# US 12,192,179 B2 · Dynamic firewall discovery on a service plane in a SDWAN architecture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,179 B2 - Document ID: US12192179B2 - Status: Granted - Kind: B2 - Application number: 17/817,479 - Filed: 2022-08-04 - Published: 2022-11-24 - Granted: 2025-01-07 - Earliest claimed: 2020-02-26 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology Inc. - Inventors: Balaji Sundararajan; Venkatesh Gota B R; Sireesha Yeruva; Chandramouli Balasubramanian; Anand Oswal - Web page: https://patentgrep.com/patent/US12192179B2 ## CPC - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 1/18: Automatic repetition systems, e.g. Van Duuren systems - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 45/54: {Organization of routing tables} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0272: {Virtual private networks} - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure is directed to systems and methods for dynamic firewall discovery on a service plane. The method includes the steps of identifying a source data packet for transmission from a source machine at a source site to a destination machine at a destination site, wherein the source data packet corresponds to a request for connection between the source machine and the destination machine over a WAN, inspecting the source data packet at a first firewall associated with the source site, marking the source data packet with a marker to indicate inspection by the first firewall, transmitting the marked source data packet to the destination site, determining at the destination site that the source data packet has been inspected based on the marker, and forwarding the source data packet to the destination machine at the destination site, without inspection of the source data packet by a second firewall associated with the destination site. ## Claims ### Claim 1 A router, comprising: one or more processors; and one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the router to perform operations comprising: generating a flow table entry for a data packet, wherein the flow table entry indicates that the data packet is a synchronize (SYN) packet and that corresponding return traffic will be received from a destination site; communicating the data packet to a firewall for a first inspection; receiving the data packet from the firewall; marking the data packet with a marker, wherein the marker indicates the first inspection by the firewall; transmitting the data packet with the marker to the destination site, wherein the destination site caches the flow table entry based on an existence of the marker; receiving an acknowledgement data packet from the destination site; using the flow table entry to verify that the acknowledgement data packet is associated with the data packet; determining that the acknowledgement data packet does not comprise a redirect flag located in an options field of a header of the data packet; and communicating the acknowledgement data packet to the firewall for an acknowledgement data packet inspection. ### Claim 2 (depends on 1) The router of claim 1, the operations further comprising: receiving a second acknowledgement data packet from the destination site; determining that the second acknowledgment data packet is not associated with a second data packet received by the firewall; and dropping the second acknowledgement data packet. ### Claim 3 (depends on 1) The router of claim 1, wherein the acknowledgement data packet is a synchronize/acknowledge (SYN/ACK) packet. ### Claim 4 (depends on 1) The router of claim 1, the operations further comprising: prior to generating the flow table entry for the data packet, determining that the data packet has not previously been seen by the router. ### Claim 5 (depends on 1) The router of claim 1, wherein: the marker is based on a field in a Transmission Control Protocol (TCP) header of the data packet. ### Claim 6 (depends on 1) The router of claim 1, wherein the router marks the data packet with the marker prior to communicating the data packet to the firewall for the first inspection. ### Claim 7 A method, comprising: generating a flow table entry for a data packet, wherein the flow table entry indicates that the data packet is a synchronize (SYN) packet and that corresponding return traffic will be received from a destination site; communicating, by a router, the data packet to a firewall for a first inspection; receiving, by the router, the data packet from the firewall; marking, by the router, the data packet with a marker, wherein the marker indicates the first inspection by the firewall; transmitting, by the router, the data packet with the marker to the destination site, wherein the destination site caches the flow table entry based on an existence of the marker; receiving, by the router, an acknowledgement data packet from the destination site; using, by the router, the flow table entry to verify that the acknowledgement data packet is associated with the data packet; determining, by the router, that the acknowledgement data packet does not comprise a redirect flag located in an options field of a header of the data packet; and communicating, by the router, the acknowledgement data packet to the firewall for an acknowledgement data packet inspection. ### Claim 8 (depends on 7) The method of claim 7, further comprising: receiving, by the router, a second acknowledgement data packet from the destination site; determining, by the router, that the second acknowledgment data packet is not associated with a second data packet received by the firewall; and dropping, by the router, the second acknowledgement data packet. ### Claim 9 (depends on 7) The method of claim 7, wherein the acknowledgement data packet is a synchronize/acknowledge (SYN/ACK) packet. ### Claim 10 (depends on 7) The method of claim 7, further comprising: prior to generating the flow table entry for the data packet, determining that the data packet has not previously been seen by the router. ### Claim 11 (depends on 7) The method of claim 7, wherein: the marker is based on a field in a Transmission Control Protocol (TCP) header of the data packet. ### Claim 12 (depends on 7) The method of claim 7, wherein the router marks the data packet with the marker prior to communicating the data packet to the firewall for the first inspection. ### Claim 13 One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause performance of operations comprising: generating a flow table entry for a data packet, wherein the flow table entry indicates that the data packet is a synchronize (SYN) packet and that corresponding return traffic will be received from a destination site; communicating, by a router, the data packet to a firewall for a first inspection; receiving, by the router, the data packet from the firewall; marking, by the router, the data packet with a marker, wherein the marker indicates the first inspection by the firewall; transmitting, by the router, the data packet with the marker to the destination site, wherein the destination site caches the flow table entry based on an existence of the marker; receiving an acknowledgement data packet from the destination site; using the flow table entry to verify that the acknowledgement data packet is associated with the data packet; determining that the acknowledgement data packet does not comprise a redirect flag located in an options field of a header of the data packet; and communicating the acknowledgement data packet to the firewall for an acknowledgement data packet inspection. ### Claim 14 (depends on 13) The one or more computer-readable non-transitory storage media of claim 13, the operations further comprising: receiving a second acknowledgement data packet from the destination site; determining that the second acknowledgment data packet is not associated with a second data packet received by the firewall; and dropping the second acknowledgement data packet. ### Claim 15 (depends on 13) The one or more computer-readable non-transitory storage media of claim 13, wherein: the acknowledgement data packet is a synchronize/acknowledge (SYN/ACK) packet. ### Claim 16 (depends on 13) The one or more computer-readable non-transitory storage media of claim 13, the operations further comprising: prior to generating the flow table entry for the data packet, determining that the data packet has not previously been seen by the router. ### Claim 17 (depends on 13) The one or more computer-readable non-transitory storage media of claim 13, wherein: the marker is based on a field in a Transmission Control Protocol (TCP) header of the data packet.