Granted Patent B2

US 12,375,920 · App. 18/661,055 · Granted Jul 29, 2025

Inventors: Stefan Olofsson (Dubai, AE); Ijsbrand Wijnands (Leuven, BE); Hendrikus G. P. Bosch (Aalsmeer, NL); Jeffrey Napper (Delft, NL); Anubhav Gupta (Freemont, CA)

Assignee: CISCO TECHNOLOGY, INC.

H04W12/086H04L63/0272H04L63/20H04W12/37H04L45/64

Abstract

Claims (77)

1. An apparatus, comprising:

one or more processors; and

one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause the apparatus to perform operations comprising:

receiving software-defined networking in a wide area network (SD-WAN) policies from a component of an SD-WAN network;

establishing a session with a mobile device;

receiving information associated with the mobile device in response to establishing the session with the mobile device, wherein the information associated with the mobile device comprises device posture information comprising a hostname and an identification of an operating system;

filtering the SD-WAN policies based on the information associated with the mobile device to generate SD-WAN device-specific policies; and

communicating the SD-WAN device-specific policies to the mobile device.

2. The apparatus of claim 1 , the operations further comprising:

receiving updated SD-WAN policies from the component of the SD-WAN network;

filtering the updated SD-WAN policies based on the information associated with the mobile device to generate updated SD-WAN device-specific policies; and

communicating the updated SD-WAN device-specific policies to the mobile device.

3. The apparatus of claim 1 , the operations further comprising:

receiving updated information associated with the mobile device;

filtering the SD-WAN policies based on the updated information associated with the mobile device to generate updated SD-WAN device-specific policies; and

communicating the updated SD-WAN device-specific policies to the mobile device.

4. The apparatus of claim 1 , wherein the SD-WAN policies comprise at least one of the following types of policies:

access policies;

segmentation-based policies;

flow classification policies; or

path selection policies.

5. The apparatus of claim 1 , wherein the information associated with the mobile device further comprises security posture information.

6. The apparatus of claim 1 , wherein:

the apparatus is a virtual routing and forwarding (VRF) enterprise Internet Protocol Security (IPsec) gateway; and

the component of the SD-WAN network is a VRF SD-WAN edge router.

7. The apparatus of claim 1 , wherein:

the session between the mobile device and the apparatus is a Virtual Private Network (VPN) session; and

the apparatus is a VRF enterprise Secure Sockets Layer/Transport Layer Security SSL/DTLS gateway.

8. A method, comprising:

receiving software-defined networking in a wide area network (SD-WAN) policies from a component of an SD-WAN network;

establishing a session with a mobile device;

receiving information associated with the mobile device in response to establishing the session with the mobile device, wherein the information associated with the mobile device comprises device posture information comprising a hostname and an identification of an operating system;

filtering the SD-WAN policies based on the information associated with the mobile device to generate SD-WAN device-specific policies; and

communicating the SD-WAN device-specific policies to the mobile device.

9. The method of claim 8 , further comprising:

receiving updated SD-WAN policies from the component of the SD-WAN network;

filtering the updated SD-WAN policies based on the information associated with the mobile device to generate updated SD-WAN device-specific policies; and

communicating the updated SD-WAN device-specific policies to the mobile device.

10. The method of claim 8 , further comprising:

receiving updated information associated with the mobile device;

filtering the SD-WAN policies based on the updated information associated with the mobile device to generate updated SD-WAN device-specific policies; and

communicating the updated SD-WAN device-specific policies to the mobile device.

11. The method of claim 8 , wherein the SD-WAN policies comprise at least one of the following types of policies:

access policies;

segmentation-based policies;

flow classification policies; or

path selection policies.

12. The method of claim 8 , wherein the information associated with the mobile device further comprises security posture information.

13. The method of claim 8 , wherein:

the SD-WAN policies are received by a virtual routing and forwarding (VRF) enterprise Internet Protocol Security (IPsec) gateway; and

the component of the SD-WAN network is a VRF SD-WAN edge router.

14. The method of claim 8 , wherein:

the session is a Virtual Private Network (VPN) session; and

the SD-WAN policies are received by a VRF enterprise Secure Sockets Layer/Transport Layer Security SSL/DTLS gateway.

15. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving software-defined networking in a wide area network (SD-WAN) policies from a component of an SD-WAN network;

establishing a session with a mobile device;

receiving information associated with the mobile device in response to establishing the session with the mobile device, wherein the information associated with the mobile device comprises device posture information comprising a hostname and an identification of an operating system;

filtering the SD-WAN policies based on the information associated with the mobile device to generate SD-WAN device-specific policies; and

communicating the SD-WAN device-specific policies to the mobile device.

16. The one or more computer-readable storage media of claim 15 , the operations further comprising:

receiving updated SD-WAN policies from the component of the SD-WAN network;

filtering the updated SD-WAN policies based on the information associated with the mobile device to generate updated SD-WAN device-specific policies; and

communicating the updated SD-WAN device-specific policies to the mobile device.

17. The one or more computer-readable storage media of claim 15 , the operations further comprising:

receiving updated information associated with the mobile device;

filtering the SD-WAN policies based on the updated information associated with the mobile device to generate updated SD-WAN device-specific policies; and

communicating the updated SD-WAN device-specific policies to the mobile device.

18. The one or more computer-readable storage media of claim 15 , wherein the SD-WAN policies comprise at least one of the following types of policies:

access policies;

segmentation-based policies;

flow classification policies; or

path selection policies.

19. The one or more computer-readable storage media of claim 15 , wherein the information associated with the mobile device further comprises security posture information.

20. The one or more computer-readable storage media of claim 15 , wherein:

the SD-WAN policies are received by a virtual routing and forwarding (VRF) enterprise Internet Protocol Security (IPsec) gateway; and

the component of the SD-WAN network is a VRF SD-WAN edge router.

Assignments (1)

Continuity (4)

References Cited (43)