Abstract:
A firewall is described that is integrated in an input stage of a packet processing pipeline so that it recognizes and has access to internal information regarding the different services, such as conduit, intranet, Internet, local vs WAN, applications, and security zones, of a communication network, such as an adaptive private network (APN). The integrated firewall is able to dynamically access the service type, respond to the service type, and adjust the service type based on conditions in the network. Since application awareness and security functions are integrated, customers can set security policies on software applications. The integrated firewall also provides automatic detection of applications, classifies applications based on domain names, steers traffic to services according to software applications, reports on software applications in passthrough traffic, and provides analysis of traffic that does not match a software application so that a user can investigate and define custom applications.
Abstract:
Systems and techniques, including special messages and state machines, are described that configures an intermediate site to dynamically trigger creation of and removal of a dynamic conduit between two sites based on usage that is tracked at the sites. The intermediate site providing WAN-to-WAN forwarding between the two sites, monitors throughput statistics on each local WAN link (LWL) associated with the two sites. If traffic between the two sites passes a configured first threshold or if LWL usage passes a configured second threshold, the intermediate site sends a message to the two sites to set up a dynamic conduit directly coupling the two sites. Busy lists are used to keep track of eligible site pairs. Once a dynamic conduit is set up between two sites, a grow technique tests the dynamic conduit increasing communication flows between the two sites each configured sampling period before putting the conduit in normal use.
Abstract:
System and techniques are described for time correlated playback of traffic patters between nodes in a network. Node statistics of data transfers between nodes are received in a control point, wherein the node statistics include a time stamp (tn) according to time at the control point of when a request statistics message was sent to each node, a node timestamp (ta) according to time at each node of when the message was received in the node, and a first delta between tn and ta that is used to determine a second delta which adjusts the node statistics. The node statistics adjusted according to the second delta are stored in a statistics database at the control point. A time stepping mechanism is used to repeatedly access the node statistics from the statistics database at a predetermined rate for playback presentation beginning from a specified start time to a specified end time.
Abstract:
Techniques are described which apply a method for including a routing stack to provide a timely way to dynamically learn about route changes for an end to end system in the context of an adaptive private network (APN). By allowing learned routes to be assigned different services based on filtering rules, the APN can efficiently manage traffic through the WAN. Techniques for learning routes and to advertise the learned routes in different networks are also described. Upon an APN route change being detected in the APN, a route table is updated with the APN route change, wherein the route table contains routes in a local area network (LAN) and routes in a wide area network (WAN). The APN route change is selected from the route table and configured to a protocol for the LAN. The selected APN route change is advertised in the protocol to local routers in the LAN.
Abstract:
A firewall is described that is integrated in an input stage of a packet processing pipeline so that it recognizes and has access to internal information regarding the different services, such as conduit, intranet, Internet, local vs WAN, applications, and security zones, of a communication network, such as an adaptive private network (APN). The integrated firewall is able to dynamically access the service type, respond to the service type, and adjust the service type based on conditions in the network. Since application awareness and security functions are integrated, customers can set security policies on software applications. The integrated firewall also provides automatic detection of applications, classifies applications based on domain names, steers traffic to services according to software applications, reports on software applications in passthrough traffic, and provides analysis of traffic that does not match a software application so that a user can investigate and define custom applications.
Abstract:
System and techniques are described for time correlated playback of traffic patterns between nodes in a network. Node statistics of data transfers between nodes are received in a control point, wherein the node statistics include a time stamp (tn) according to time at the control point of when a request statistics message was sent to each node, a node timestamp (ta) according to time at each node of when the message was received in the node, and a first delta between tn and ta that is used to determine a second delta which adjusts the node statistics. The node statistics adjusted according to the second delta are stored in a statistics database at the control point. A time stepping mechanism is used to repeatedly access the node statistics from the statistics database at a predetermined rate for playback presentation beginning from a specified start time to a specified end time.
Abstract:
Techniques are described which apply a method for including a routing stack to provide a timely way to dynamically learn about route changes for an end to end system in the context of an adaptive private network (APN). By allowing learned routes to be assigned different services based on filtering rules, the APN can efficiently manage traffic through the WAN. Techniques for learning routes and to advertise the learned routes in different networks are also described. Upon an APN route change being detected in the APN, a route table is updated with the APN route change, wherein the route table contains routes in a local area network (LAN) and routes in a wide area network (WAN). The APN route change is selected from the route table and configured to a protocol for the LAN. The selected APN route change is advertised in the protocol to local routers in the LAN.
Abstract:
System and techniques are described which apply a method for automatic database schema migration. An initial database is installed, according to rules that define tables of data, in an adaptive private network (APN) having a centralized management system including a network control node (NCN) coupled through the APN to a plurality of client nodes, wherein the NCN provides timing and control to the client nodes. An update to the initial database is received, wherein the initial database includes a first table of data stored in a first set of columns and the updated database includes a modified first table having a second set of columns that has a different number of columns as compared to the first table is automatically detected. One or more columns from the second set of columns that are different than the first set of columns are updated for data content.
Abstract:
Systems and techniques are described for a path maximum transmission unit (MTU) discovery method that allows the sender of IP packets to discover the MTU of packets that it is sending over a conduit to a given destination. The MTU is the largest packet that can be sent through the network along a path without requiring fragmentation. The path MTU discovery method actively probes each sending path of each conduit with fragmentation enabled to determine a current MTU and accordingly increase or decrease the conduit MTU. The path MTU discovery process is resilient to errors and supports retransmission if packets are lost in the discovery process. The path MTU discovery process is dynamically adjusted at a periodic rate to adjust to varying network conditions.
Abstract:
Techniques are described to automatically activate and deactivate standby backup paths in response to changing bandwidth requirements in an adaptive private network (APN). The APN includes one or more regular active wide area network (WAN) links in an active mode and an on-demand WAN link in a standby mode. The on-demand WAN link is activated to supplement the conduit bandwidth when an available bandwidth of the conduit falls below a pre-specified trigger bandwidth threshold and the conduit bandwidth usage exceeds a usage threshold of a bandwidth of the conduit that is being supplied by the active paths (BWc). The on-demand WAN link is deactivated to standby mode when an available bandwidth of the conduit is above the pre-specified trigger bandwidth threshold and the conduit bandwidth usage drops below the usage threshold of BWc techniques for adaptive and active bandwidth testing of WAN links in an APN are also described.