Methods and systems for application and policy based network traffic isolation and data transfer
AssigneePalo Alto Networks, Inc.
InventorsKumar Ramachandran, Venkataraman Anand, Navneet Yadav, Arivu Mani Ramasamy, Aaron Edwards
Life of this patent
Estimating the term…
Abstract
Various techniques for dynamic path selection and data flow forwarding are disclosed. For example, various systems, processes, and computer program products for dynamic path selection and data flow forwarding are disclosed for providing dynamic path selection and data flow forwarding that can facilitate preserving/enforcing symmetry in data flows as disclosed with respect to various embodiments.
Claims17
A system, comprising:
- a processor of a networked branch device configured to:
- detect a data flow of a selected application from an associated originating interface on a network;
- determine a first link over which to forward the data flow, wherein the first link includes a first device;
- transmit the data flow over the determined first link;
- receive a return data flow;
- move a forward direction of the return data flow to a new path in the event that the return data flow arrived via a second link that is different from the first link, wherein the second link includes a second device and omits the first device, wherein all packets following an initial packet of the data flow are forwarded and returned on the same new path via the second link as the initial packet;
- and
- store, in a flow table, the first link at a Layer 4 (L4) level;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- detecting, by a networked branch device, a data flow of a selected application from an associated originating interface on a network;
- determining, by a networked branch device, a first link over which to forward the data flow, wherein the first link includes a first device;
- transmitting, by a networked branch device, the data flow over the determined first link;
- receiving, by a networked branch device, a return data flow;
- moving, by a networked branch device, a forward direction of the return data flow to a new path in the event that the return data flow arrived via a second link that is different from the first link, wherein the second link includes a second device and omits the first device, wherein all packets following an initial packet of the data flow are forwarded and returned on the same new path via the second link as the initial packet;
- and
- storing, in a flow table, the first link at a Layer 4 (L4) level.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- detecting, by a networked branch device, a data flow of a selected application from an associated originating interface on a network;
- determining, by a networked branch device, a first link over which to forward the data flow, wherein the first link includes a first device;
- transmitting, by a networked branch device, the data flow over the determined first link;
- receiving, by a networked branch device, a return data flow;
- moving, by a networked branch device, a forward direction of the return data flow to a new path in the event that the return data flow arrived via a second link that is different from the first link, wherein the second link includes a second device and omits the first device, wherein all packets following an initial packet of the data flow are forwarded and returned on the same new path via the second link as the initial packet;
- and
- storing, in a flow table, the first link at a Layer 4 (L4) level.
Dependencies are inferred from the claim text.