IPSEC sequence synchronization and recovery in software-defined wide area network(s)
AssigneeCisco Technology, Inc.
InventorsQingguo Zhang, Shuang Han, Bo Gao, Changhong Shen
Life of this patent
Estimating the term…
Abstract
This disclosure describes techniques and mechanisms for providing an automatic and lightweight solution to detect and resolve session stuck failure(s) due to erroneous anti-replay packet drops in SDWAN networks. The techniques may operate in a data plane of the network devices, such as part of an anti-replay feature. The techniques may enable a sending and receiving edge device to communicate via secure tunnels. The receiving edge device may detect an out-of-window error and may generate and send, within the data plane, a message that includes a set control bit to trigger the sending edge device to perform a synchronization and recovery process.
Claims16
A method of sequence synchronization and recovery within a software-defined wide area network (SDWAN), comprising:
- receiving, from a first edge device and at a second edge device within the SDWAN, first data packets comprising sequence numbers;
- determining, by the second edge device, that an out of sync error has occurred at the second edge device, wherein determining that the out of sync error has occurred comprises:
- determining, by the second edge device that a stored sequence number does not match the sequence numbers in the first data packets, the sequence number being outside of a configured sequence window;
- dropping one or more of the first data packets;
- incrementing a drop counter stored by the second edge device;
- and
- determining that a drop rate or the drop counter is above a threshold value;
- generating, by the second edge device, a first message comprising an expected sequence number;
- sending the first message to the first edge device, the first message causing the first edge device to perform a recovery process;
- receiving, from the first edge device and based at least in part on the recovery process, one of a second message or second data packets comprising a new sequence number;
- and
- updating, by the second edge device, a stored sequence number value based on the new sequence number.
A system comprising:
- one or more hardware processors;
- and
- one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving, from a first edge device and at a second edge device within a SDWAN, first data packets comprising sequence numbers;
- determining, by the second edge device, that an out of sync error has occurred at the second edge device;
- generating, by the second edge device, a first message comprising an expected sequence number, wherein generating the first message further comprises setting a control bit within a header of the first message, the control bit causing the first edge device to perform a recovery process;
- sending the first message to the first edge device, the first message causing the first edge device to perform the recovery process, wherein the first message comprises an internet protocol security (IPSec) packet and is sent via an IPSec tunnel, the header comprising an encapsulated security payload (ESP) header, and the expected sequence number being included as part of a payload of the first message;
- receiving, from the first edge device and based at least in part on the recovery process, one of a second message or second data packets comprising the expected sequence number;
- and
- updating, by the second edge device, a stored sequence number value based on the expected sequence number.
A method for performing sequence synchronization and recovery within a data plane of a software-defined wide area network (SDWAN), comprising:
- sending, from a first edge device and to a second edge device within the SDWAN, first data packets comprising sequence numbers;
- receiving, by the first edge device and from the second edge device, a first message comprising an expected sequence number, the first message including a set control bit;
- updating, by the first edge device and in response to the first message, a stored sequence number based on the expected sequence number;
- and
- in response to updating the stored sequence number, sending, to the second edge device, at least one of a second message or second data packets comprising the updated sequence number,
- wherein the first edge device sends the second data packets, the second data packets comprising encapsulated security payload (ESP) traffic.
Dependencies are inferred from the claim text.