Granted Patent B2

US 12,375,403 · App. 18/102,689 · Granted Jul 29, 2025

Inventors: Alex Markuze (Rosh HaAyin, IL); Chen Dar (Magshimim, IL); Aran Bergman (Givatayim, IL); Igor Golikov (Kfar Saba, IL); Israel Cidon (San Francisco, CA); Eyal Zohar (Shimshit, IL)

Assignee: VMware LLC

H04L45/74H04L45/20H04L45/38H04L45/42

Abstract

Claims (39)

1. A method of forwarding packets through a software-defined wide area network (SD-WAN), the method comprising:

at an ingress forwarding node of the SD-WAN:

terminating a TCP (Transport Connection Protocol) connection for a flow from a first site connected to the SD-WAN to a second site connected to the SD-WAN;

identifying a set of forwarding nodes in the SD-WAN that the flow should take to reach the second site, the flow being forwarded through the SD-WAN without encapsulating the packets in tunnel headers;

starting a new TCP connection with a next SD-WAN forwarding node in the identified set, and sending data regarding the identified set of forwarding nodes to the next SD-WAN forwarding node;

sending the flow to the next forwarding node in the SD-WAN;

wherein the terminating and starting are part of a TCP split operation performed by the ingress forwarding node, wherein a first packet of the flow comprises a prepended header identifying a series of forwarding nodes in the SD-WAN, wherein a second packet subsequent to the first packet is sent without the prepended header; and

wherein sending the data regarding the identified set of forwarding nodes comprises sending the data before or with the first packet and not sending any additional SD-WAN header (SDH) values before or with any subsequent packets of the flow.

2. The method of claim 1 , wherein sending data regarding the identified set of forwarding nodes comprises sending, to the next forwarding node, one or more identifiers for one or more forwarding nodes in the identified set that are after the next forwarding node.

3. The method of claim 2 , wherein the one or more identifiers comprise one or more network addresses one or more forwarding nodes in the identified set that are after the next forwarding node.

4. The method of claim 1 , wherein identifying the set of forwarding elements comprises identifying a path through the SD-WAN based on header values of a first packet of the flow.

5. The method of claim 4 , wherein the sent data comprises one or more identifiers of one or more forwarding nodes along the path, the method further comprising:

at each forwarding node along the path after the ingress forwarding node, identifying a subsequent forwarding node from the sent data, removing an identity of the particular forwarding node from the sent data, and forwarding the remaining data to a subsequent forwarding node when there is a next subsequent forwarding node.

6. The method of claim 5 , wherein when there is not a next subsequent forwarding node, forwarding the flow from the subsequent forwarding node to the second site connected to the SD-WAN.

7. The method of claim 5 further comprising:

at each SD-WAN forwarding node traversed by the flow from the first site to the second site:

performing a TCP split operation to terminate an incoming TCP connection and to start a new outgoing TCP connection;

storing a record for the flow that associates the two TCP connections; and

using the record to forward the packets of the flow along the path.

8. The method of claim 7 , wherein the flow is a first flow, the method further comprising using the record to forward reply flow sent from the second site to the first site in response to the first flow.

9. A non-transitory machine readable medium storing a program which when executed by at least one processing unit forwards packets through a software-defined wide area network (SD-WAN), the program for execution at an ingress forwarding node of the SD-WAN, the program comprising sets of instructions for:

terminating a TCP (Transport Connection Protocol) connection for a flow from a first site connected to the SD-WAN to a second site connected to the SD-WAN, the flow being forwarded through the SD-WAN without encapsulating the packets in tunnel headers;

identifying a set of forwarding nodes in the SD-WAN that the flow should take to reach the second site;

starting a new TCP connection with a next SD-WAN forwarding node in the identified set, and sending data regarding the identified set of forwarding nodes to the next SD-WAN forwarding node;

sending the flow to the next forwarding node in the SD-WAN;

wherein the terminating and starting are part of a TCP split operation performed by the ingress forwarding node, wherein a first packet of the flow comprises a prepended header identifying a series of forwarding nodes in the SD-WAN, wherein a second packet subsequent to the first packet is sent without the prepended header; and

wherein sending the data regarding the identified set of forwarding nodes comprises sending the data before or with the first packet and not sending any additional SD-WAN header (SDH) values before or with any subsequent packets of the flow.

10. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for sending data regarding the identified set of forwarding nodes comprises a set of instructions for sending, to the next forwarding node, one or more identifiers for one or more forwarding nodes in the identified set that are after the next forwarding node.

11. The non-transitory machine readable medium of claim 10 , wherein the one or more identifiers comprise one or more network addresses one or more forwarding nodes in the identified set that are after the next forwarding node.

12. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for identifying the set of forwarding elements comprises a set of instructions for identifying a path through the SD-WAN based on header values of a first packet of the flow.

13. The non-transitory machine readable medium of claim 12 , wherein the sent data comprises one or more identifiers of one or more forwarding nodes along the path, the program further comprising a set of instructions for:

at each forwarding node along the path after the ingress forwarding node, identifying a subsequent forwarding node from the sent data, removing an identity of the particular forwarding node from the sent data, and forwarding the remaining data to a subsequent forwarding node when there is a next subsequent forwarding node.

14. The non-transitory machine readable medium of claim 13 , wherein when there is not a next subsequent forwarding node, forwarding the flow from the subsequent forwarding node to the second site connected to the SD-WAN.

15. The non-transitory machine readable medium of claim 13 , wherein the program further comprises sets of instructions for:

at each SD-WAN forwarding node traversed by the flow from the first site to the second site:

performing a TCP split operation to terminate an incoming TCP connection and to start a new outgoing TCP connection;

storing a record for the flow that associates the two TCP connections; and

using the record to forward the packets of the flow along the path.

16. The non-transitory machine readable medium of claim 15 , wherein the flow is a first flow, the program further comprises a set of instructions for using the record to forward reply flow sent from the second site to the first site in response to the first flow.

Assignments (2)

Continuity (2)

References Cited (400)