Dynamic firewall discovery on a service plane in a SDWAN architecture

A method, comprising:

• generating a flow table entry for a data packet, wherein the flow table entry indicates that the data packet is a synchronize (SYN) packet and that corresponding return traffic will be received from a destination site;
• communicating, by a router, the data packet to a firewall for a first inspection;
• receiving, by the router, the data packet from the firewall;
• marking, by the router, the data packet with a marker, wherein the marker indicates the first inspection by the firewall;
• transmitting, by the router, the data packet with the marker to the destination site, wherein the destination site caches the flow table entry based on an existence of the marker;
• receiving, by the router, an acknowledgement data packet from the destination site;
• using, by the router, the flow table entry to verify that the acknowledgement data packet is associated with the data packet;
• determining, by the router, that the acknowledgement data packet does not comprise a redirect flag located in an options field of a header of the data packet;
• and
• communicating, by the router, the acknowledgement data packet to the firewall for an acknowledgement data packet inspection.

One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause performance of operations comprising:

• generating a flow table entry for a data packet, wherein the flow table entry indicates that the data packet is a synchronize (SYN) packet and that corresponding return traffic will be received from a destination site;
• communicating, by a router, the data packet to a firewall for a first inspection;
• receiving, by the router, the data packet from the firewall;
• marking, by the router, the data packet with a marker, wherein the marker indicates the first inspection by the firewall;
• transmitting, by the router, the data packet with the marker to the destination site, wherein the destination site caches the flow table entry based on an existence of the marker;
• receiving an acknowledgement data packet from the destination site;
• using the flow table entry to verify that the acknowledgement data packet is associated with the data packet;
• determining that the acknowledgement data packet does not comprise a redirect flag located in an options field of a header of the data packet;
• and
• communicating the acknowledgement data packet to the firewall for an acknowledgement data packet inspection.