US 11,991,152 B2
Bypassing IKE firewall for cloud-managed IPSec keys in SDWAN fabric
Shreekanth Chandranna, Santa Clara, CA (US); Bhagvan Cheeyandira, Santa Clara, CA (US); and Gopalakrishnan Gunasekaran, Santa Clara, CA (US)
Assigned to Hewlett Packard Enterprise Development LP, Spring, TX (US)
Filed by HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, Houston, TX (US)
Filed on Feb. 9, 2022, as Appl. No. 17/667,987.
Prior Publication US 2023/0254289 A1, Aug. 10, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/029 (2013.01) [H04L 63/0236 (2013.01); H04L 63/0272 (2013.01); H04L 63/0435 (2013.01); H04L 63/061 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method comprising:
detecting, at a first network device between a second network device and a third network device, an Internet Key Exchange protocol (IKE) key negotiation between the second network device and the third network device;
based on detecting the IKE key negotiation between the second network device and the third network device, creating a firewall session in the first network device between the second and third network devices, wherein a first Internet Protocol Security (IPSec) tunnel is established through the first network device between the second and third network devices using the IKE key negotiation, the first tunnel being compliant with the firewall session and allowing passage of IPSec data packets through the first network device between the second and third network devices;
passing, through the first network device based on the establishment of the first tunnel, the IPSec data packets exchanged between the second and third network devices using cloud-managed IPSec keys from a cloud-based orchestrator, wherein the IPSec data packets are exchanged as part of a hand-shake operation that results in an establishment of a second tunnel between the second and third network devices according to the cloud-managed IPSec keys, wherein the second tunnel is an overlay tunnel on an underlay network; and
after the establishment of the second tunnel and the cloud-managed IPSec keys are active, discarding the negotiated IKE and taking down the first IPSec tunnel gracefully without disrupting encrypted communications between the second and third network devices.