# US 11,444,872 B2 · Method and system of application-aware routing with crowdsourcing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,872 B2 - Document ID: US11444872B2 - Status: Granted - Kind: B2 - Application number: 16/699,719 - Filed: 2019-12-01 - Published: 2020-04-02 - Granted: 2022-09-13 - Earliest claimed: 2015-04-13 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Ajit Ramachandra Mayya; Parag Pritam Thakore; Stephen Craig Connors; Sunil Mukundan; Thomas Harold Speeter - Web page: https://patentgrep.com/patent/US11444872B2 ## CPC - G06N 20/00: Machine learning - H04L 45/306: {Route determination based on the nature of the carried application} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 45/38: {Flow based routing} - H04L 45/42: Centralised routing - H04L 45/745: Address table lookup; Address filtering - H04L 49/35: Switches specially adapted for specific applications - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one aspect, a computerized method of an application routing service includes the step of using a deep-packet inspection (DPI) technique on a first network flow to identify an application. The method includes the step of storing an Internet-protocol (IP) address and a port number used by the application and an identity of the application in a database. The method includes the step of detecting a second network flow. The method includes the step of identifying the IP address and the port number of the application in the second network flow. The method includes the step of looking up the IP address and the port number in the database. The method includes the step of identifying the application based on the IP address and the port number. ## Claims ### Claim 1 A method for implementing a virtual private network (VPN) for an enterprise, the method comprising: deploying a gateway in at least one public cloud to connect a plurality of premises of an enterprise; at each of at least two premises of the enterprise, deploying an edge device that automatically connects to the gateway to establish the VPN for the enterprise; from each deployed edge device, providing to the gateway a set of local subnets of the edge device that is reachable over the VPN; and from the gateway, distributing to each particular deployed edge device each set of local subnets provided by each other deployed edge device for the particular deployed edge device to use to forward packets to each other deployed edge device. ### Claim 2 (depends on 1) The method of claim 1 further comprising before the VPN is established between the gateway and each deployed edge device, negotiating a secure connection link between the gateway and each deployed edge device in preparation for transmission of secure traffic between the gateway and edge device once the VPN is established. ### Claim 3 (depends on 2) The method of claim 2 further comprising establishing a VPN between the gateway and a particular edge device after the particular edge device receives a message from an orchestrator that the VPN should be established. ### Claim 4 (depends on 2) The method of claim 2 further comprising at each edge device, establishing an unsecure tunnel with the gateway before negotiating the secure connection link between the edge device and the gateway, said establishing comprising sending, as part of a handshake message exchange, information needed to identify the edge device and a logical identifier for the enterprise. ### Claim 5 (depends on 4) The method of claim 4, wherein as part of the handshake message exchange between the gateway and the edge device, the edge device provides to the gateway the set of local subnets of the edge device. ### Claim 6 (depends on 4) The method of claim 4, wherein the edge device automatically contacts the gateway and provides data as part of the handshake message exchange because each individual gateway is a self-contained autonomous entity that can be configured through the edge devices rather than being configured by an external orchestrator. ### Claim 7 (depends on 4) The method of claim 4 further comprising creating, at the gateway, a new virtual routing and forwarding (VRF) table for the enterprise after being contacted by an initial edge device of the entity. ### Claim 8 (depends on 7) The method of claim 7 further comprising inserting, at the gateway, each edge devices set of reachable local subnets in the VRF table of the edge device's enterprise. ### Claim 9 (depends on 1) The method of claim 1, wherein providing the set of local subnets comprises: receiving, at each deployed particular edge device, a message from an orchestrator that the VPN has been enabled; after receiving the message, sending the gateway a message to indicate that the set of local subnets of the particular edge device are reachable over the VPN. ### Claim 10 (depends on 2) The method of claim 2, wherein providing the set of local subnets further comprises in preparation for establishing the VPN, providing the set of local subnets before receiving the message from the orchestrator that the VPN has been enabled. ### Claim 11 (depends on 1) The method of claim 1 further comprising implementing a routing protocol between each edge device and the gateway. ### Claim 12 (depends on 11) The method of claim 11, wherein the routing protocol relays state information of each particular edge device that connects to the gateway to each other edge device that connects to the gateway and thus is one hop away. ### Claim 13 (depends on 12) The method of claim 12 further comprising: defining a virtual routing and forwarding (VRF) table for the enterprise; and identifying in the VRF table each edge device that is one hop away from a particular edge device. ### Claim 14 (depends on 12) The method of claim 12, wherein the state information includes the local subnets reachable over the VPN. ### Claim 15 A non-transitory machine readable medium storing a program implementing a virtual private network (VPN) for an enterprise, the program for execution by at least one processing unit, the program comprising sets of instructions for: configuring a gateway in at least one public cloud to connect a plurality of premises of an enterprise; configuring, at each of at least two premises of the enterprise, an edge device that automatically connects to the gateway to establish the VPN for the enterprise; configuring each deployed edge device to provide to the gateway a set of local subnets of the edge device that is reachable over the VPN; and configuring the gateway to distribute to each particular deployed edge device each set of local subnets provided by each other deployed edge device for the particular deployed edge device to use to forward packets to each other deployed edge device. ### Claim 16 (depends on 15) The non-transitory machine readable medium of claim 15, wherein the program further comprises a set of instructions for configuring each deployed edge device to negotiate a secure connection link with the gateway before the VPN is established between the gateway and the edge device, in order to establish transmission of secure traffic between the gateway and edge device. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the program further comprising sets of instructions for configuring each edge device to establish an unsecure tunnel with the gateway before negotiating the secure connection link between the edge device and the gateway, by sending, as part of a handshake message exchange, information needed to identify the edge device and a logical identifier for the enterprise. ### Claim 18 (depends on 17) The non-transitory machine readable medium of claim 17, wherein as part of the handshake message exchange between the gateway and the edge device, the edge device provides to the gateway the set of local subnets of the edge device. ### Claim 19 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the edge device automatically contacts the gateway and provides data as part of the handshake message exchange because each individual gateway is a self-contained autonomous entity that can be configured through the edge devices rather than being configured by an external orchestrator. ### Claim 20 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the program further comprises a set of instructions for creating, at the gateway, a new virtual routing and forwarding (VRF) table for the enterprise after being contacted by an initial edge device of the entity. ### Claim 21 (depends on 20) The non-transitory machine readable medium of claim 20, wherein the program further comprises a set of instructions for configuring the gateway to insert each edge devices set of reachable local subnets in the VRF table of the edge device's enterprise. ### Claim 22 (depends on 15) The non-transitory machine readable medium of claim 15, wherein each deployed particular edge device receives a message from an orchestrator that the VPN has been enabled, and after receiving the message, sends the gateway a message to indicate that the set of local subnets of the particular edge device are reachable over the VPN.