Ultimate regional fallback path for hierarchical SD-WAN
In one embodiment, a method includes determining, by a network node, that a first plurality of tunnel interfaces resides in a core region of a network and determining, by the network node, that a second plurality of tunnel interfaces resides in an access region of the network. The method also includes configuring, by the network node, a first tunnel interface as a core regional fallback path for the core region of the network and configuring, by the network node, a second tunnel interface as an access regional fallback path for the access region of the network.
1. A network node comprising one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and including instructions that, when executed by the one or more processors, cause the network node to perform operations comprising:
determining that a first plurality of tunnel interfaces resides in a core region of a network;
determining that a second plurality of tunnel interfaces resides in an access region of the network;
configuring a first tunnel interface as a core regional fallback path for the core region of the network;
configuring a second tunnel interface as an access regional fallback path for the access region of the network;
determining whether to activate the first tunnel interface or the second tunnel interface in response to one or more connectivity losses within the network;
in response to determining that the first plurality of tunnel interfaces loses connectivity to a data plane of the core region of the network, activating, by the network node, the first tunnel interface; and
in response to determining that the second plurality of tunnel interfaces loses connectivity to a data plane of the access region of the network, activating, by the network node, the second tunnel interface, wherein:
the network node is a border router, the border router comprising the first plurality of tunnel interfaces and the second plurality of tunnel interfaces; and
the border router is located at a boundary of the core region and the access region.
2. The network node of claim 1 , wherein a determination to activate the first tunnel interface is independent of a determination to activate the second tunnel interface.
3. The network node of claim 1 , wherein:
the first tunnel interface is connected to a first Internet Protocol Security (IPSec) data plane tunnel that resides in the core region; and
the second tunnel interface is connected to a second IPSec data plane tunnel that resides in the access region.
4. The network node of claim 1 , further comprising using Bidirectional Forwarding Detection (BFD) to determine data plane connectivity within the network.
5. The network node of claim 1 , wherein:
the network is a hierarchical software-defined wide area network (SD-WAN).
6. A method, comprising:
determining, by a network node, that a first plurality of tunnel interfaces resides in a core region of a network;
determining, by the network node, that a second plurality of tunnel interfaces resides in an access region of the network;
configuring, by the network node, a first tunnel interface as a core regional fallback path for the core region of the network;
configuring, by the network node, a second tunnel interface as an access regional fallback path for the access region of the network;
determining whether to activate the first tunnel interface or the second tunnel interface in response to one or more connectivity losses within the network;
in response to determining that the first plurality of tunnel interfaces loses connectivity to a data plane of the core region of the network, activating, by the network node, the first tunnel interface; and
in response to determining that the second plurality of tunnel interfaces loses connectivity to a data plane of the access region of the network, activating, by the network node, the second tunnel interface, wherein:
the network node is a border router, the border router comprising the first plurality of tunnel interfaces and the second plurality of tunnel interfaces; and
the border router is located at a boundary of the core region and the access region.
7. The method of claim 6 , wherein a determination to activate the first tunnel interface is independent of a determination to activate the second tunnel interface.
8. The method of claim 6 , wherein:
the first tunnel interface is connected to a first Internet Protocol Security (IPSec) data plane tunnel that resides in the core region; and
the second tunnel interface is connected to a second IPSec data plane tunnel that resides in the access region.
9. The method of claim 6 , further comprising using, by the network node, Bidirectional Forwarding Detection (BFD) to determine data plane connectivity within the network.
10. The method of claim 6 , wherein:
the network is a hierarchical software-defined wide area network (SD-WAN).
11. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
determining that a first plurality of tunnel interfaces of a border router resides in a core region of a network;
determining that a second plurality of tunnel interfaces of the border router resides in an access region of the network;
configuring a first tunnel interface as a core regional fallback path for the core region of the network;
configuring a second tunnel interface as an access regional fallback path for the access region of the network;
determining whether to activate the first tunnel interface or the second tunnel interface in response to one or more connectivity losses within the network;
in response to determining that the first plurality of tunnel interfaces loses connectivity to a data plane of the core region of the network, activating, by a network node, the first tunnel interface; and
in response to determining that the second plurality of tunnel interfaces loses connectivity to a data plane of the access region of the network, activating, by the network node, the second tunnel interface, wherein:
the network node is a border router, the border router comprising the first plurality of tunnel interfaces and the second plurality of tunnel interfaces; and
the border router is located at a boundary of the core region and the access region.
12. The one or more computer-readable non-transitory storage media of claim 11 , wherein a determination to activate the first tunnel interface is independent of a determination to activate the second tunnel interface.
13. The one or more computer-readable non-transitory storage media of claim 11 , wherein:
the first tunnel interface is connected to a first Internet Protocol Security (IPSec) data plane tunnel that resides in the core region; and
the second tunnel interface is connected to a second IPSec data plane tunnel that resides in the access region.
14. The one or more computer-readable non-transitory storage media of claim 11 , further comprising using Bidirectional Forwarding Detection (BFD) to determine data plane connectivity within the network.