may be control messages sent via WebSocket. WebSocket is a communication protocol that provides a full-duplex communication channel over a single TCP connection. WebSocket enables message streaming on top of TCP. TCP handles byte streams alone and has no inherent concept of messages. Although the present disclosure describes sending control messages in a particular manner, the present disclosure contemplates sending control messages in any suitable manner.

[0024] In certain embodiments, the second network node may be the SD-WAN fabric control plane controller 105. The second network node may maintain a group identifier associated with hosts in the network. The first network node 101 may receive a response from the second network node including an identifier of the second group. Figure 4 An example process for obtaining a destination group from the SD-WAN fabric control plane is shown. As an example and not by way of limitation, Figure 4As shown, when the first host 111 performs an authentication procedure, the controller 105 within the SD-WAN fabric control plane may receive information associated with an identifier of a first group associated with the first host 111 from the authentication server 205 in the first site 110. When the second host 121 performs an authentication procedure, the controller 105 may receive information associated with an identifier of a second group associated with the second host 121 from the authentication server 305 in the second site 120. When the first host 111 sends a data packet to the second host 121, the data packet may be forwarded to the switch 203 connected to the first host 111 in step 410. In step 420, the switch 203 may add the identifier of the first group as a source group to the data packet, and forward the data packet to the source edge router 101 connected to the first host. The source edge router 101 may attempt to determine the identifier of the destination group by looking up the IP address of the second host 121 (destination host) in a local database. If the source edge router 101 fails to find a record of the IP address of the second host 121, the source edge router 101 may send a request to the controller 105 in the SD-WAN fabric control plane at step 430. The request may include the IP address of the destination host (i.e., the second host 121). The controller 105 may find the identifier of the second group from its own database. At step 440, the controller 105 may respond to the source edge router 101 with the identifier of the second group. The request at step 430 and the response at step 440 may be control plane messages. The source edge router 101 may determine that the second group is the destination group based on the received identifier. The source edge router 101 may determine a policy corresponding to the data packet based on the destination group identifier. In a particular embodiment, the source edge router 101 may determine a policy corresponding to the data packet based on the first group identifier. The source edge router 101 may apply the determined policy to the data packet. At step 450, the source edge router 101 may cause the data packet to be passed to the destination edge router 102 through the lower layer network 130. The destination edge router 102 may attempt to determine the destination group identifier by looking up the IP address of the destination host (i.e., the second host 121) in its local database. If the destination edge router 102 fails to find the destination IP address in the local database, the destination edge router 102 may send a request to the controller 105, which is not in the local database. Figure 4. The destination edge router 102 may determine a policy corresponding to the data packet based on the destination group identifier. In a particular embodiment, the destination edge router 102 may determine a policy corresponding to the data packet based on the source group identifier. The destination edge router 102 may apply the policy to the data packet. At step 460, the destination edge router 102 may forward the data packet to the switch 303 connected to the second host 121. At step 470, the switch may forward the data packet to the second host 121. Although the present disclosure describes obtaining the destination group identifier from the SD-WAN fabric control plane in a particular manner, the present disclosure contemplates obtaining the destination group identifier from the SD-WAN fabric control plane in any suitable manner.

[0025] In certain embodiments, first network node 101 may determine one or more policies corresponding to the data packet. In certain embodiments, one or more policies may be associated with a destination group. In certain embodiments, one or more policies may be associated with a source group. First network node 101 may apply one or more policies to the data packet. Figure 5 An example determination of a policy for data grouping is shown. As an example and not by way of limitation, Figure 5 As shown, the source edge router 101 can utilize a policy engine 501 to determine one or more policies corresponding to the data packet. In a particular embodiment, the policy engine 501 can be within the source edge router 101. In a particular embodiment, the policy engine 501 can be remote from the source edge router 101. The source edge router 101 can provide the policy engine 501 with an identifier of a source group corresponding to the data packet as input. The source edge router 101 can provide the policy engine 501 with an identifier of a destination group corresponding to the data packet as input. The policy engine 501 can generate one or more policies corresponding to the data packet. The one or more policies may include admission control, routing path selection, security policies, quality of service (QoS) services, and traffic policing. The source edge router 101 can apply the determined one or more policies to the data packet. Any router in the routing path within the SD-WAN network 100 can determine one or more policies corresponding to the data packet and apply the one or more policies to the data packet. Although the present disclosure describes determining one or more policies corresponding to the data packet in a particular manner and applying the policies to the data packet, the present disclosure contemplates determining one or more policies corresponding to the data packet in any suitable manner and applying the policies to the data packet.

[0026] In particular embodiments, one or more policies may include admission control. The network 100 may limit traffic accessing the network based on a source group identifier, based on a destination group identifier, or based on a combination of a source group and a destination group. As an example and not by way of limitation, the policy engine 501 may deny data packets from being routed through the SD-WAN network 100 based on a determined source group identifier and / or a determined destination group identifier. The source router 101 may then discard the data packet without causing the data packet to be routed through the SD-WAN network 100. Although the present disclosure describes implementing admission control policies on data packets in a particular manner, the present disclosure contemplates implementing admission control policies on data packets in any suitable manner.

[0027] In a particular embodiment, one or more policies may include routing path selection. Routing path selection may be performed based on a destination group identifier. In a particular embodiment, routing path selection may be performed based on a source group identifier. Dynamic routing may be one of the main features of the SD-WAN. The first network node 101 may route data packets through one of a plurality of available routing paths based on a source group identifier and / or a destination group identifier. As an example and not by way of limitation, the policy engine 501 may generate a routing path for a data packet based on a source group identifier and / or a destination group identifier. The source edge router 101 may cause the data packet to be routed to the destination edge router 102 via the generated routing path. Although the present disclosure describes implementing routing path selection based at least on a destination group identifier in a particular manner, the present disclosure contemplates implementing routing path selection based at least on a destination group identifier in any suitable manner.

[0028] In a particular embodiment, one or more policies may include a security policy. The security policy may be determined based on the destination group identifier. In a particular embodiment, the security policy may be determined based on the source group identifier. As an example and not by way of limitation, the policy engine 501 may generate a set of firewall rules for a data packet based on the source group identifier and / or the destination group identifier. The source edge router 101 may apply the generated firewall rules to the data packet. In a particular embodiment, if the data packet fails to meet the generated firewall rules, the source edge router 101 may discard the data packet. Although the present disclosure describes implementing a security policy to a data packet based at least on the destination group identifier in a particular manner, the present disclosure contemplates implementing a security policy to a data packet based at least on the destination group identifier in any suitable manner.

[0029] In a particular embodiment, one or more policies may include a quality of service (QoS) policy. The QoS policy may be determined based on a destination group identifier. In a particular embodiment, the QoS policy may be determined based on a source group identifier. Multiple QoS parameters may be determined based on the QoS level of the data packet. The QoS level may be determined based on the source group identifier and / or the destination group identifier of the traffic. As an example and not by way of limitation, the policy engine 501 may determine that the data packet is a traffic of the best performance level based on the source group identifier and / or the destination group identifier. The source edge router 101 may apply multiple QoS parameters associated with the traffic of the best performance level to the data packet. Although the present disclosure describes implementing a QoS policy based at least on a destination group identifier in a particular manner, the present disclosure contemplates implementing a QoS policy based at least on a destination group identifier in any suitable manner.

[0030] In certain embodiments, one or more policies may include traffic policing that may implement a predetermined maximum data rate. The predetermined maximum data rate may be determined based on a destination group identifier. In certain embodiments, the predetermined maximum data rate may be determined based on a source group identifier. As an example and not by way of limitation, the policy engine 501 may determine that the maximum data rate for traffic from a first group to a second group is 100 Mbps. The source edge router 101 may implement the determined maximum data rate for traffic from a first host 111 to a second host 121. Although the present disclosure describes implementing the maximum data rate based at least on a destination group identifier in a particular manner, the present disclosure contemplates implementing the maximum data rate based at least on a destination group identifier in any suitable manner.

[0031] In certain embodiments, first network node 101 may cause data packets to be routed to second host 121. As an example and not by way of limitation, source edge router 101 may cause data packets to be routed to destination edge router 102 via one of the one or more IPSec tunnels between source edge router 101 and destination edge router 102 through underlying network 130. Upon receiving the data packet, destination edge router 102 may route the data packet to second host 121 based on a local routing policy in second site 120. Although the present disclosure describes routing data packets to a destination host in a particular manner, the present disclosure contemplates causing data packets to be routed to a destination host in any suitable manner.

[0032] In a particular embodiment, the first network node 101 may receive a second data packet from the second host 121 to the first host 111. The first network node 101 may identify the source group identifier based on the source group identifier field in the second data packet. In a particular embodiment, the first network node 101 may determine that the source group identifier is different from the second group identifier in the record. In response to the determination, the first network node 101 may update the identifier of the second group in the record with the source group identifier. As an example and not by limitation, upon receiving the first data packet from the first host 111, the second host 121 may respond to the first host 111 with a second data packet. The second data packet may arrive at the first edge router 101 within the first site 110. The first edge router 101 may determine the source group identifier of the second data packet based on the source group identifier field in the second data packet. The first edge router 101 may compare the source group identifier of the second data packet with the second group identifier corresponding to the second host 121 in the local database. If the source group identifier does not match the second group identifier in the local database, the first edge router 101 may update the second group identifier in the local database with the source group identifier of the second data packet. Although this disclosure describes updating a remote host's group identifier based on data packets originating from the remote host in a particular manner, this disclosure contemplates updating a remote host's group identifier based on data packets originating from the remote host in any suitable manner.

[0033] Figure 6 An example method 600 for implementing policies based on a destination group identifier at an SD-WAN edge router is shown. The method may begin at step 610, where a first network node configured to operate at a first site of a network may receive a data packet from a first host located in the first site that is destined for a second host located in a second site. The first site and the second site may be different. At step 620, the first network node may determine whether an identifier of a second group to which the second host belongs is available at the first network node. At step 630, the first network node may, in response to the determination, send a request for an identifier of the second group to the second network node. The request may include an address of the second host. At step 640, the first network node may receive a response including an identifier of the second group from the second network node. The first network node may determine that the second group is a destination group based on the received identifier. At step 650, the first network node may apply one or more policies associated with the destination group to the data packet. At step 660, the first network node may cause the data packet to be routed to the second host. Specific embodiments may be repeated where appropriate Figure 6 Although the present disclosure describes and illustrates the steps that occur in a particular order, Figure 6The specific steps of the method are described in detail below, but the present disclosure contemplates that they occur in any suitable order. Figure 6 In addition, although the present disclosure describes and illustrates example methods (including Figure 6 ), but the present disclosure contemplates any suitable method (including any suitable steps) for implementing a policy based on a destination group identifier at an SD-WAN edge router, which steps may include, where appropriate Figure 6 All, some or none of the steps of the method Figure 6 Furthermore, although the present disclosure describes and illustrates the steps of performing Figure 6 specific components, devices or systems for specific steps of the method, but the disclosure contemplates the implementation of Figure 6 Any suitable combination of any suitable components, devices, or systems of any suitable steps of the method.

[0034] System and method

[0035] Figure 7 An example computer system 700 is shown. In a particular embodiment, one or more computer systems 700 perform one or more steps of one or more methods described or shown herein. In a particular embodiment, one or more computer systems 700 provide functionality described or shown herein. In a particular embodiment, software running on one or more computer systems 700 performs one or more steps of one or more methods described or shown herein, or provides functionality described or shown herein. A particular embodiment includes one or more portions of one or more computer systems 700. In this document, references to computer systems may encompass computing devices, and vice versa, where appropriate. In addition, references to computer systems may encompass one or more computer systems, where appropriate.

[0036] The present disclosure contemplates any suitable number of computer systems 700. The present disclosure contemplates computer systems 700 in any suitable physical form. By way of example and not by way of limitation, computer system 700 may be an embedded computer system, a system on a chip (SOC), a single board computer system (SBC) (e.g., a modular computer (COM) or modular system (SOM)), a desktop computer system, a laptop or notebook computer system, an interactive kiosk, a mainframe, a computer system grid, a mobile phone, a personal digital assistant (PDA), a server, a tablet computer system, an augmented / virtual reality device, or a combination of two or more of the foregoing. Where appropriate, computer system 700 may include one or more computer systems 700; be single or distributed; span multiple locations; span multiple machines; span multiple data centers; or reside in a cloud, which may include one or more cloud components in one or more networks. Where appropriate, one or more computer systems 700 may perform one or more steps of one or more methods described or shown herein without substantial spatial or temporal limitations. By way of example and not by way of limitation, one or more computer systems 700 may perform one or more steps of one or more methods described or shown herein in real time or in batch mode. Where appropriate, one or more computer systems 700 may perform at different times or at different locations one or more steps of one or more methods described or illustrated herein.

[0037] In a particular embodiment, computer system 700 includes a processor 702, a memory 704, a storage device 706, an input / output (I / O) interface 708, a communication interface 710, and a bus 712. Although this disclosure describes and illustrates a particular computer system having a particular number of particular components in a particular arrangement, this disclosure contemplates any suitable computer system having any suitable number of particular components in any suitable arrangement.

[0038] In a particular embodiment, the processor 702 includes hardware for executing instructions (e.g., those that constitute a computer program). As an example and not by way of limitation, to execute instructions, the processor 702 may retrieve (or fetch) instructions from an internal register, an internal cache, a memory 704, or a storage device 706; decode and execute the instructions; and then write one or more results to an internal register, an internal cache, a memory 704, or a storage device 706. In a particular embodiment, the processor 702 may include one or more internal caches for data, instructions, or addresses. Where appropriate, the present disclosure contemplates that the processor 702 includes any suitable number of any suitable internal caches. As an example and not by way of limitation, the processor 702 may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). The instructions in the instruction cache may be copies of the instructions in the memory 704 or the storage device 706, and the instruction cache may speed up the retrieval of those instructions by the processor 702. The data in the data cache may be a copy of data in the memory 704 or storage device 706 for executing instructions on the processor 702 for operation; the results of previous instructions executed at the processor 702 for access by subsequent instructions executed at the processor 702 or for writing to the memory 704 or storage device 706; or other suitable data. The data cache may speed up the read or write operations of the processor 702. The TLB may speed up the virtual address translation of the processor 702. In a particular embodiment, the processor 702 may include one or more internal registers for data, instructions, or addresses. The present disclosure contemplates that the processor 702 includes any suitable number of any suitable internal registers, where appropriate. Where appropriate, the processor 702 may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors 702. Although the present disclosure describes and illustrates a particular processor, the present disclosure contemplates any suitable processor.

[0039] In a particular embodiment, the memory 704 includes a main memory for storing instructions for execution by the processor 702 or data for operation by the processor 702. As an example and not by way of limitation, the computer system 700 may load instructions from the storage device 706 or another source (e.g., another computer system 700) to the memory 704. The processor 702 may then load the instructions from the memory 704 to an internal register or internal cache. In order to execute the instructions, the processor 702 may retrieve the instructions from the internal register or internal cache and decode them. During or after the execution of the instructions, the processor 702 may write one or more results (which may be intermediate or final results) to the internal register or internal cache. The processor 702 may then write one or more of these results to the memory 704. In a particular embodiment, the processor 702 executes only instructions in one or more internal registers or internal caches or memory 704 (as opposed to the storage device 706 or elsewhere) and operates only on data in one or more internal registers or internal caches or memory 704 (as opposed to the storage device 706 or elsewhere). One or more memory buses (which may each include an address bus and a data bus) may couple the processor 702 to the memory 704. The bus 712 may include one or more memory buses, as described below. In a particular embodiment, one or more memory management units (MMUs) reside between the processor 702 and the memory 704 and facilitate access to the memory 704 requested by the processor 702. In a particular embodiment, the memory 704 includes a random access memory (RAM). Where appropriate, the RAM may be a volatile memory. Where appropriate, the RAM may be a dynamic RAM (DRAM) or a static RAM (SRAM). In addition, where appropriate, the RAM may be a single-port or multi-port RAM. The present disclosure contemplates any suitable RAM. Where appropriate, the memory 704 may include one or more memories 704. Although the present disclosure describes and illustrates specific memories, the present disclosure contemplates any suitable memory.

[0040] In a particular embodiment, the storage device 706 includes a large capacity memory for data or instructions. As an example and not by limitation, the storage device 706 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive or a combination of two or more of the above. Where appropriate, the storage device 706 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 706 may be inside or outside the computer system 700. In a particular embodiment, the storage device 706 is a non-volatile solid-state memory. In a particular embodiment, the storage device 706 includes a read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM) or a flash memory or a combination of two or more of the above. The present disclosure contemplates a large capacity storage device 706 in any suitable physical form. Where appropriate, the storage device 706 may include one or more storage control units that facilitate communication between the processor 702 and the storage device 706. Where appropriate, storage 706 may include one or more storage devices 706. Although this disclosure describes and illustrates particular storage devices, this disclosure contemplates any suitable storage devices.

[0041] In a particular embodiment, the I / O interface 708 includes hardware, software, or both, for providing one or more interfaces for communication between the computer system 700 and one or more I / O devices. Where appropriate, the computer system 700 may include one or more of these I / O devices. One or more of these I / O devices can enable communication between a person and the computer system 700. As an example and not by limitation, the I / O device may include a keyboard, a key, a microphone, a monitor, a mouse, a printer, a scanner, a speaker, a static camera, a stylus, a tablet computer, a touch screen, a trackball, a camera, other suitable I / O devices, or a combination of two or more of the above. The I / O device may include one or more sensors. The present disclosure contemplates any suitable I / O device and any suitable I / O interface 708 for them. Where appropriate, the I / O interface 708 may include one or more device or software drivers that enable the processor 702 to drive one or more of these I / O devices. Where appropriate, the I / O interface 708 may include one or more I / O interfaces 708. Although the present disclosure describes and illustrates a specific I / O interface, the present disclosure contemplates any suitable I / O interface.

[0042] In a particular embodiment, the communication interface 710 includes hardware, software, or both for providing one or more interfaces for communication (e.g., packet-based communication) between the computer system 700 and one or more other computer systems 700 or one or more networks. As an example and not by limitation, the communication interface 710 may include a network interface controller (NIC) or a network adapter for communicating with an Ethernet or other wired network, or a wireless NIC (WNIC) or a wireless adapter for communicating with a wireless network (e.g., a WI-FI network). The present disclosure contemplates any suitable network and any suitable communication interface 710. As an example and not by limitation, the computer system 700 may communicate with one or more parts of a self-organizing network, a personal area network (PAN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), or the Internet, or a combination of two or more of the foregoing. One or more parts of one or more of these networks may be wired or wireless. As an example, the computer system 700 may communicate with a wireless PAN (WPAN) (e.g., a BLUETOOTH WPAN), a WI-FI network, a WI-MAX network, a cellular telephone network (e.g., a Global System for Mobile Communications (GSM) network, a Long Term Evolution (LTE) network, or a 5G network), or other suitable wireless networks, or a combination of two or more of the above. Where appropriate, the computer system 700 may include any suitable communication interface 710 for any of these networks. Where appropriate, the communication interface 710 may include one or more communication interfaces 710. Although the present disclosure describes and illustrates particular communication interfaces, the present disclosure contemplates any suitable communication interface.

[0043] In a particular embodiment, bus 712 includes hardware, software, or both that couples components of computer system 700 to each other. As an example and not by way of limitation, bus 712 may include an accelerated graphics port (AGP) or other graphics bus, an enhanced industry standard architecture (EISA) bus, a front side bus (FSB), a HYPERTRANSPORT (HT) interconnect, an industry standard architecture (ISA) bus, an INFINIBAND interconnect, a low pin count (LPC) bus, a memory bus, a micro channel architecture (MCA) bus, a peripheral component interconnect (PCI) bus, a PCI-Express (PCIe) bus, a serial advanced technology attachment (SATA) bus, a video electronics standard association local (VLB) bus, or other suitable bus or a combination of two or more of the above. Where appropriate, bus 712 may include one or more buses 712. Although the present disclosure describes and illustrates a particular bus, the present disclosure contemplates any suitable bus or interconnect.

[0044] In summary, in one embodiment, a method includes: receiving a data packet from a first host located at a first site, wherein the data packet may be destined for a second host located in a second site that may be different from the first site; sending a request for an identifier of a second group to a second network device, wherein the request may include an address of the second host; receiving a response including the identifier of the second group from the second network device; determining that the second group is a destination group; applying one or more policies associated with the destination group to the data packet; and causing the data packet to be routed to the second host.

[0045] Herein, where appropriate, a computer-readable non-transitory storage medium may include one or more semiconductor-based or other integrated circuits (ICs) (e.g., field programmable gate arrays (FPGAs) or application-specific ICs (ASICs)), hard disk drives (HDDs), hybrid hard disk drives (HHDs), optical disks, optical disk drives (ODDs), magneto-optical disks, magneto-optical drives, floppy disks, floppy disk drives (FDDs), magnetic tapes, solid-state drives (SSDs), RAM drives, SECURE DIGITAL cards or drives, any other suitable computer-readable non-transitory storage medium, or any suitable combination of two or more of the foregoing. Where appropriate, a computer-readable non-transitory storage medium may be volatile, non-volatile, or a combination of volatile and non-volatile.

[0046] As used herein, "or" is inclusive and not exclusive, unless expressly stated otherwise or the context indicates otherwise. Thus, as used herein, "A or B" means "A, B, or both," unless expressly stated otherwise or the context indicates otherwise. Additionally, "and" is joint and several, unless expressly stated otherwise or the context indicates otherwise. Thus, as used herein, "A and B" means "A and B, jointly or severally," unless expressly stated otherwise or the context indicates otherwise.

[0047] The scope of the present disclosure covers all changes, substitutions, variations, alterations and modifications to the example embodiments described or shown herein that will be understood by those of ordinary skill in the art. The scope of the present disclosure is not limited to the example embodiments described or shown herein. In addition, although the present disclosure describes and illustrates the various embodiments herein as including specific components, elements, features, functions, operations or steps, any of these embodiments may include any combination or arrangement of any components, elements, features, functions, operations or steps described or shown anywhere herein that will be understood by those of ordinary skill in the art. In addition, the references to the device or system or the components of the device or system in the attached claims that are applicable to, arranged to, capable of being used for, configured to, enabled for, and operable for performing a specific function cover the device, system, component (regardless of whether it or the specific function is activated, turned on or unlocked), as long as the device, system or component is so applicable, arranged, capable of being used for, configured, enabled, operable for, or operated for. In addition, although the present disclosure describes or illustrates specific embodiments as providing specific advantages, specific embodiments may not provide these advantages or provide some or all of these advantages.

Claims

1. A method for data communication, comprising performing, by a first network device configured to operate at a first site of a network: receiving a data packet from a first host located in the first site and destined for a second host located in a second site, wherein: the first site and the second site are different, and wherein the data packet includes an identifier of a first group to which the first host belongs; determining, based on an identifier of the first group in the data packet, that the first group is a source group; determining that an identifier of a second group to which the second host belongs is not available at the first network device; sending a request for an identifier of the second group to which the second host belongs to a second network device, wherein the request includes an address of the second host; in response to sending the request for the identifier of the second group, receiving a response from the second network device including the identifier of the second group; determining, based on the received identifier, that the second group is a destination group; applying one or more policies determined based on a combination of the source group and the destination group to the data packets; and Causes the data packet to be routed to the second host.

2. The method according to claim 1, wherein: The first network device is a wide area network (WAN) edge router connected to the network, and wherein the network is a software defined (SD)-WAN including a plurality of sites.

3. The method according to claim 1, wherein: A switch connected to the first host adds an identifier of the first group, and wherein the switch connected to the first host learns the identifier of the first group during an authentication process for the first host.

4. The method according to any one of claims 1 to 3, wherein: The one or more policies include at least one of admission control, routing path selection, security policy, or quality of service (QoS) policy.

5. The method according to any one of claims 1 to 3, wherein: The one or more policies include traffic policing, and wherein a predetermined maximum data rate is enforced.

6. The method according to claim 5, wherein: Determining that the identifier of the second set is not available includes searching a local database at the first network device.

7. The method according to any one of claims 1 to 3, wherein: The request is a control message sent via the Ordered Management Protocol (OMP).

8. The method according to any one of claims 1 to 3, wherein: The request is a control message sent over WebSocket.

9. The method according to any one of claims 1 to 3, wherein: The second network device is a WAN fabric control plane, and the second network device maintains group identifiers associated with hosts in the network.

10. The method according to any one of claims 1 to 3, wherein: The second network device is a WAN edge router configured to operate at the second site.

11. The method according to claim 10, wherein: The second network device determines an identifier of the second group by communicating with a local fabric control plane associated with the second site.

12. The method according to any one of claims 1 to 3, further comprising: receiving, from the second host, a second data packet destined for the first host; identifying a source group identifier based on a source group identifier field in the second data packet; determining that the source group identifier is not identical to an identifier of the second group in the record; as well as In response to the determination, an identifier of the second group in the record is updated with the source group identifier.

13. A first network device, configured to operate at a first site of a network, the first network device comprising: one or more processors; as well as One or more computer-readable non-transitory storage media coupled to one or more of the one or more processors and comprising instructions that, when executed by one or more of the one or more processors, are operable to cause the system to: receiving a data packet from a first host located in the first site to a second host located in a second site, wherein the first site and the second site are different, and wherein the data packet includes an identifier of a first group to which the first host belongs; determining, based on an identifier of the first group in the data packet, that the first group is a source group; determining that an identifier of a second group to which the second host belongs is not available at the first network device; sending a request for an identifier of the second group to which the second host belongs to the second network device, wherein the request includes an address of the second host; in response to sending the request for the identifier of the second group, receiving a response from the second network device including the identifier of the second group; determining, based on the received identifier, that the second group is a destination group; applying one or more policies determined based on a combination of the source group and the destination group to the data packets; and Causes the data packet to be routed to the second host.

14. The first network device according to claim 13, wherein: The first network device is a WAN edge router connected to the network, and wherein the network is a SD-WAN including a plurality of sites.

15. The first network device according to claim 13 or 14, wherein: The one or more policies include at least one of admission control, routing path selection, security policy, or quality of service (QoS) policy.

16. The first network device according to claim 13 or 14, wherein: One or more of the one or more processors, when executing the instructions, may be further operable to: receiving, from the second host, a second data packet destined for the first host; identifying a source group identifier based on a source group identifier field in the second data packet; determining that the source group identifier is not identical to an identifier of the second group in the record; as well as In response to the determination, an identifier of the second group in the record is updated with the source group identifier.

17. A computer-readable non-transitory storage medium comprising software, the software, when executed on a first network device configured to operate at a first site of a network, operable to: receiving a data packet from a first host located in the first site and destined for a second host located in a second site, wherein: the first site and the second site are different, and wherein the data packet includes an identifier of a first group to which the first host belongs; determining, based on an identifier of the first group in the data packet, that the first group is a source group; determining that an identifier of a second group to which the second host belongs is not available at the first network device; sending a request for an identifier of the second group to which the second host belongs to the second network device, wherein the request includes an address of the second host; in response to sending the request for the identifier of the second group, receiving a response from the second network device including the identifier of the second group; determining, based on the received identifier, that the second group is a destination group; applying one or more policies determined based on a combination of the source group and the destination group to the data packets; and Causes the data packet to be routed to the second host.

18. The medium according to claim 17, wherein The first network device is a WAN edge router connected to the network, and wherein the network is a SD-WAN including a plurality of sites.

19. A first network device, configured to run the following modules at a first site of a network: means for receiving a data packet from a first host located in the first site to a second host located in a second site, wherein: the first site and the second site are different, and wherein the data packet includes an identifier of a first group to which the first host belongs; means for determining, based on an identifier of the first group in the data packet, that the first group is a source group; means for determining that an identifier of a second group to which the second host belongs is not available at the first network device; means for sending a request to a second network device for an identifier of the second group to which the second host belongs, wherein the request includes an address of the second host; means for receiving, in response to sending a request for an identifier of the second group, from the second network device a response including the identifier of the second group; means for determining the second group as a destination group based on the received identifier; means for applying to the data packets one or more policies determined based on a combination of the source group and the destination group; and Means for causing the data packets to be routed to the second host.

20. The first network device of claim 19, further comprising a module for implementing the method of any one of claims 2 to 12.

21. A computer program product comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 12.

Images