IP Library › Granted Patent US 12712806
Granted Patent B2
US 12712806 · App. 18/626,759 · Granted Aug 18, 2026

Resiliency and symmetric routing in networks during service chain failure

Inventors: Pritam Baruah (Fremont, CA); Satish Mahadevan (San Ramon, CA); Laxmikantha Reddy Ponnuru (San Ramon, CA); Balaji Sundararajan (Fremont, CA)
Assignee: Cisco Technology, Inc.
H04L45/28H04L45/02H04L45/76
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12712806
App. No.
18/626,759
Granted
Aug 18, 2026
Kind
B2
Abstract

Techniques for making the state of a peering connections or routes between SD-WAN routers of an SD-WAN fabric and external routers dependent on the state of a local instance of a service chain of redundant service chains in the SD-WAN fabric. In examples, an SD-WAN router may determine that a local instance of a service chain is unavailable for inspecting network traffic, and terminate a peering session with an external router such that routes through the SD-WAN router are no longer available to the external router. In other examples where the SD-WAN router determines that the local instance of the service chain is unavailable, the SD-WAN router may use an update message to notify the external router that certain routes are not available through the SD-WAN router for network traffic that needs to be service-chained.

Claims (96)

1 . A system configured to ensure symmetric routing in a software-defined wide-area network (SD-WAN) fabric during a service chain failure, the system comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

establishing a first connection between a first endpoint and a first SD-WAN router in the SD-WAN fabric, the first SD-WAN router being connected to a first service chain in the SD-WAN fabric;

establishing a peering connection between the first SD-WAN router and an external router located exterior the SD-WAN fabric, the peering connection being configured to exchange routing information between the first SD-WAN router and the external router;

sending, from the first SD-WAN router and using the peering connection, a route advertisement to the external router, the route advertisement indicating a route from a second endpoint associated with the external router and to the first endpoint that passes through the first SD-WAN router;

determining that the first service chain is unavailable; and

based at least in part on the first service chain being unavailable, terminating the peering connection between the first SD-WAN router and the external router such that the route is withdrawn.

2 . The system of claim 1 , the operations further comprising:

determining that the first SD-WAN router routes all traffic through the first service chain,

wherein the terminating the peering connection is further based at least in part on the SD-WAN router routing all the traffic through the first service chain.

3 . The system of claim 1 , the operations further comprising:

sending, from the first SD-WAN router, an instruction for a controller associated with the SD-WAN fabric to withdraw the route between the first endpoint and the second endpoint; and

sending, from the controller, a notification to an internal router of the SD-WAN fabric indicating that the route is withdrawn, the internal router configured to communicate traffic between the first endpoint and the first SD-WAN router.

4 . The system of claim 1 , the operations further comprising:

establishing a second connection between the first endpoint and a second SD-WAN router in the SD-WAN fabric, the second SD-WAN router being connected to a second service chain in the SD-WAN fabric;

sending, from the second SD-WAN router, a second route advertisement to the external router, the second route advertisement indicating a second route from the second endpoint associated with the external router and to the first endpoint that passes through the second SD-WAN router;

receiving, at the second SD-WAN router, traffic to be communicated between the first endpoint and the second endpoint; and

routing the traffic through the second service chain.

5 . The system of claim 1 , the operations further comprising:

sending, from the first SD-WAN router, probes to the first service chain, wherein the probes are configured to determine a current state of the first service chain;

applying, by the first SD-WAN router, logic to one or more of the probes to determine that the first service chain is unavailable;

updating, at the first SD-WAN router, a track object to indicate that the current state of the first service chain is unavailable, the track object being referenced by a route-map stored at the first SD-WAN router; and

based at least in part on the track object indicating that the first service chain is unavailable, withdrawing the route from the route-map.

6 . The system of claim 1 , the operations further comprising:

sending, from the first SD-WAN router, probes to the first service chain, wherein the probes are configured to determine a current state of the first service chain;

determining, by the first SD-WAN router and using one or more of the probes, that the first service chain is available;

establishing a second peering connection between the first SD-WAN router and the external router; and

sending, from the first SD-WAN router and using the second peering connection, a second route advertisement to the external router indicating a second route from the second endpoint associated with the external router and to the first endpoint that passes through the first SD-WAN router.

7 . The system of claim 1 , wherein:

the first SD-WAN router is an SD-WAN router in a site of the SD-WAN fabric;

the external router is a cloud edge router and the route advertisement is Border Gateway Protocol (BGP) advertisement; and

the second endpoint is located in a cloud environment associated with the cloud edge router.

8 . A computer-implemented method comprising:

establishing a first connection between a first endpoint and a first SD-WAN router in a software-defined wide-area network (SD-WAN) fabric, the first SD-WAN router being connected to a first service chain in the SD-WAN fabric;

establishing a peering connection between the first SD-WAN router and an external router located exterior the SD-WAN fabric, the peering connection being configured to exchange routing information between the first SD-WAN router and the external router;

sending, from the first SD-WAN router and using the peering connection, a route advertisement to the external router, the route advertisement indicating a route from a second endpoint associated with the external router and to the first endpoint that passes through the first SD-WAN router;

determining that the first service chain is unavailable; and

based at least in part on the first service chain being unavailable, terminating the peering connection between the first SD-WAN router and the external router such that the route is withdrawn.

9 . The computer-implemented method of claim 8 , further comprising:

determining that the first SD-WAN router routes all traffic through the first service chain,

wherein the terminating the peering connection is further based at least in part on the SD-WAN router routing all the traffic through the first service chain.

10 . The computer-implemented method of claim 8 , further comprising:

sending, from the first SD-WAN router, an instruction for a controller associated with the SD-WAN fabric to withdraw the route between the first endpoint and the second endpoint; and

sending, from the controller, a notification to an internal router of the SD-WAN fabric indicating that the route is withdrawn, the internal router configured to communicate traffic between the first endpoint and the first SD-WAN router.

11 . The computer-implemented method of claim 8 , further comprising:

establishing a second connection between the first endpoint and a second SD-WAN router in the SD-WAN fabric, the second SD-WAN router being connected to a second service chain in the SD-WAN fabric;

sending, from the second SD-WAN router, a second route advertisement to the external router, the second route advertisement indicating a second route from the second endpoint associated with the external router and to the first endpoint that passes through the second SD-WAN router;

receiving, at the second SD-WAN router, traffic to be communicated between the first endpoint and the second endpoint; and

routing the traffic through the second service chain.

12 . The computer-implemented method of claim 8 , further comprising:

sending, from the first SD-WAN router, probes to the first service chain, wherein the probes are configured to determine a current state of the first service chain;

applying, by the first SD-WAN router, logic to one or more of the probes to determine that the first service chain is unavailable;

updating, at the first SD-WAN router, a track object to indicate that the current state of the first service chain is unavailable, the track object being referenced by a route-map stored at the first SD-WAN router; and

based at least in part on the track object indicating that the first service chain is unavailable, withdrawing the route from the route-map.

13 . The computer-implemented method of claim 8 , further comprising:

sending, from the first SD-WAN router, probes to the first service chain, wherein the probes are configured to determine a current state of the first service chain;

determining, by the first SD-WAN router and using one or more of the probes, that the first service chain is available;

establishing a second peering connection between the first SD-WAN router and the external router; and

sending, from the first SD-WAN router and using the second peering connection, a second route advertisement to the external router indicating a second route from the second endpoint associated with the external router and to the first endpoint that passes through the first SD-WAN router.

14 . The computer-implemented method of claim 8 , wherein:

the first SD-WAN router is an SD-WAN router in a site of the SD-WAN fabric;

the external router is a cloud edge router and the route advertisement is Border Gateway Protocol (BGP) advertisement; and

the second endpoint is located in a cloud environment associated with the cloud edge router.

15 . One or more computing devices configured to ensure symmetric routing in a software-defined wide-area network (SD-WAN) fabric during a service chain failure, the one or more computing devices comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

establishing a first route between a first endpoint and a second endpoint that passes through a first SD-WAN router in the SD-WAN fabric, the first SD-WAN router being connected to a first service chain in the SD-WAN fabric;

establishing a second route between the first endpoint and a third endpoint that passes through the first SD-WAN router in the SD-WAN fabric;

determining that the first SD-WAN router is configured to route first traffic communicated with the second endpoint through the first service chain;

determining that the first SD-WAN router is not configured to route second traffic communicated with the third endpoint through the first service chain;

determining that the first service chain is unavailable; and

based at least in part on the first service chain being unavailable and the first SD-WAN router being configured to route the first traffic communicated with the second endpoint through the first service chain:

withdrawing the first route from a route-map of the first SD-WAN router; and

sending, to an external router associated with the second endpoint, an update message indicating that first route is withdrawn.

16 . The one or more computing devices of claim 15 , the operations further comprising:

sending, from the first SD-WAN router, an instruction for a controller associated with the SD-WAN fabric to withdraw the first route between the first endpoint and the second endpoint; and

sending, from the controller, a notification to an internal router of the SD-WAN fabric indicating that the route is withdrawn, the internal router configured to communicate traffic between the first endpoint and the first SD-WAN router.

17 . The one or more computing devices of claim 15 , the operations further comprising:

sending, from the first SD-WAN router, probes to the first service chain, wherein the probes are configured to determine a current state of the first service chain;

applying, by the first SD-WAN router, logic to one or more of the probes to determine that the first service chain is unavailable; and

updating, at the first SD-WAN router, a track object to indicate that the current state of the first service chain is unavailable, the track object being referenced by a route-map stored at the first SD-WAN router,

wherein the withdrawing the route from the route-map is based at least in part on the track object indicating that the first service chain is unavailable.

18 . The one or more computing devices of claim 15 , the operations further comprising:

sending, from the first SD-WAN router, probes to the first service chain, wherein the probes are configured to determine a current state of the first service chain;

determining, by the first SD-WAN router and using one or more of the probes, that the first service chain is available;

adding a third route to a route-map of the first SD-WAN router, the third route being between the first endpoint and the second endpoint that passes through the first SD-WAN router; and

sending, to the external router, an advertisement message indicating that third route is available.

19 . The one or more computing devices of claim 15 , the operations further comprising:

establishing a third route between the first endpoint and the second endpoint that passes through a second SD-WAN router in the SD-WAN fabric, the second SD-WAN router being connected to a second service chain in the SD-WAN fabric;

prior to the first service chain being unavailable, sending a first discriminator to the external router indicating that the first route is a preferred route for the second endpoint; and

subsequent to the first service chain being unavailable, sending a second discriminator to the external router indicating that the second route is a preferred route for the second endpoint to reach the first endpoint.

20 . The one or more computing devices of claim 15 , wherein:

the first SD-WAN router is an SD-WAN router in a site of the SD-WAN fabric;

the external router is a cloud edge router and the update message is Border Gateway Protocol (BGP) message; and

the second endpoint is located in a cloud environment associated with the cloud edge router.