US 12,192,179 B2
Dynamic firewall discovery on a service plane in a SDWAN architecture
Balaji Sundararajan, Fremont, CA (US); Venkatesh Gota B R, Bangalore (IN); Sireesha Yeruva, Fremont, CA (US); Chandramouli Balasubramanian, Mountain View, CA (US); and Anand Oswal, Pleasanton, CA (US)
Assigned to CISCO TECHNOLOGY, INC., San Jose, CA (US)
Filed by Cisco Technology Inc., San Jose, CA (US)
Filed on Aug. 4, 2022, as Appl. No. 17/817,479.
Application 17/817,479 is a continuation of application No. 16/801,430, filed on Feb. 26, 2020, granted, now 11,418,491.
Prior Publication US 2022/0377053 A1, Nov. 24, 2022
Int. Cl. H04L 9/40 (2022.01); H04L 1/18 (2023.01); H04L 45/00 (2022.01); H04L 69/22 (2022.01)
CPC H04L 63/029 (2013.01) [H04L 1/18 (2013.01); H04L 45/54 (2013.01); H04L 63/0227 (2013.01); H04L 69/22 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A router, comprising:
one or more processors; and
one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the router to perform operations comprising:
generating a flow table entry for a data packet, wherein the flow table entry indicates that the data packet is a synchronize (SYN) packet and that corresponding return traffic will be received from a destination site;
communicating the data packet to a firewall for a first inspection;
receiving the data packet from the firewall;
marking the data packet with a marker, wherein the marker indicates the first inspection by the firewall;
transmitting the data packet with the marker to the destination site, wherein the destination site caches the flow table entry based on an existence of the marker;
receiving an acknowledgement data packet from the destination site;
using the flow table entry to verify that the acknowledgement data packet is associated with the data packet;
determining that the acknowledgement data packet does not comprise a redirect flag located in an options field of a header of the data packet; and
communicating the acknowledgement data packet to the firewall for an acknowledgement data packet inspection.