Distributed Routing Controller for Multi-Region SDWAN

Abstract

According to some embodiments, a software defined wide area network (SD-WAN) includes a first region and a second region. The first region includes a plurality of first routing controllers and a plurality of first SD-WAN edge routers. The second region includes a plurality of second routing controllers and a plurality of second SD-WAN edge routers. Each first SD-WAN edge router in the first region is configured to establish an Overlay Management Protocol (OMP) peering connection with the plurality of first routing controllers in the first region but avoid establishing an OMP peering connection with the plurality of second routing controllers in the second region. Each second SD-WAN edge router in the second region is configured to establish an OMP peering connection with the plurality of second routing controllers in the second region but avoid establishing an OMP peering connection with the plurality of first routing controllers in the first region.

Description

[Technical field]

[0001] (Related Applications) This application claims the benefit of U.S. Provisional Patent Application No. 63 / 232,946, filed August 13, 2021, entitled “Distributed Routing Controllers for Multi-Region SDWAN,” the entire contents of which are incorporated herein by reference.

[0002] FIELD OF THEINVENTION The present disclosure relates generally to software defined networking in a wide area network (SD-WAN), and more particularly to a distributed routing controller for multi-region SD-WAN. [Background technology]

[0003] Traditional wide area network (WAN) architectures connect users at branch or campus locations to applications hosted on servers in data centers. Typically, dedicated multiprotocol label switching (MPLS) circuits are used for secure and reliable connectivity. However, businesses are becoming increasingly mobile, and business-critical applications are running on the Internet across multiple clouds. Traditional WAN architectures can be limited in available bandwidth, security, and complexity management, which can hinder business productivity.

[0004] Software-defined networking in the WAN (SD-WAN) simplifies WAN management and operation by decoupling the networking hardware from its control mechanisms. Benefits include cost reduction through transport independence across multiple technologies, improved business application performance and increased agility, optimized user experience and efficiency for SaaS and public cloud applications, and simplified operations through automation and cloud-based management. However, existing SD-WANs can be difficult to scale due to limitations in routing controllers. [Brief description of the drawings]

[0005] For a more complete understanding of the disclosed embodiments and their features and advantages, reference is made to the following specification taken in conjunction with the accompanying drawings, in which: [Figure 1] FIG. 1 is a network diagram illustrating a multi-region SD-WAN with a distributed routing controller, according to some embodiments. [Diagram 2] FIG. 1 is a flow diagram illustrating an example method by an edge router in an SD-WAN, according to some embodiments. [Diagram 3] FIG. 1 is a flow diagram illustrating an example method by a route controller in an SD-WAN, according to some embodiments. [Figure 4] FIG. 1 illustrates an exemplary computer architecture for a device capable of executing program components that can be utilized to implement aspects of the various technologies presented herein, according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0006] overview Aspects of the invention are set out in the independent claims and preferred features are set out in the dependent claims. Features of one aspect may be applied to each aspect alone or in combination with other aspects.

[0007] According to some embodiments, a software defined wide area network (SD-WAN) includes a first region and a second region. The first region includes a plurality of first routing controllers and a plurality of first SD-WAN edge routers. The second region includes a plurality of second routing controllers and a plurality of second SD-WAN edge routers. Each first SD-WAN edge router in the first region is configured to establish an Overlay Management Protocol (OMP) peering connection with the plurality of first routing controllers in the first region but avoid establishing an OMP peering connection with the plurality of second routing controllers in the second region. Each second SD-WAN edge router in the second region is configured to establish an OMP peering connection with the plurality of second routing controllers in the second region but avoid establishing an OMP peering connection with the plurality of first routing controllers in the first region.

[0008] According to another embodiment, a method performed by an SD-WAN edge router in an SD-WAN includes sending a registration request to a network facilitator of the SD-WAN. The registration request includes a specific realm identifier of the SD-WAN edge router. The method further includes receiving a list of routing controllers from the network facilitator of the SD-WAN. The list of routing controllers identifies a plurality of routing controllers of the SD-WAN. Each routing controller in the list of routing controllers received from the network facilitator has a realm identifier that matches the specific realm identifier of the SD-WAN edge router. The method further includes establishing an OMP peering connection with the plurality of routing controllers in the list of routing controllers from the network facilitator. The method further includes avoiding establishing an OMP peering connection with any other routing controller having a realm identifier different from the specific realm identifier of the SD-WAN edge router.

[0009] According to yet another embodiment, a method performed by an SD-WAN facilitator in an SD-WAN includes receiving a first realm identifier from a plurality of first routing controllers in a first realm. The method further includes receiving a second realm identifier from a plurality of second routing controllers in a second realm. The method further includes receiving a registration request from an SD-WAN edge router. The registration request includes a particular realm identifier of the SD-WAN edge router. The method further includes determining that the particular realm identifier of the SD-WAN edge router matches the first realm identifiers of the plurality of first routing controllers in the first realm. The method further includes sending a list of routing controllers to the SD-WAN edge router. The list of routing controllers includes the plurality of first routing controllers and excludes the plurality of second routing controllers.

[0010] Technical advantages of certain embodiments of the present disclosure may include one or more of the following: Some systems and methods described herein prevent a full mesh of peering / control connections between all routing controllers in an SD-WAN. Unlike existing SD-WANs in which a centralized pool of routing controllers (e.g., vSmart controllers) stores route information for all regions of the SD-WAN, embodiments of the present disclosure provide a distributed per-region routing controller that stores route information only for the region to which the routing controller is assigned. Furthermore, each edge router in a particular region only peers with the routing controller in that particular region. By providing an SD-WAN with a distributed per-region routing controller, the SD-WAN may be able to horizontally scale to a greater extent than existing SD-WANs. Furthermore, by reducing the number of routes each routing controller needs to store, network bandwidth and computer resources (e.g., computer memory and processing power) may be optimized. Other technical advantages will be readily apparent to one skilled in the art from the following drawings, description, and claims. Moreover, although specific advantages have been recited above, various embodiments may include all, some, or none of the recited advantages.

[0011] Exemplary embodiments The present disclosure generally relates to multi-region SD-WANs with distributed routing controllers, as opposed to typical SD-WANs with centralized routing controllers. Large enterprises and organizations with facilities across multiple regions (e.g., multiple cities, states, or counters) may deploy SD-WANs to support various technical requirements. Such deployments typically have high scale requirements. For example, an organization's SD-WAN may require the ability to scale up to tens of thousands of routers. However, because a typical SD-WAN has a centralized routing controller cluster (e.g., a centralized cluster of Cisco vSmart controllers), a typical SD-WAN deployment may have limitations in its ability to scale up to the number of routers required.

[0012] To address these and other issues with typical SD-WANs with centralized routing controllers, the embodiments described herein provide an architecture for a distributed per-region routing controller architecture that allows multi-region SD-WANs to scale horizontally to a greater extent than existing SD-WANs with centralized routing controllers. The distributed routing controller architecture of the disclosed embodiments addresses the scaling limitations of existing SD-WANs with centralized routing controllers by providing an architecture in which routing controllers (i.e., vSmart controllers) are assigned to specific regions and can have different states than routing controllers in different regions. This allows for greater route scaling overall across the entire SD-WAN, since each routing controller does not store routes for the entire SD-WAN, but only for its region. To achieve this architecture, the disclosed embodiments provide fully automated dynamic peering logic for edge / border routers that utilizes region-specific identifiers to program edge / border routers to peer only with routing controllers assigned to the same region as the edge / border router. For example, all border routers in a particular SD-WAN region are programmed to peer only with routing controllers that have the same region identifier as the border router (i.e., the border router does not peer with routing controllers assigned to different SD-WAN regions). As a result, SD-WANs according to disclosed embodiments can scale horizontally more than existing SD-WANs with centralized routing controllers.

[0013] 1 shows a network diagram illustrating a multi-region SD-WAN environment 100 with distributed routing controllers 120. The multi-region SD-WAN environment 100 includes multiple SD-WAN regions 110. For example, the multi-region SD-WAN environment 100 may include a first SD-WAN region 110A, a second SD-WAN region 110B, a third SD-WAN region 110C, and a core / middle mile SD-WAN region 110D. Each SD-WAN region 110 includes multiple routing controllers 120. For example, the first SD-WAN region 110A includes routing controllers 120A-1 and 120A-2, the second SD-WAN region 110B includes routing controllers 120B-1 and 120B-2, the third SD-WAN region 110C includes routing controllers 120C-1 and 120C-2, and the core / middle mile SD-WAN region 110D includes routing controllers 120D-1 and 120D-2. Each routing controller 120 peers only with other routing controllers 120 in the same SD-WAN region 110 (e.g., by forming an OMP peering / control connection 150 over a network such as the Internet). For example, the routing controllers 120A-1 and 120A-2 peer with each other but not with any of the remaining routing controllers 120 in the multi-region SD-WAN environment 100. Similarly, each routing controller 120 peers (e.g., by forming OMP peering / control connections 150 over a network such as the Internet) only with edge routers 130 and border routers 140 that are within the same SD-WAN region 110. For example, routing controllers 120A-1 and 120A-2 peer with edge routers 130A-1, 130A-2, and 130A-3 and border routers 140A and 140B, but do not peer with any of the remaining edge routers 130 and border routers 140 in the multi-region SD-WAN environment 100.Because the multi-region SD-WAN environment 100 includes SD-WAN regions 110 that each have dedicated routing controllers 120 that peer only with their respective SD-WAN regions 110 (i.e., instead of a typical SD-WAN where a centralized pool of routing controllers peers with the entire SD-WAN), the multi-region SD-WAN environment 100 may be able to horizontally scale routing controller clusters and their associated paths / routes relatively indefinitely.

[0014] The routing controller 120 analyzes and manages the control plane of the multi-region SD-WAN environment 100. Unlike the edge router 130 or the border router 140, the routing controller 120 does not handle the transmission of data traffic. Instead, the routing controller 120 provides route information to the edge router 130 and the border router 140. In some embodiments, each routing controller 120 is a Cisco vSmart controller, which is software running as a virtual machine on a server. Each routing controller 120 forms OMP peering / control connections 150 over a network, such as the Internet, with edge routers 130, border routers 140, and other routing controllers 120 in the same region 110. Each OMP peering / control connection 150 (e.g., 150A-F) is a communication channel over which a control protocol (i.e., OMP) is used to exchange routing, policy, and management information between network devices. In general, the routing controller 120 establishes connections, coordinates connections, and maintains the connections that form the SD-WAN fabric. The routing controller 120 establishes and maintains a control plane connection (i.e., OMP peering / control connection 150) with each edge router 130. Each OMP peering / control connection 150, which operates as a Datagram Transport Layer Security (DTLS) tunnel, is established after successful device authentication. In some embodiments, the OMP peering / control connection 150 carries an encrypted payload between the routing controller 120 and the edge router 130. This payload may include route information necessary for the routing controller 120 to determine the network topology, calculate the best route to a network destination, and distribute this route information to the edge router 130. In some embodiments, the routing controller 120 does not have a direct peering relationship with any device to which the edge router 130 is connected on the service side of the SD-WAN.

[0015] Each routing controller 120 stores and maintains a route table that stores route information (i.e., OMP routes) for its associated region 110 that it learns from edge routers 130 and from any other routing controllers 120 in that region 110 (i.e., via OMP peering / control connections 150). Because the multi-region SD-WAN environment 100 provides a distributed per-region architecture for the routing controllers 120, each routing controller 120 only stores in its route table route information for the region in which the routing controller 120 is operating. For example, routing controllers 120A-1 and 120A-2 only store route information for SD-WAN region 110A that they learn from each other and from edge routers 130A-1, 130A-2, and 130A-3 in SD-WAN region 110A. Similarly, routing controllers 120B-1 and 120B-2 store only route information for SD-WAN region 110B that they learn from each other and from edge routers 130B-1, 130B-2, and 130B-3 in SD-WAN region 110B, and routing controllers 120C-1 and 120C-2 store only route information for SD-WAN region 110C that they learn from each other and from edge routers 130C-1, 130C-2, and 130C-3 in SD-WAN region 110C. Routing controllers 120A-1 and 120A-2 do not store route information for regions 110B or 110C, routing controllers 120B-1 and 120B-2 do not store route information for regions 110A or 110C, and routing controllers 120C-1 and 120C-2 do not store route information for regions 110A or 110B. By having a distributed routing controller 120 that is prevented from storing route information for all regions 110 in the SD-WAN, the multi-region SD-WAN environment 100 can scale horizontally to a much greater extent than a typical SD-WAN that has a centralized routing controller 120 that stores route information for all regions 110.

[0016] Each SD-WAN area 110 also includes multiple edge routers 130. For example, the first SD-WAN area 110A includes edge routers 130A-1, 130A-2, and 130A-3, the second SD-WAN area 110B includes edge routers 130B-1, 130B-2, and 130B-3, and the third SD-WAN area 110C includes edge routers 130C-1, 130C-2, and 130C-3. The edge routers 140 are located at the periphery of sites (remote offices, branches, campuses, data centers, etc.) and provide connectivity between the sites. The edge routers 130 can be either hardware devices or software (e.g., cloud-based routers) running as virtual machines. The edge routers 130 handle the transmission of data traffic. Similar to the routing controllers 120, each edge router 130 peers only with routing controllers 120 in the same SD-WAN region 110 (e.g., by forming OMP peering / control connections 150). For example, edge routers 130A-1, 130A-2, and 130A-3 peer with routing controllers 120A-1 and 120A-2, but avoid peering with any of the remaining routing controllers 120 in the multi-region SD-WAN environment 100.

[0017] Each SD-WAN region 110 also includes multiple border routers 140. For example, the first SD-WAN region 110A includes border routers 140A and 140B, the second SD-WAN region 110B includes border routers 140C and 140D, and the third SD-WAN region 110C includes border routers 140E and 140F. Each border router 140 is also located within the core / middle mile SD-WAN region 110D. The border routers 140 can be either hardware devices or software running as virtual machines (e.g., cloud-based routers). The border routers 140 handle the transmission of data traffic. Each border router 140, edge router 130 peers with a routing controller 120 in the same SD-WAN region 110 and with a routing controller 120 in the core / middle mile SD-WAN region 110D (e.g., by forming an OMP peering / control connection 150). For example, border routers 140A and 140B peer with routing controllers 120A-1 and 120A-2 in the first SD-WAN region 110A in addition to routing controllers 120D-1 and 120D-2 in the core / middle mile SD-WAN region 110D.

[0018] The network facilitator 160 is a network device that automatically coordinates the initial onboarding of the routing controller 120, the edge router 130, and the border router 140. In general, the network facilitator 160 facilitates the connection between the routing controller 120 and the edge router 130. During the onboarding process, the network facilitator 160 authenticates and validates the device requesting to join the overlay network. For example, the network facilitator 160 may receive a registration request 170 from a particular SD-WAN edge router 130, such as edge router 130A-1. In some embodiments, the registration request 170 may include a particular realm identifier of the particular SD-WAN edge router (e.g., the realm identifier for the SD-WAN realm 110A). In response to receiving the registration request, the network facilitator 160 sends a routing controller list 180 to the edge router 130A-1. The routing controller list 180 is a list of routing controllers 120 that is filtered to include only those routing controllers 120 (i.e., routing controllers 120A-1 and 120A-2 in this example) that have a region identifier that matches the region identifier of the edge router 130A-1. In this way, the network facilitator 160 provides the necessary information for the edge router 130A-1 to peer only with the routing controllers 120 (i.e., routing controllers 120A-1 and 120A-2) in its region 110A. In some embodiments, the network facilitator 160 is a Cisco vBond orchestrator. The network facilitator 160 can be either a hardware device or software (e.g., a cloud-based router) running as a virtual machine.

[0019] In operation, the multi-region SD-WAN environment 100 provides a distributed per-region routing controller architecture that prevents a full mesh of peering / control connections between all routing controllers 120 in the SD-WAN. To do so, the multi-region SD-WAN environment 100 has unique behavior in control connections and OMP route distribution. First, each routing controller 120, edge router 130, and border router 140 in the multi-region SD-WAN environment 100 is configured with a region identifier associated with the particular region 110 to which they belong. For example, the SD-WAN region 110A may have a region identifier of "Region 1," and all devices in the SD-WAN region 110A (e.g., routing controllers 120A-1 and 120A-2, edge routers 130A-1, 130A-2, and 130A-3, and border routers 140A and 140B) are configured with the same region identifier of "Region 1." Similarly, SD-WAN region 110B may have a region identifier of "Region 2", and all devices in SD-WAN region 110B (e.g., routing controllers 120B-1 and 120B-2, edge routers 130B-1, 130B-2, and 130B-3, and border routers 140C and 140D) are configured with the same region identifier of "Region 2". When registering with network facilitator 160, each routing controller 120 presents its region identifier to network facilitator 160. Network facilitator 160 maintains a routing controller list 180 that lists all routing controllers 120 in multi-region SD-WAN environment 100 and the region identifier of each routing controller 120. In this way, network facilitator 160 knows which routing controller 120 is responsible for a given region 110.

[0020] Then, when the edge router 130 and the border router 140 register with the network facilitator 160, each device sends its assigned realm identifier in a registration request 170 to the network facilitator 160. The network facilitator 160 responds to the registration request 170 by sending a routing controller list 180 back to the requesting device. However, instead of sending a routing controller list 180 that lists all routing controllers 120 in the multi-region SD-WAN environment 100, the network facilitator 160 filters the routing controller list 180 to include only those routing controllers 120 that have a realm identifier that matches the requesting device. For example, in response to receiving a registration request 170 from the edge router 130A-1 that includes a realm identifier of "Realm 1," the network facilitator 160 responds by sending a routing controller list 180 that is filtered to include only those routing controllers 120 (i.e., routing controllers 120A-1 and 120A-2) that also have a realm identifier of "Realm 1." The receiving device (i.e., edge router 130A-1 in this example) then proceeds to establish control connections and OMP peering (i.e., OMP peering / control connection 150A) only with the routing controllers 120 (i.e., routing controllers 120A-1 and 120A-2) listed in the routing controller list 180. In this manner, the multi-region SD-WAN environment 100 prevents a full mesh of peering / control connections between all routing controllers 120 in the network across regions 110.

[0021] 2 is a flow diagram illustrating an example method 200 by an edge router in an SD-WAN. For example, method 200 may be performed by edge router 130 of multi-region SD-WAN environment 100. Method 200 may begin at step 210 where a registration request is sent to a network facilitator of the SD-WAN. The registration request includes a particular realm identifier of the SD-WAN edge router. In some embodiments, the registration request is registration request 170 and the network facilitator is network facilitator 160. In some embodiments, the registration request is a request to form a DTLS tunnel.

[0022] In step 220, method 200 receives a list of routing controllers from a network facilitator of the SD-WAN. The list of routing controllers identifies one or more routing controllers of the SD-WAN. Each routing controller in the list of routing controllers received from the network facilitator has a region identifier that matches a particular region identifier of the SD-WAN edge router received in step 210. In some embodiments, the list of routing controllers is routing controller list 180. In some embodiments, the multiple routing controllers are routing controllers 120. In some embodiments, each routing controller is a vSmart controller.

[0023] In step 230, method 200 establishes an OMP peering connection with a number of routing controllers in the list of routing controllers from the network facilitator received in step 220. In some embodiments, the OMP peering connection is OMP peering / control connection 150.

[0024] In step 240, method 200 avoids establishing an OMP peering connection with any other routing controller having a realm identifier different from the particular realm identifier of the SD-WAN edge router. For example, if the particular realm identifier of the SD-WAN edge router is "Realm 1," the SD-WAN edge router avoids establishing an OMP peering connection with a routing controller having a realm identifier of "Realm 2," "Realm 3," or any other realm identifier other than "Realm 1." After step 240, method 200 may end.

[0025] FIG. 3 is a flow diagram illustrating an example method 300 by a route controller in an SD-WAN. For example, method 300 may be performed by network facilitator 160 of multi-region SD-WAN environment 100. Method 300 may begin at step 310 where method 300 receives a realm identifier from a routing controller of the SD-WAN. For example, each routing controller may send its associated realm identifier in a request to register with the SD-WAN. In some embodiments, the registration request is registration request 170. In some embodiments, method 300 may form and maintain a list of routing controllers and their associated realm identifiers. For example, method 300 may form and maintain routing controller list 180.

[0026] In step 320, method 300 receives a registration request from an SD-WAN edge router. The registration request includes a realm identifier of the edge router. In some embodiments, the registration request is registration request 170. In some embodiments, the SD-WAN edge router is edge router 130.

[0027] In step 330, method 300 matches the realm identifier of the edge router received in step 320 with the stored realm identifiers of the routing controllers. For example, method 300 may analyze the complete list of routing controllers in the SD-WAN to identify routing controllers that have a realm identifier identical to the realm identifier of the edge router received in step 320.

[0028] In step 340, method 300 sends the list of routing controllers to the edge router. In some embodiments, the list of routing controllers is a filtered list of routing controllers that has been filtered to include only those routing controllers with a matching region identifier identified in step 330. In some embodiments, the list of routing controllers is routing controller list 180. After step 340, method 300 may end.

[0029] FIG. 4 illustrates an exemplary computer architecture for a device that can execute program components to implement the above-described functionality. The computer architecture illustrated in FIG. 4 illustrates any type of computer 400, such as a conventional server computer, workstation, desktop computer, laptop, tablet, network appliance, electronic reader, smartphone, or other computing device, that can be utilized to execute any of the software components presented herein. The computer 400, in some examples, can correspond to one or more devices described herein, such as the routing controller 120, edge router 130, border router 140, network facilitator 160, and / or any other device described herein, and can include networked devices, such as personal devices (e.g., smartphones, tables, wearable devices, laptop devices, etc.), servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, and / or any other type of computing device that can execute any type of software and / or virtualization technology. The computer 400 includes a baseboard 402 or "motherboard," which is a printed circuit board to which a number of components or devices can be connected by a system bus or other electrical communication pathway. In one exemplary configuration, one or more central processing units (“CPU”) 404 operate in conjunction with a chipset 406. CPU 404 may be a standard programmable processor that performs arithmetic and logical operations necessary for the operation of computer 400.

[0030] The CPU 404 performs operations by transitioning from one discrete physical state to the next through the manipulation of switching elements that discriminately change state. Switching elements generally include electronic circuits that maintain one of two binary states, such as flip-flops, and electronic circuits that provide an output state based on a logical combination of the states of one or more other switching elements, such as logic gates. These basic switching elements can be combined to create more complex logic circuits, including registers, adder-subtractors, arithmetic logic units, floating point units, and the like.

[0031] Chipset 406 provides an interface between CPU 404 and the remaining components and devices on baseboard 402. Chipset 406 may provide an interface to RAM 408, which is used as the main memory in computer 400. Chipset 406 may further provide an interface to a computer-readable storage medium, such as read-only memory ("ROM") 410 or non-volatile RAM ("NVRAM"), for storing basic routines that start up computer 400 and help transfer information between various components and devices. ROM 410 or NVRAM may also store other software components necessary for operation of computer 400 in accordance with the configurations described herein.

[0032] The computer 400 can operate in a networked environment using logical connections to remote computing devices and computer systems through a network, such as the Internet. The chipset 406 can include functionality for providing network connectivity through a NIC 412, such as a Gigabit Ethernet adapter. The NIC 412 can connect the computer 400 to other computing devices through a network 424. It should be appreciated that multiple NICs 412 can be present in the computer 400 to connect the computer to other types of networks and remote computer systems.

[0033] The computer 400 can be connected to a storage device 418 that provides non-volatile storage for the computer. The storage device 418 can store an operating system 420, programs 422, and data, which are described in more detail herein. The storage device 418 can be connected to the computer 400 through a storage controller 414 that is connected to the chipset 406. The storage device 418 can be comprised of one or more physical storage units. The storage controller 414 can interface with the physical storage units through a serial attached SCSI ("SAS") interface, a serial advanced technology attachment ("SATA") interface, a fiber channel ("FC") interface, or other type of interface for physically connecting and transferring data between the computer and the physical storage units.

[0034] Computer 400 may store data on storage device 418 by transforming the physical state of the physical storage units to reflect the information being stored. The particular transformation of the physical state may depend on a variety of factors in different embodiments of the present specification. Examples of such factors may include, but are not limited to, the technology used to implement the physical storage units, whether storage device 418 is characterized as primary or secondary storage, etc.

[0035] For example, computer 400 may issue instructions via storage controller 414 to store information in storage device 418 by altering the magnetic properties of a particular location in a magnetic disk drive unit, the reflective or refractive properties of a particular location in an optical storage unit, or the electrical properties of a particular capacitor, transistor, or other individual component in a solid-state storage unit. Other transformations of physical media are possible without departing from the scope and spirit of this specification, and the foregoing examples are provided only to facilitate this description. Computer 400 may further read information from storage device 418 by detecting the physical state or properties of one or more particular locations in a physical storage unit.

[0036] In addition to the mass storage device 418 described above, the computer 400 can access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. Those skilled in the art will appreciate that a computer-readable storage medium is any available medium that provides non-transitory storage of data and can be accessed by the computer 400. In some examples, operations performed by the routing controller 120, the edge router 130, the border router 140, the network facilitator 160, and / or any other device described herein may be supported by one or more devices similar to the computer 400. In other words, some or all of the operations performed by the routing controller 120, the edge router 130, the border router 140, the network facilitator 160, and / or any other device described herein may be performed by one or more computer devices 400.

[0037] By way of example and not limitation, computer readable storage media may include volatile and non-volatile, removable and non-removable media implemented in any manner or technology, including, but not limited to, RAM, ROM, erasable ROM, erasable programmable ROM ("EPROM"), electrically-erasable programmable ROM ("EEPROM"), flash memory or other solid-state memory technology, compact disc ROM ("CD-ROM"), digital versatile disk ("DVD"), high definition DVD ("HD-DVD"), BLU-RAY or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or any other medium that can be used to non-temporarily store the desired information.

[0038] As briefly mentioned above, the storage device 418 may store an operating system 420 utilized to control the operation of the computer 400. According to one embodiment, the operating system includes a LINUX operating system. According to another embodiment, the operating system includes a WINDOWS® SERVER operating system from MICROSOFT Corporation of Redmond, Wash. According to a further embodiment, the operating system may include a UNIX operating system or one of its variants. It should be understood that other operating systems may also be utilized. The storage device 418 may store other system or application programs and data utilized by the computer 400.

[0039] In one embodiment, the storage device 418 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into the computer 400, transform the computer from a general-purpose computing system to a special-purpose computer capable of implementing the embodiments described herein. These computer-executable instructions transform the computer 400 by specifying how the CPU 404 transitions between states, as described above. According to one embodiment, the computer 400 can access a computer-readable storage medium that stores computer-executable instructions that, when executed by the computer 400, perform the various processes described above with respect to Figures 2 and 3. The computer 400 can also include a computer-readable storage medium having stored thereon instructions for performing any of the other computer-implemented operations described herein.

[0040] Computer 400 may also include one or more input / output controllers 416 for receiving and processing input from a number of input devices, such as a keyboard, a mouse, a touchpad, a touch screen, an electronic stylus, or other types of input devices. Similarly, input / output controller 416 may provide output to a display, such as a computer monitor, a flat panel display, a digital projector, a printer, or other type of output device.

[0041] As described herein, computer 400 may comprise one or more of routing controller 120, edge router 130, border router 140, network facilitator 160, and / or any other device described herein. Computer 400 may include one or more hardware processors 404 (processors) configured to execute one or more stored instructions. Processor 404 may comprise one or more cores. Additionally, computer 400 may include one or more network interfaces configured to provide communications between computer 400 and other devices, such as communications described herein as being performed by routing controller 120, edge router 130, border router 140, network facilitator 160, and / or any other device described herein. Network interfaces may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), and the like. For example, network interfaces may include devices compatible with Ethernet, Wi-Fi™, and the like. Programs 422 may comprise any type of program or process for performing the techniques described in this disclosure.

[0042] As used herein, a computer-readable non-transitory storage medium may include, where appropriate, one or more semiconductor-based or other integrated circuits (ICs) (e.g., a field-programmable gate array (FPGA) or an application-specific IC (ASIC) or the like), a hard disk drive (HDD), a hybrid hard drive (HHD), an optical disk, an optical disk drive (ODD), a magneto-optical disk, a magneto-optical drive, a floppy diskette, a floppy disk drive (FDD), a magnetic tape, a solid-state drive (SSD), a RAM drive, a secure digital card or drive, any other suitable computer-readable non-transitory storage medium, or any suitable combination of two or more of these. A computer-readable non-transitory storage medium may be volatile, non-volatile, or a combination of volatile and non-volatile, where appropriate.

[0043] As used herein, "or" is inclusive and not exclusive, unless expressly indicated otherwise or the context indicates otherwise. Thus, as used herein, "A or B" means "A, B, or both," unless expressly indicated otherwise or the context indicates otherwise. Furthermore, "and" is both joint and plural, unless expressly indicated otherwise or the context indicates otherwise. Thus, as used herein, "A and B" means "A and B, together or separately," unless expressly indicated otherwise or the context indicates otherwise.

[0044] The scope of the present disclosure encompasses all changes, substitutions, variations, modifications, and alterations to the exemplary embodiments described or illustrated herein that would be understood by a person skilled in the art. The scope of the present disclosure is not limited to the exemplary embodiments described or illustrated herein. Furthermore, although the present disclosure describes and illustrates each embodiment herein as including certain components, elements, features, functions, operations, or steps, any of these embodiments may include any combination or permutation of any of the components, elements, features, functions, operations, or steps described or illustrated anywhere herein that would be understood by a person skilled in the art. Furthermore, any reference in the appended claims to an apparatus or system, or a component of an apparatus or system, that is adapted, arranged, capable, configured, enabled, operable, or operative to perform a particular function encompasses that apparatus, system, or component, regardless of whether it or that particular function is activated, turned on, or unlocked, so long as the apparatus, system, or component is so adapted, arranged, capable, configured, enabled, operative, or operative. In addition, although the present disclosure has described or illustrated particular embodiments as providing certain advantages, the particular embodiment may provide none of these advantages, or may provide some or all of these advantages.

[0045] It should be noted that the embodiments disclosed herein are merely examples, and the scope of the disclosure is not limited thereto. A particular embodiment may include all, some, or none of the components, elements, features, functions, operations, or steps of the embodiments disclosed herein. Certain embodiments are disclosed in the appended claims, which are directed, among other things, to methods, storage media, systems, and computer program products, and any feature recited in one claim category, e.g., a method, may also be claimed in another claim category, e.g., a system. Dependencies or references in the appended claims have been selected for formality reasons only. However, any subject matter resulting from an intentional reference to any preceding claim (especially multiple dependencies) may also be claimed, and therefore any combination of claims and their features may be claimed, regardless of the dependencies disclosed and selected in the appended claims. The subject matter that may be claimed includes not only combinations of features recited in the appended claims, but also any other combination of features in the claims, and each feature recited in a claim may be combined with any other feature or combination of features in the claim. Furthermore, any of the embodiments and features described or depicted in this specification may be claimed in a separate claim and / or in any combination with any of the embodiments or features described or depicted in this specification or with any of the features of the appended claims.

Claims

1. A software defined wide area network (SD-WAN), comprising: A first region, a plurality of first routing controllers configured with a first region identifier associated with the first region, each first routing controller storing a plurality of first routes for the first region; A first area including a plurality of first SD-WAN edge routers configured using the first area identifier; A second region, a plurality of second routing controllers configured with second region identifiers associated with the second regions, each second routing controller storing a plurality of second routes for the second regions; a second area including a plurality of second SD-WAN edge routers configured using the second area identifier; Each first SD-WAN edge router in the first region comprises: Establishing an Overlay Management Protocol (OMP) peering connection with the first plurality of routing controllers in the first domain; configured to avoid establishing an OMP peering connection with the second routing controllers of the second domain associated with the second domain identifier different from the first domain identifier; Each second SD-WAN edge router in the second region establishing an OMP peering connection with the plurality of second routing controllers in the second region; The SD-WAN is configured to avoid establishing an OMP peering connection with the plurality of first routing controllers of the first domain associated with the first domain identifier different from the second domain identifier.

2. A software defined wide area network (SD-WAN), comprising: A first region, a plurality of first routing controllers, each first routing controller storing a plurality of first routes for the first region; a first area including a plurality of first SD-WAN edge routers; A second region, a plurality of second routing controllers, each second routing controller storing a plurality of second routes for the second region; a second area including a plurality of second SD-WAN edge routers; A network facilitator, receiving a registration request from a particular SD-WAN edge router of the plurality of first and second SD-WAN edge routers, the registration request including a particular realm identifier of the particular SD-WAN edge router; a network facilitator configured to, in response to receiving the registration request, send a list of routing controllers to the particular SD-WAN edge router, each routing controller in the list of routing controllers having a realm identifier that matches the particular realm identifier of the particular SD-WAN edge router; Each first SD-WAN edge router in the first region comprises: Establishing an Overlay Management Protocol (OMP) peering connection with the first plurality of routing controllers in the first domain; configured to avoid establishing an OMP peering connection with the plurality of second routing controllers in the second region; Each second SD-WAN edge router in the second region establishing an OMP peering connection with the plurality of second routing controllers in the second region; The SD-WAN is configured to avoid establishing an OMP peering connection with the plurality of first routing controllers in the first region.

3. each first routing controller of the first region is prevented from storing the plurality of second routes for the second region; The SD-WAN of claim 1 or 2, wherein each second routing controller in the second region is prevented from storing the first routes for the first region.

4. The SD-WAN according to claim 1 or 2, wherein each of the first and second routing controllers is a vSmart controller.

5. Each first routing controller of the plurality of first routing controllers is configured to establish an OMP peering connection with other first routing controllers in the first region; each first routing controller of the plurality of first routing controllers is prevented from establishing an OMP peering connection with any routing controller outside the first region; Each second routing controller of the plurality of second routing controllers is configured to establish an OMP peering connection with other second routing controllers in the second region; The SD-WAN of claim 1 or 2, wherein each second routing controller of the plurality of second routing controllers is prevented from establishing an OMP peering connection with any routing controller outside the second region.

6. The SD-WAN of claim 2 , wherein the network facilitator is a vBond orchestrator.

7. The SD-WAN of claim 2 or 6, wherein the registration request is a request to form a Datagram Transport Layer Security (DTLS) tunnel.

8. a plurality of first border routers in the first area, each of the first border routers comprising: Establishing an OMP peering connection with the plurality of first routing controllers in the first region; Establishing OMP peering connections with a plurality of core routing controllers in a core region; a plurality of first border routers configured to avoid establishing an OMP peering connection with the plurality of second routing controllers in the second area; a plurality of second border routers in the second area, each second border router comprising: establishing an OMP peering connection with the plurality of second routing controllers in the second region; establishing an OMP peering connection with the plurality of core routing controllers in the core region; The SD-WAN of claim 1 or 2, further comprising: a plurality of second border routers configured to avoid establishing an OMP peering connection with the plurality of first routing controllers in the first area.

9. A core area, A plurality of core routing controllers; The SD-WAN of claim 1 or 2, further comprising a core region including a plurality of SD-WAN border routers.

10. Each SD-WAN border router: establishing an OMP peering connection with the plurality of core routing controllers in the core region; The SD-WAN of claim 9 , configured to establish OMP peering connections with routing controllers of only one of the other domains of the first or second domain.

11. 1. A method performed by a software defined wide area network (SD-WAN) edge router in a software defined wide area network (SD-WAN), comprising: sending a registration request to a network facilitator of the SD-WAN, the registration request including a specific realm identifier of the SD-WAN edge router; receiving a list of routing controllers from the network facilitator of the SD-WAN; the routing controller list identifies a plurality of routing controllers in the SD-WAN; each routing controller in the list of routing controllers received from the network facilitator has a realm identifier that matches the particular realm identifier of the SD-WAN edge router; establishing an Overlay Management Protocol (OMP) peering connection with the plurality of routing controllers in the list of routing controllers from the network facilitator; and avoiding establishing an OMP peering connection with any other routing controller having a realm identifier different from the particular realm identifier of the SD-WAN edge router.

12. The method of claim 11 , wherein each of the plurality of routing controllers is a vSmart controller.

13. The method of claim 11 or 12, wherein the network facilitator is a vBond orchestrator.

14. The method according to claim 11 or 12, wherein the registration request is a request to create a Datagram Transport Layer Security (DTLS) tunnel.

15. 1. A method performed by a software defined wide area network (SD-WAN) network facilitator in a software defined wide area network (SD-WAN), comprising: receiving a first region identifier from a plurality of first routing controllers in a first region; receiving second region identifiers from a plurality of second routing controllers in a second region; receiving a registration request from a SD-WAN edge router, the registration request including a specific realm identifier of the SD-WAN edge router; determining that the particular domain identifier of the SD-WAN edge router matches the first domain identifiers of the plurality of first routing controllers in the first domain; sending a list of routing controllers to the SD-WAN edge router, the list of routing controllers including the plurality of first routing controllers and excluding the plurality of second routing controllers.

16. The method of claim 15 , wherein each of the first and second plurality of routing controllers is a vSmart controller.

17. The method of claim 15 or 16, wherein the SD-WAN network facilitator is a vBond orchestrator.

18. 17. The method of claim 15 or 16, wherein the registration request is a request to create a Datagram Transport Layer Security (DTLS) tunnel.

19. receiving a second registration request from a SD-WAN border router, the second registration request including a specific realm identifier of the SD-WAN border router; determining that the particular area identifier of the SD-WAN border router matches the second area identifiers of the plurality of second routing controllers in the second area; 17. The method of claim 15 or 16, further comprising: sending a second list of routing controllers to the SD-WAN border router, the second list of routing controllers including the second plurality of routing controllers and excluding the first plurality of routing controllers.

20. The method of claim 15 or 16, wherein determining that the particular area identifier of the SD-WAN edge router matches the first area identifiers of the plurality of first routing controllers in the first area includes analyzing a complete list of routing controllers including all routing controllers in the SD-WAN.

21. 1. A software defined wide area network (SD-WAN) edge router in a SD-WAN, comprising: means for transmitting a registration request to a network facilitator of the SD-WAN, the registration request including a specific area identifier of the SD-WAN edge router; means for receiving a list of routing controllers from the network facilitator of the SD-WAN, the routing controller list identifies a plurality of routing controllers in the SD-WAN; a means for receiving, each routing controller in the list of routing controllers received from the network facilitator having a realm identifier that matches the particular realm identifier of the SD-WAN edge router; means for establishing an Overlay Management Protocol (OMP) peering connection with the plurality of routing controllers in the list of routing controllers from the network facilitator; and means for avoiding establishing an OMP peering connection with any other routing controller having a realm identifier different from the particular realm identifier of the SD-WAN edge router.

22. The router of claim 21 further comprising means for implementing the method of claim 12.

23. 1. A software defined wide area network (SD-WAN) network facilitator in a SD-WAN, comprising: means for receiving first region identifiers from a plurality of first routing controllers in a first region; means for receiving second region identifiers from a plurality of second routing controllers in the second region; means for receiving a registration request from a SD-WAN edge router, the registration request including a specific realm identifier of the SD-WAN edge router; means for determining that the particular domain identifier of the SD-WAN edge router matches the first domain identifiers of the plurality of first routing controllers in the first domain; and means for transmitting a list of routing controllers to the SD-WAN edge router, the list of routing controllers including the plurality of first routing controllers and excluding the plurality of second routing controllers.

24. 24. The facilitator of claim 23, further comprising means for implementing the method of claim 16.

25. 16. A computer program encoded on a tangible computer readable medium comprising instructions for implementing the method of claim 11 or 15.

Images