SDWAN data-plane resiliency for extended survivability
The present technology provides solutions for maintaining communications within a software-defined wide area network (SDWAN) when one or more devices in the SDWAN are isolated from one or more controllers. An example method includes receiving, at a static edge device associated with a static wide area network (WAN) Internet Protocol (IP) address in a data plane of the SDWAN, data from a first device communicating through an edge device of a first Internet service provider (ISP) of the SDWAN, where the first device is associated with a private IP address, associating, by the static edge device, the first device with the private IP address, and communicating, by the static edge device, with the first device at the private IP address. Systems and computer-readable media are also provided.
1 . A method for maintaining communications within a software-defined wide area network (SDWAN) when one or more devices in the SDWAN are isolated from one or more controllers, the method comprising:
receiving, at a static edge device associated with a static wide area network (WAN) Internet Protocol (IP) address in a data plane of the SDWAN, data from a first device communicating through an edge device of a first Internet service provider (ISP) of the SDWAN, wherein the first device is associated with a private IP address;
associating, by the static edge device, the first device with the private IP address;
communicating, by the static edge device, with the first device at the private IP address;
determining, by the static edge device, isolation from the one or more controllers; and
automatically extending, by the static edge device and based on the determining of isolation from the one or more controllers, a lifetime of a security parameter.
2 . The method of claim 1 , wherein the static WAN IP address of the static edge device is a static public WAN IP address.
3 . The method of claim 1 , the method further comprising:
determining, by the static edge device, that the private IP address is different from a previous private IP address associated with the first device,
wherein associating the first device with the private IP address includes updating the previous private IP address to the private IP address.
4 . The method of claim 1 , wherein the ISP includes a network address translation (NAT) entry identifying a translation between a public IP address associated with the first device and the private IP address, the method further comprising:
determining, by the static edge device, that the public IP address is different from a previous public IP address,
wherein the first device is associated with the private IP address by associating the first device with the public IP address, and wherein associating the first device with the public IP address includes updating the previous public IP address to the public IP address.
5 . The method of claim 1 , wherein the security parameter is an IP security (IPsec) key or a security association.
6 . The method of claim 1 , the method further comprising:
sending, from the static edge device and based on the determining of isolation from the one or more controllers, a new security parameter to the first device.
7 . The method of claim 6 , wherein the new security parameter is a new IPsec key or a new security association.
8 . A system comprising:
a processor; and
a non-transitory memory storing computer-executable instructions thereon, wherein the computer-executable instructions, when executed by the processor, cause the processor to perform operations comprising:
receiving, at a static edge device associated with a static wide area network (WAN) Internet Protocol (IP) address in a data plane of a software-defined wide area network (SDWAN), data from a first device communicating through an edge device of a first Internet service provider (ISP) of the SDWAN, wherein the first device is associated with a private IP address;
associating, by the static edge device, the first device with the private IP address;
communicating, by the static edge device, with the first device at the private IP address;
determining, by the static edge device, isolation from one or more controllers; and
automatically extending, by the static edge device and based on the determining of isolation from the one or more controllers, a lifetime of a security parameter.
9 . The system of claim 8 , wherein the static WAN IP address of the static edge device is a static public WAN IP address.
10 . The system of claim 8 , wherein the computer-executable instructions, when executed by processor, cause the processor to further perform operations comprising:
determining, by the static edge device, that the private IP address is different from a previous private IP address associated with the first device,
wherein associating the first device with the private IP address includes updating the previous private IP address to the private IP address.
11 . The system of claim 8 , wherein the ISP includes a NAT entry identifying a translation between a public IP address associated with the first device and the private IP address, wherein the computer-executable instructions, when executed by processor, cause the processor to further perform operations comprising:
determining, by the static edge device, that the public IP address is different from a previous public IP address,
wherein the first device is associated with the private IP address by associating the first device with the public IP address, and wherein associating the first device with the public IP address includes updating the previous public IP address to the public IP address.
12 . The system of claim 8 , wherein the security parameter is an IP security (IPsec) key or a security association.
13 . The system of claim 8 , wherein the computer-executable instructions, when executed by processor, cause the processor to further perform operations comprising:
sending, from the static edge device and based on the determining of isolation from the one or more controllers, a new security parameter to the first device.
14 . The system of claim 13 , wherein the new security parameter is a new IPsec key or a new security association.
15 . A non-transitory computer-readable medium storing instructions thereon, wherein the instructions, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, at a static edge device associated with a static wide area network (WAN) Internet Protocol (IP) address in a data plane of a software-defined wide area network (SDWAN), data from a first device communicating through an edge device of a first Internet service provider (ISP) of the SDWAN, wherein the first device is associated with a private IP address;
associating, by the static edge device, the first device with the private IP address;
communicating, by the static edge device, with the first device at the private IP address;
determining, by the static edge device, isolation from one or more controllers; and
automatically extending, by the static edge device and based on the determining of isolation from the one or more controllers, a lifetime of a security parameter.
16 . The non-transitory computer-readable medium of claim 15 , wherein the static WAN IP address of the static edge device is a static public WAN IP address.
17 . The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, cause the one or more processors to further perform operations comprising:
determining, by the static edge device, that the private IP address is different from a previous private IP address associated with the first device,
wherein associating the first device with the private IP address includes updating the previous private IP address to the private IP address.
18 . The non-transitory computer-readable medium of claim 15 , wherein the ISP includes a NAT entry identifying a translation between a public IP address associated with the first device and the private IP address, wherein the instructions, when executed by the one or more processors, cause the one or more processors to further perform operations comprising:
determining, by the static edge device, that the public IP address is different from a previous public IP address,
wherein the first device is associated with the private IP address by associating the first device with the public IP address, and wherein associating the first device with the public IP address includes updating the previous public IP address to the public IP address.
19 . The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, cause the one or more processors to further perform operations comprising:
sending, from the static edge device and based on the determining of isolation from the one or more controllers, a new security parameter to the first device.
20 . The non-transitory computer-readable medium of claim 15 , wherein the security parameter is an IP security (IPsec) key or a security association.