Patent Description:
A computer network can include a system of hardware, software, protocols, and transmission components that collectively allow separate devices to communicate, share data, and access resources, such as software applications. More specifically, a computer network is a geographically distributed collection of nodes interconnected by communication links and segments for transporting data between endpoints, such as personal computers and workstations. Many types of networks are available, ranging from local area networks (LANs) and wide area networks (WANs) to overlay and software-defined networks, such as software-defined local area networks (SD-LANs) and software-defined wide area networks (SD-WANs), and virtual networks, such as virtual LANs (VLANs) and virtual private networks (VPNs). <CIT> describes a method that includes parsing a packet received by the network device to identify a packet header value of the packet and performing a lookup into an application identification cache using the packet header value to identify the packet as part of a traffic flow of a particular application. <NPL>) describes requirements on the SD-WAN security checklist. <CIT> describes computerized system useful for implementing a cloud-based multipath routing protocol to an Internet endpoint includes an edge device that provides an entry point into an entity's core network. The entity's core network includes a set of resources to be reliably accessed. The computerized system includes a cloud-edge device instantiated in a public-cloud computing platform. The cloud-edge device joins a same virtual routing and forwarding table as the edge device. The cloud-edge device receives a set of sources and destinations of network traffic that are permitted to access the edge device and the set of resources.

Particular embodiments described herein provide an intent based application fabric which is created to control and manage one or more specific applications of interest using a portion of a software-defined wide area network (SD-WAN) in a communication network. This is accomplished by (<NUM>) discovering which devices (or routers) are running an application of interest among edge routers of the SD-WAN, and by (<NUM>) building (or generating), when one or more edge routers running the application of interest are discovered, an application fabric for the application of interest based on a policy (e.g., network policy), quality of service (QoS), latency, loss, or bandwidth availability for the application of interest. For purposes of description, certain embodiments may refer to this application fabric as an "intent based application fabric. " The application fabric is to be built using a portion of the SD-WAN, because the application fabric is configured with all or part of the edge routers, each of which runs the application of interest, selected from among the edge routers of the SD-WAN.

In particular embodiments, a controller of the SD-WAN is configured to generate a first profile for a first application and provide the first profile to a plurality of edge routers of the SD-WAN. Herein, the plurality of edge routers may be operable to interface a plurality of devices to the SD-WAN, and the first profile may enable the plurality of edge routers to discover which devices of the plurality of devices support the first application. The controller is further configured to receive, from one or more of the edge routers, information indicating which devices of the plurality of devices support the first application. And the controller is furthermore configured to build a first application fabric for the first application based on the information indicating which devices of the plurality of devices support the first application.

In some embodiments, intent-based networking infrastructure is provided to capture the business intent, in business language, and translate this intent into IT policies that can be applied and constantly monitored across the network. In view of the user's viewpoint, an intent of a user or an operator (e.g., the "what") is translated into specific executions (the "how") for performing the intent. An intent-based network provides three principal functional building blocks: capabilities to capture intent; functions to automate the deployment of the expressed intent throughout the network infrastructure; and the ability to assure that the desired intent is being realized.

In certain embodiments of this disclosure, intent-based networking (IBN) may offer a significant paradigm shift in how networks are planned, designed, and operated. In the past, tools were not available to declare intent and translate it into the device-level configurations required to realize a desired outcome. Instead, the network designer or operator had to manually derive individual network-element configurations to support the desired intent, such as, "I want these servers to be reachable from these branches; therefore, I need to configure specific virtual local area network (VLAN), subnet, and security rules on each device in my network. " Intent-based networking solutions enable conventional practices that require the alignment of manually derived individual network-element configurations to be replaced by controller-led and policy-based abstractions that easily enable operators to express intent (desired outcome) and subsequently validate that the network is doing what they asked of it.

In some embodiments of intent-based networking, scale, agility and security demands associated with digital transformation require that element-by-element network configuration be replaced by automated systemwide programming of network elements with consistent intent-based policies. Furthermore, the contextual analysis of data before, during, and after deployment enables continuous verification to help assure that the network is delivering the desired outcome and protection at any point in time. Continuous gathering of telemetry and other forms of data from a multitude of diverse sources provides a rich context of information to optimize a system and ensure it is secure. Intent-based policy extends beyond the access control of clients or applications. It broadens to expressions of the desired user experience, application prioritization, service-chaining network functions that need to be applied to an application flow, or even operational service-level agreement (SLA) rules, such as, "I want to deploy only golden images on my network devices.

As described herein, embodiments include various elements and limitations, with no one element or limitation contemplated as being a critical element or limitation. Each of the claims individually recites an aspect of the embodiment in its entirety. Moreover, some embodiments described may include, but are not limited to, inter alia, systems, networks, integrated circuit chips, embedded processors, ASICs, methods, and computer-readable non-transitory media containing instructions. One or multiple systems, devices, components, etc., may comprise one or more embodiments, which may include some elements or limitations of a claim being performed by the same or different systems, devices, components, etc. A processing element may be a general processor, a task-specific processor, a core of one or more processors, or other co-located, resource-sharing implementation for performing the corresponding processing. The embodiments described hereinafter embody various aspects and configurations, with the figures illustrating example and non-limiting configurations. The term "system" or "apparatus" is used consistently herein with its common definition of an appliance or device.

The steps, connections, and processing of signals and information illustrated in the figures, including, but not limited to, any block and flow diagrams and message sequence charts, may typically be performed in the same or in a different serial or parallel ordering and/or by different components and/or processes, threads, etc., and/or over different connections and be combined with other functions in other embodiments, unless this disables the embodiment or a sequence is explicitly or implicitly required (e.g., for a sequence of read the value, process said read value--the value must be obtained prior to processing it, although some of the associated processing may be performed prior to, concurrently with, and/or after the read operation). Also, nothing described or referenced in this document is admitted as prior art to this application unless explicitly so stated.

The term "one embodiment" is used herein to reference a particular embodiment, wherein each reference to "one embodiment" may refer to a different embodiment, and the use of the term repeatedly herein in describing associated features, elements and/or limitations does not establish a cumulative set of associated features, elements and/or limitations that each and every embodiment must include, although an embodiment typically may include all these features, elements and/or limitations. In addition, the terms "first," "second," etc., as well as "particular" and "specific" are typically used herein to denote different units (e.g., a first widget or operation, a second widget or operation, a particular widget or operation, a specific widget or operation). The use of these terms herein does not necessarily denote an ordering such as one unit, operation or event occurring or coming before another or another characterization, but rather provides a mechanism to distinguish between element units. Moreover, the phrases "based on x" and "in response to x" are used to indicate a minimum set of items "x" from which something is derived or caused, wherein "x" is extensible and does not necessarily describe a complete list of items on which the operation is performed, etc. The term "or" is inclusive and not exclusive, unless expressly indicated otherwise or indicated otherwise by context. Additionally, the transitional term "comprising," which depending on the context may generally be synonymous with "including," "containing," or "characterized by," is inclusive or open-ended and does not exclude additional, unrecited elements or method steps. Finally, the term "particular machine," when recited in a method claim for performing steps, refers to a particular machine within the <NUM> USC § <NUM> machine statutory class.

<FIG> illustrates an example of an SD-WAN overlay <NUM>. SD-WAN overlay <NUM> comprises a management controller (manager <NUM>), a network controller (controller <NUM>), and a plurality of edge routers <NUM> (e.g., edge routers <NUM> to <NUM>). Edge routers <NUM> connect with one another via, for example, dynamic tunnels. The example in <FIG> illustrates a fully-meshed network in which each edge router <NUM> is part of the SD-WAN overlay. Edge routers <NUM> may interface a plurality of devices to the SD-WAN. Examples of devices may include washing machines, credit card machines, security cameras, conference room cameras, printers, remote surgery machines, etc. The devices may be deployed at different sites. For example, devices at one site may communicate with edge router <NUM>, and devices at a different site may communicate with edge router <NUM>. Examples of different sites may include a headquarters, one or more branch offices, an R&D campus, a cloud-based site, a data center, etc. The devices may communicate messages via the SD-WAN according to various applications (e.g., washing machine application, video conferencing, credit card application, security camera application, printer application, remote surgery application, etc.).

Manager <NUM> and controller <NUM> are both examples of controllers. In the example shown in <FIG>, manager <NUM> (e.g., a management controller) is connected with controller <NUM>. Controller <NUM> is configured to communicate with manager <NUM> and to control a plurality of edge routers <NUM> in SD-WAN overlay <NUM>. In one embodiment, controller <NUM> may be embodied independently from manager <NUM>. In another embodiment, controller <NUM> may embodied together with manager <NUM> (e.g., a controller in a single computer system or device may perform functionality of both manager <NUM> and controller <NUM>). Thus, depending on the embodiment, a controller may comprise manager <NUM>, controller <NUM>, or both (whether embodied in the same system/device, or embodied in different systems/devices communicatively coupled via a network or other connection).

In certain embodiments, manager <NUM> and controller <NUM> may cooperate to determine an application-specific fabric overlay for edge routers deployed in the SD-WAN overlay. The application-specific fabric comprises a portion of the SD-WAN operable to communicate messages associated with a specific application (as one example, a washing machine application). The application-specific fabric includes a subset of edge routers <NUM> that interface devices that support the specific application (in the example, the washing machine application) with the SD-WAN. In some embodiments, manager <NUM> and controller <NUM> may build the application-specific fabric overlay in response to a request from a user (such as a system administrator, network operator, or end user). The request may indicate the application (or features of the application) for which the user would like to build an application-specific fabric.

As an example, in certain embodiments, manager <NUM> is operable to determine an application of interest (an application for which an application fabric overlay is to be built) and to provide controller <NUM> with a profile to be distributed to edge routers <NUM>-<NUM>. The profile enables edge routers <NUM>-<NUM> to discover which devices support the application of interest. One or more of edge routers <NUM>-<NUM> may each provide information to controller <NUM> indicating whether that edge router has discovered any devices supporting the application of interest. Controller <NUM> provides the information to manager <NUM>, and manager <NUM> uses the information to build the application fabric overlay for the application of interest. Manager <NUM> may then develop application-specific policies and provide the policies to controller <NUM> for distribution to the subset of edge devices that are associated with the application fabric overlay for the application of interest. The subset of edge devices may then enforce the application-specific policies when communicating traffic associated with the application of interest. Controller <NUM> may receive application monitoring data (or application meta data) from the end devices.

In certain embodiments of this disclosure, an example method and system may support the capabilities of SD-WAN and may provide an intent based application fabric (e.g., a platform using a set of middleware technologies) for business critical applications in the SD-WAN. For example, in certain embodiments, one or more controllers of the SD-WAN infrastructure (e.g., manager <NUM> and/or controller <NUM>) may be operable to: see or monitor an application fabric (e.g., a customer's application fabric); monitor traffic states in sites (e.g., places where edge routers <NUM> are placed in <FIG>) and traffic flowing in the network; monitor in real time the security and performance of the traffic across different sites; and/or enforce traffic policies for segmenting the network, providing security (e.g., quarantine or other security), and/or changing or maintaining quality of service (QoS). Particular embodiments of this disclosure provide a solution and a system for performing an intent based application fabric in the SD-WAN that performs a set of technical functions or abilities: (i) to identify applications hosted in a site; (ii) to host the applications and collect meta data on an Enterprise Network Compute System (ENCS)-type branch platform and to advertise application availability to the rest of the enterprise networks; (iii) to visualize and monitor flows/conversations belonging to an application across the enterprise; (iv) to query a management controller (e.g., vManage Controller such as manager <NUM> in <FIG>) for network bandwidth availability for using SD-WAN overlay and allocate dynamic tunnels between sites for facilitating an application.

<FIG> illustrates a first example of an application overlay for a first application fabric in SD-WAN. <FIG> includes manager <NUM> and controller <NUM> (described above with respect to <FIG>). <FIG> also includes a plurality of edge routers <NUM> (similar to edge routers <NUM> described above with respect to <FIG>). In particular, <FIG> illustrates eight edge routers <NUM>-<NUM>. As indicated by the tunnels shown in <FIG>, the application overlay connects a subset of the edge routers (<NUM> and <NUM>-<NUM>). This subset represents the edge routers associated with a specific application. In the example, edge routers <NUM> and <NUM> are not associated with the specific application (e.g., the devices that edge routers <NUM> and <NUM> interface to the SD-WAN do not support the specific application) and therefore edge routers <NUM> and <NUM> are not included in the application overlay. Thus, application overlay shown in <FIG> does not include tunnels connecting to edge routers <NUM> and <NUM>.

As an example, <FIG> may represent an application overlay for an application related to a health care. In certain embodiments, an application overlay may encompass applications associated with a field (e.g., health care) and/or an enterprise (e.g., a hospital or health care provider). As an example, an intent based application fabric may be applied to a health care vertical (e.g., McKesson, Cigna, Palo Alto Medical Foundation and others) use case in which hospitals are located at various sites and these various sites are connected using SD-WAN overlay. Certain health care-related embodiments may facilitate providing patients with high quality care and access to all of the latest technologies available to the doctors and staffs. Particular embodiments may provide availability of various pre-determined application overlays based on business vertical like, e.g., the heath care. In an embodiment, to identify applications which are managed in devices of the SD-WAN, a computing system may deploy, for example, device classification services (DCS) which classify the devices in addition to application recognition engines (e.g., NBAR2) which use application signatures.

Consider the example of an application for "remote surgery" telepresence. Particular embodiments enable or authorize the health care provider to perform a set of instructions in the network. The instructions may indicate the user's intent and may be based on information obtained from the user. A user-friendly interface may be provided to obtain the user's intent through familiar, natural language ordinarily used in the applicable business, such as the health care business, instead of requiring the user to learn technical jargon to convey the user's intent. The instructions may allow the health care provider to know (i.e., monitor, detect, or check) all the sites where the remote surgery application can be performed. In the example, the health care provider may be associated with a subset of the sites (e.g., hospitals) at network end points. The particular embodiments may enable or authorize the health care provider to show, between these sites, a view of how the "remote surgery" telepresence applications are performing, where each remote surgery application is hosted (e.g., which of the edge routers are hosting, scheduled to host, and/or capable of hosting the remote surgery application), and the performance reliability and/or performance guarantee associated with each remote surgery application (or each edge router). The health care provider may use information obtained based on the application overlay to reserve bandwidth resources. For example, the health care provider may reserve bandwidth for a particular time (when the surgery is scheduled) with a particular quality of service (QoS) guarantee (QoS approved for the remote surgery application). The health care provider can schedule the resources to ensure that the reserved resources have high availability (e.g., a remote surgery application may require high availability to ensure patient safety and may be given higher priority/QoS guarantee compared to other types of applications, such as back office applications). Information obtained via the application overlay may also aide the health care provider in quickly troubleshooting any problems in the network or with a particular application.

As another example, certain embodiments may provide video and voice services in an enterprise network such that the SD-WAN controller (e.g., <NUM> and <NUM> in <FIG> and <FIG>) is to perform various query processes and the bandwidth between sites is reserved to participate in the video and/or voice teleconference meetings. Manager <NUM> may determine a policy (or policies) that is specific to the application of interest. Manager <NUM> may provide the determined policy to the edge routers via the controller <NUM>. Different types of policies may include, for example, routing policies, bandwidth reservation policies, QoS policies, service level agreement (SLA) policies, security policies, etc. The policy may be determined based on information obtained from the user (such as a system administrator, network operator, or end user). The policy may also be determined based on information obtained from the network (e.g., based on network performance).

<FIG> illustrate an example signal flow of a method and system for building a first application fabric. In certain embodiments of this disclosure, a method and system for building an "intent based application fabric" (e.g., application fabric overlay shown in <FIG>) for a business critical application (e.g., "remote surgery" application) may perform the following processes (or steps): (<NUM>) application discovery; (<NUM>) application fabric building; (<NUM>) application monitoring; (<NUM>) application control and experience. An embodiment in <FIG> presents signal flows associated with the processes of the application discovery (e.g., steps <NUM>-<NUM>), application fabric building (e.g., step <NUM>), application monitoring (e.g., step <NUM>), and application control and experience (e.g., step <NUM>). The example in <FIG> shows certain functionality of one or more controllers. This functionality may be performed by manager <NUM>, controller <NUM>, both, or any other controller or combination of controllers operable to perform the described functionality, depending on the embodiment.

At step <NUM>, manager <NUM> may determine a first application. The first application may be an application for which a first application fabric is to be built. For example, the first application may be an application of interest to a user. In certain embodiments, the first application may be determined based on information received from a user (such as a system administrator, network operator, or end user). In certain embodiments, the user may select the first application from a list of predetermined applications. For example, the list might include a video application, a telepresence application, a printer application, a credit card reader application, etc. In certain embodiments, the user can define a custom application. For example, a washing machine vendor may provide characteristics for discovering washing machines that support a proprietary washing machine application. Examples of characteristics may include an application identifier, an application signature, or other application-related information (e.g., a parameter, a port number, a protocol number, a protocol format, a message signature, etc.). The application signature (or custom signature) is configured to determine a certain application which is specific to a certain business or a specified customer. Certain embodiments may provide the user with the option of selecting from a list of predetermined applications (e.g., listing default applications or previously defined custom applications) or customizing a new definition for an application. Information may be obtained from a user in any suitable manner, such as via an I/O interface of manager <NUM> (or controller <NUM>), or via a network (e.g., the Internet) that connects manager <NUM> to a computer system of the user.

At step <NUM>, manager <NUM> may generate a first profile for enabling edge routers <NUM>-<NUM> to discover devices that support the first application (i.e., the application determined in step <NUM>). The profile may indicate one or more characteristics associated with the first application, such as an application identifier, an application signature, or other application-related information (e.g., a parameter, a port number, a protocol number, a protocol format, a message signature, etc.). Manager <NUM> may provide the first profile to controller <NUM> for distribution to edge routers <NUM> of the SD-WAN, and at step <NUM> controller <NUM> may provide the first profile generated in step <NUM> to the plurality of edge routers <NUM> of the SD-WAN.

The first profile enables edge routers <NUM>-<NUM> to discover devices that support the first application. For example, edge routers <NUM>-<NUM> are operable to interface a plurality of devices (such as washing machines, credit card machines, security cameras, conference room cameras, printers, etc.) to the SD-WAN. Suppose the first profile indicates characteristics of a video conferencing application, such as a message signature of messages that a video conferencing device communicates to other video conferencing devices via an edge router and SD-WAN. The first profile enables the plurality of edge routers <NUM>-<NUM> to discover which devices of the plurality of devices support the first application. Continuing with the video conferencing application example, the message signature can be compared to messages that end devices send to the SD-WAN, and messages from video conferencing devices running the first application would match the message signature associated with the first application. Messages from other types of devices (such as washing machines) would not match the message signature associated with the first application.

At step <NUM>, manager <NUM> and/or controller <NUM> may receive, from one or more of the edge routers (e.g., <NUM>, <NUM>-<NUM>) among edge routers <NUM>, information indicating which devices of the plurality of devices support the first application. In some embodiments, manager <NUM> receives the information from the edge routers via controller <NUM>. In <FIG>, edge routers <NUM>, and <NUM>-<NUM> may send information which indicates support for the first application. The information may be transmitted through traffic signals sent from one or more edge routers. In some embodiments, the information may include a device signature (or other device identifier) used for validating each device. Manager <NUM> may perform a validation process (or security process) based on the device signature. For example, if the first application of interest is a video conferencing application, traffic signals received from a printer (via one of the edge routers) would contain the device signature of a printer and would fail validation for the video conferencing application. Thus, the printer would not be authorized to run the video conferencing application. This prevents rogue devices, such as devices that are spoofing an application, from being associated with the first application fabric. Validation may be performed by any suitable node (e.g., manager <NUM>, controller <NUM>, or an edge router).

At step <NUM>, manager <NUM> and/or controller <NUM> may build the first application fabric based on the information indicating which devices of the plurality of devices support the first application. The first application fabric may correspond to a portion of the SD-WAN operable to communicate messages associated with the first application. For example, <FIG> shows a full-meshed SD-WAN overlay operable communicate between edge routers <NUM>-<NUM>, and <FIG> shows the first application fabric (i.e., an application overlay configured for the first application) to be built with a portion (e.g., edge routers <NUM> and <NUM>-<NUM>) determined among all edge routers <NUM>-<NUM> of the SD-WAN overlay. Since building the first application fabric between edge routers <NUM> and <NUM>-<NUM> configures the application overlay for the first application, edge routers <NUM> and <NUM>-<NUM> may be operable to communicate messages associated with the first application therebetween (at step <NUM>). In the example, manager <NUM> excludes edge routers <NUM> and <NUM> from the first application fabric based on the absence of any message from edge routers <NUM> and <NUM> in step <NUM> (or based on the presence of a message from edge routers <NUM> and <NUM> indicating that they have not discovered any devices that support the first application). In certain embodiments, manager <NUM> and/or controller <NUM> may continue to receive information from edge routers <NUM> over time indicating discovery of additional devices that support the first application (e.g., as additional devices are added to the SD-WAN over time). Manager <NUM> and/or controller <NUM> may continue to build/update the first application fabric accordingly. Similarly, manager <NUM> and/or controller <NUM> may build/update the first application fabric to remove an edge router from the first application fabric (e.g., if all of the devices that the edge router had discovered for the first application are later removed from the site hosted by that edge router). Thus, building of an application fabric may be dynamic to reflect when devices are added to or removed from the SD-WAN.

At step <NUM>, manager <NUM> and/or controller <NUM> configure the first application fabric comprising edge devices <NUM> and <NUM>-<NUM> (and excluding edge devices <NUM> and <NUM>). In certain embodiments, manager <NUM> and controller <NUM> may use the first application fabric to apply application-specific policies, as shown in step <NUM>. At step <NUM>-<NUM>, manager <NUM> may determine a first policy that is specific to the first application and may provide the first policy to controller <NUM>. At step <NUM>-<NUM>, controller <NUM> may push the first policy with signatures (or identifiers, or meta data) for the first application of interest to edge routers <NUM> and <NUM>-<NUM> that are associated with the first application fabric to apply the first policy to traffic of the first application. That is, manager <NUM> and controller <NUM> instruct each of edge routers <NUM> and <NUM>-<NUM> to apply the first policy to traffic of the first application (at step <NUM>-<NUM>). The first policy may include one or more different types of policies such as, for example, routing policies, bandwidth reservation policies, QoS policies, SLA policies, security policies, etc. The first policy may be determined based on information obtained from the user (such as a system administrator, network operator, or end user). The policy may be also determined based on information obtained from the network (e.g., based on network performance). In one embodiment, controller <NUM> may abstain from providing the first policy to edge routers that are not associated with the first application fabric. Thus, the first policy need only be applied by the edge routers (e.g., <NUM> and <NUM>-<NUM> in <FIG>) that are associated with the first application fabric. Also, depending on the type of policy, the first policy may be provided to and enforced by other types of nodes (e.g., internal routers) associated with the first application fabric. In an alternative embodiment, step <NUM> may be performed before building the first application fabric (in which case the policy may be sent to each edge router in the SD-WAN).

Either or both of manager <NUM> or controller <NUM> may further perform the processes of application monitoring and application control at steps <NUM> and <NUM>. Manager <NUM> may monitor traffic associated with the first application fabric. For example, manager <NUM> may receive information about application-specific traffic communicated via the SD-WAN. Manager <NUM> may receive the information about the application-specific traffic from the edge routers associated with the first application fabric (at step <NUM>). In some embodiments, manager <NUM> may receive the information from the edge routers via controller <NUM>. Manager <NUM> may generate data (e.g., the data can be statistics, a status report, etc.) indicating performance of the first application fabric and report the generated data to a user (such as a system administrator, network operator, or end user) or to components of the network that use the data to automatically update policies (e.g., a routing policy could be updated if the data shows that the first application was experiencing too much latency) (at step <NUM>). At step <NUM>, manager <NUM> and controller <NUM> may further control the first application fabric based on the monitored traffic, by instructing one or more nodes (e.g., edge routers <NUM>, <NUM>-<NUM> in <FIG> and/or internal nodes within the SD-WAN (not shown)) of the first application fabric to perform one or more actions such as, for example, reserving a bandwidth resource, implementing a routing decision, and updating a policy.

The method described in <FIG> may be repeated to build additional application fabrics for additional applications. Different application fabrics may include different (overlapping or non-overlapping) portions of the SD-WAN depending on where the devices supporting the various applications are located. Examples are described with respect to <FIG>.

<FIG> illustrates a second example of an application overlay for a second application fabric in SD-WAN. A topology illustrated in <FIG> may be an application overlay for a specific application of interest (e.g., "washing machine" application). Referring to <FIG>, the second application fabric for the second application of interest is built to configure application overlay <NUM> in the SD-WAN. In <FIG>, the second application fabric <NUM> is configured with edge routers (e.g., edge routers <NUM>-<NUM> in <FIG>) operable to run the specific application (i.e., "washing machine" application). The second application fabric <NUM> of <FIG> corresponds to a portion of the SD-WAN, as described above in <FIG>. Referring to <FIG> and <FIG>, <FIG> shows the application overlay of the first application fabric which is built for the first application and operable to communicate between edge routers <NUM> and <NUM>-<NUM>. <FIG> shows the application overlay of the second application fabric which is built for the second application and operable to communicate between edge routers <NUM>-<NUM>.

<FIG> illustrates an example signal flow of a method and system for building a second application fabric. The processes for building the second application fabric are analogous to the processes described in <FIG>. While the first application fabric configured with edge routers <NUM> and <NUM>-<NUM> has been built (step <NUM>), the second application fabric may be further built for the second application.

Step <NUM> determines a second application. The second application may be determined in a manner analogous to step <NUM> of <FIG>. As an example, the method may build a first application fabric for a first application (e.g., a video conferencing application) following the steps of <FIG> and may also determine a second application (e.g., a printer application) for which a second application fabric is to be built.

Step <NUM> generates a second profile for enabling edge routers <NUM>-<NUM> to discover devices that support the second application (i.e., the application determined in step <NUM>). The profile may indicate one or more characteristics associated with the second application, such as an application identifier, an application signature, or other application-related information (e.g., a parameter, a port number, a protocol number, a protocol format, a message signature, etc.). Manager <NUM> may provide the second profile to controller <NUM> for distribution to edge routers <NUM> of the SD-WAN, and at step <NUM> controller <NUM> may provide the second profile generated in step <NUM> to the plurality of edge routers <NUM> of the SD-WAN.

Step <NUM> of <FIG> is generally analogous to step <NUM> of <FIG>. In step <NUM>, manager <NUM> and/or controller <NUM> may receive, from one or more of the edge routers (e.g., <NUM>-<NUM>) among edge routers <NUM>, information indicating which devices of the plurality of devices support the second application. In the example, the subset of edge routers that support the second application (edge routers <NUM>-<NUM>) differs from the subset of routers that support the first application (edge routers <NUM>, <NUM>-<NUM>), however, the different subsets partially overlap (edge routers <NUM> and <NUM> belong to both subsets).

Step <NUM> builds the second application fabric for the second application. Step <NUM> in <FIG> is generally analogous to step <NUM> in <FIG>. The second application fabric comprises the edge routers from which devices supporting the second application were discovered in step <NUM> (e.g., edge routers <NUM>-<NUM>) and excludes the other edge routers (e.g., edge routers <NUM>-<NUM>).

Step <NUM> configures the second application fabric for the second application. Step <NUM> in <FIG> is generally analogous to step <NUM> in <FIG>. In certain embodiments, manager <NUM> and/or controller <NUM> may use the second application fabric to apply application-specific policies, as shown in step <NUM>. As an example, at step <NUM>-<NUM>, manager <NUM> may determine a second policy that is specific to the second application and may provide the second policy to controller <NUM>. At step <NUM>-<NUM>, controller <NUM> may push the second policy to edge routers of the second application fabric (e.g., edge routers <NUM>-<NUM>). The edge routers of the second application fabric may then apply the second policy to traffic associated with the second application. As discussed above, examples of policies may include routing policies, bandwidth reservation policies, QoS policies, SLA policies, security policies, etc. In certain embodiments, policies may allow for prioritizing certain applications. For example, suppose that the first application fabric corresponds to a critical application (such as a remote surgery telepresence application) and the second application fabric corresponds to a non-critical application (such as a printer application in the back office). The policies may be configured to ensure that the first application fabric has higher priority for bandwidth reservation, with stricter QoS and SLA policies, etc..

Step <NUM> of <FIG> monitors traffic associated with the first application fabric and traffic associated with the second application fabric (similar to step <NUM> of <FIG>). Step <NUM> of <FIG> may report data indicating performance of the first application fabric and data indicating performance of the second application fabric (similar to step <NUM> of <FIG>). In certain embodiments, statistics or reports based on the monitoring the first application traffic may be separated from statistics or reports based on monitoring the second application fabric. In certain embodiments, the statistics or reports may be combined and application fabric identifiers may be included with the data to allow for filtering information associated with either the first application fabric or the second application fabric. In certain embodiments, step <NUM> comprises controlling the first application fabric and the second application fabric based on the monitored traffic (similar to step <NUM> of <FIG>). The first application fabric and the second application fabric may be controlled separately based on their respective traffic. As an example, a routing policy for the first application fabric could be updated if the data shows that the first application was experiencing too much latency, but a routing policy for the second application fabric would not necessarily need to be updated if the data shows that the second application was experiencing acceptable latency. Steps <NUM> and <NUM> may be performed by manager <NUM> and/or controller <NUM>.

<FIG> illustrates an example of a flow chart of building an application fabric for an application of interest in SD-WAN. Referring to <FIG>, the method may be performed by a controller (e.g., the controller may be either or both of manager <NUM> and controller <NUM> in <FIG>) of the SD-WAN, where the controller is included in a computing system and configured to perform processes for building the application fabric for a specific application of interest. In one embodiment, the controller is configured to provide a first profile to a plurality of edge routers of the SD-WAN (at step <NUM>). The edge routers are operable to interface a plurality of devices to the SD-WAN, and the first profile may enable the plurality of edge routers to discover which devices of the plurality of devices support a first application. At step <NUM>, the controller is configured to receive, from one or more of the edge routers, information indicating which devices of the plurality of devices support the first application. At step <NUM>, the controller is configured to build a first application fabric based on the information indicating which devices of the plurality of devices support the first application, where the first application fabric corresponds to a portion of the SD-WAN operable to communicate messages associated with the first application.

In certain embodiments, descriptions and requirements related to building an intent based application fabric are presented hereinafter in view of the following processes (or steps): (<NUM>) application discovery; (<NUM>) application fabric building; (<NUM>) application monitoring; (<NUM>) application control and experience.

The Application discovery according to certain embodiments of this disclosure is to perform technical instruction(s) to identify the sites (e.g., endpoints or edge routers in <FIG> and <FIG>) where business critical applications are hosted and track the user conversations/sessions between the sites and build an application fabric (e.g., intent based application fabric) based on this information with real time monitoring view. The certain embodiments enable one or more applications that need the application fabric to execute technical functions, instructions or capabilities, as follows:.

Once the applications (e.g., the specific application of "Remote Surgery" presented in the descriptions related to <FIG>) are selected, this information is propagated by a management controller (e.g., Manager <NUM> shown in <FIG> and <FIG>) of SD-WAN to all sites or the specific sites as desired by a customer. Specific sites are relevant when the customer is interested in optimizing say Webex only in selected sites.

Edge devices will make use of existing Application identification module (NBAR2, Cosmos) to observe the traffic and match against the applications selected in Fabric list. If there is a match, application metadata is collected at the site and is advertised in the smart controller (e.g., Controllers/vSmart) which include {Site, flow information - src, dst, tunnel, time, volume, performance}. Application signatures may be deployed on many edge devices, where some edge devices may not be part of an application fabric yet because of no application traffic seen on that edge device or administrator may not have excluded through some policy.

ENCS Branch case: When the customer installs an Application at different sites, on the virtual platform with Application Fabric option selected in vManage, Fabric policy is pushed and using NBAR2/SD-AVC applications metadata is advertised from the sites where the app is hosted.

Application metadata will be advertised via OMP (Overlay Management Protocol) protocol as a protocol extension, there by Controllers like vSmart can build Application overlay across sites for the said application. Each Application which is hosted at sites will have separate overlay fabric and needs its own bandwidth and QoS. These App requirements are pre-configured on vManage so all sites hosting this application will be aware of Application fabric needs.

When Auto Application discovery is selected, Applications belonging to certain Category may be grouped like "Corporate Communication Applications" which may include say WebEx, Skype, Zoom etc. and Fabric will also have individual App Fabric view also i.e., show me only WebEx Fabric. If needed Application can build Dynamic Tunnels between the sites for the said Applications. Once the Application Fabric is built by the Controllers, Application fabric specific Policies like "Reserve BW for this applications across sites say <NUM>,<NUM>,<NUM> from time say <NUM>:00am to <NUM>:00pm tomorrow" can be pushed with ease.

Constant vAnalytics (i.e., a leading analytics application for video collaboration) monitoring would indicate if Applications topology on the overlay has the minimum requirement met in the Fabric Overlay. If the requirement is not met, the performance of application across the sites will be sub-optimal and necessary recovery actions like Application priority and BW reservations should be provided. Once a case where application packet drops are witnessed takes place, in such a case more bandwidth on the IPSEC tunnels between sites along the path for that Application(s) is allowed to be reserved or assigned.

Monitoring of Application is done depending on whether to satisfy App fabric SLA. Newer Application that needs to be hosted across sites, will first consult the SD-WAN controller and determine if there is enough bandwidth available on SD-WAN overlay to satisfy the application requirements. Monitoring of Application that a customer is interested in may happen at non-application fabric edge devices for purpose of visibility.

The exemplary method and system are to perform the technical functions or instruction related to Application Experience, as follows:.

Application experience is performed by the exemplary method and system, and can be achieved at a granular level in certain cases. For examples, a video conferencing is used by many user groups but based on the Application Fabric monitoring, if a specific group of users need to be prioritized then "SGT" based Policies can be authored for the Application Fabric. For example: "Video conferencing sessions for the Doctors/Surgery rooms" is of higher priority than others video conferences for staff meetings.

The exemplary method and system are to also perform the technical functions or instruction related to Application Control, as follows:.

In some embodiments, a computing system comprises one or more end devices (or branch devices, or edge routers) configured to define one or more applications based on a user preference, provide a pre-defined list including the one or more application, select a specific application from the pre-defined list, and enable the specific application to select one or more fabric options. The computing system further comprises a first controller configured to propagate information for selecting the specific application to one or more specific sites. The computing system further comprises a second controller configured to build an application overlay for the specific application across the specific sites and advertise a metadata of the specific application to the one or more branch devices. The computing system further comprises one or more edge devices configured to observe a traffic, the traffic against the application selected in a fabric list, and collect metadata of the specific application. The computing system executes one or more processes including a first process for performing an application discovery to identify one or more endpoints and track sessions established between the endpoints, a second process for performing an application fabric building based on information on the identified endpoints and the tracked sessions, a third process for performing an application monitoring based on predetermined requirements for a fabric overlay in a soft defined network system, and a fourth process for performing application control and experience by determining a degree for quality of service (QoS) and reserving a demand bandwidth based on type of application traffic.

<FIG> illustrates an example of components of computing system <NUM>, in accordance with certain embodiments. In particular embodiments, computing system <NUM> may be implemented as manager <NUM>, a controller <NUM>, an edge router (e.g., <NUM>-<NUM> or <NUM>-<NUM>), an end device, or other suitable computing system for performing functionality disclosed herein. In particular embodiments, one or more computer systems <NUM> perform one or more steps of one or more methods described or illustrated herein. In particular embodiments, one or more computer systems <NUM> provide functionality described or illustrated herein. In particular embodiments, software running on one or more computer systems <NUM> performs one or more steps of one or more methods described or illustrated herein or provides functionality described or illustrated herein. Particular embodiments include one or more portions of one or more computer systems <NUM>. Herein, reference to a computer system may encompass a computing device, and vice versa, where appropriate. Moreover, reference to a computer system may encompass one or more computer systems, where appropriate.

As an example, and not by way of limitation, one or more computer systems <NUM> may perform in real time or in batch mode one or more steps of one or more methods described or illustrated herein.

In particular embodiments, computer system <NUM> includes one or more processor(s) <NUM>, memory <NUM>, storage <NUM>, input/output (I/O) interface(s) <NUM>, communication interface(s) <NUM>, and/or bus (or busses) <NUM>.

In particular embodiments, processor <NUM> includes hardware for executing instructions, such as those making up a computer program. As an example, and not by way of limitation, to execute instructions, processor <NUM> may retrieve (or fetch) the instructions from an internal register, an internal cache, memory <NUM>, or storage <NUM>; decode and execute them; and then write one or more results to an internal register, an internal cache, memory <NUM>, or storage <NUM>. In particular embodiments, processor <NUM> may include one or more internal caches for data, instructions, or addresses. This disclosure contemplates processor <NUM> including any suitable number of any suitable internal caches, where appropriate. As an example, and not by way of limitation, processor <NUM> may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). Instructions in the instruction caches may be copies of instructions in memory <NUM> or storage <NUM>, and the instruction caches may speed up retrieval of those instructions by processor <NUM>. Data in the data caches may be copies of data in memory <NUM> or storage <NUM> for instructions executing at processor <NUM> to operate on; the results of previous instructions executed at processor <NUM> for access by subsequent instructions executing at processor <NUM> or for writing to memory <NUM> or storage <NUM>; or other suitable data. The data caches may speed up read or write operations by processor <NUM>. The TLBs may speed up virtual-address translation for processor <NUM>. In particular embodiments, processor <NUM> may include one or more internal registers for data, instructions, or addresses. This disclosure contemplates processor <NUM> including any suitable number of any suitable internal registers, where appropriate. Where appropriate, processor <NUM> may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors <NUM>. Although this disclosure describes and illustrates a particular processor, this disclosure contemplates any suitable processor.

In particular embodiments, memory <NUM> includes main memory for storing instructions for processor <NUM> to execute or data for processor <NUM> to operate on. As an example, and not by way of limitation, computer system <NUM> may load instructions from storage <NUM> or another source (such as, for example, another computer system <NUM>) to memory <NUM>. Processor <NUM> may then load the instructions from memory <NUM> to an internal register or internal cache. To execute the instructions, processor <NUM> may retrieve the instructions from the internal register or internal cache and decode them. During or after execution of the instructions, processor <NUM> may write one or more results (which may be intermediate or final results) to the internal register or internal cache. Processor <NUM> may then write one or more of those results to memory <NUM>. In particular embodiments, processor <NUM> executes only instructions in one or more internal registers or internal caches or in memory <NUM> (as opposed to storage <NUM> or elsewhere) and operates only on data in one or more internal registers or internal caches or in memory <NUM> (as opposed to storage <NUM> or elsewhere). One or more memory buses (which may each include an address bus and a data bus) may couple processor <NUM> to memory <NUM>. Bus <NUM> may include one or more memory buses, as described below. In particular embodiments, one or more memory management units (MMUs) reside between processor <NUM> and memory <NUM> and facilitate accesses to memory <NUM> requested by processor <NUM>. In particular embodiments, memory <NUM> includes random access memory (RAM). This RAM may be volatile memory, where appropriate. Where appropriate, this RAM may be dynamic RAM (DRAM) or static RAM (SRAM). Moreover, where appropriate, this RAM may be single-ported or multi-ported RAM. This disclosure contemplates any suitable RAM. Memory <NUM> may include one or more memories <NUM>, where appropriate. Although this disclosure describes and illustrates particular memory, this disclosure contemplates any suitable memory.

As an example, and not by way of limitation, storage <NUM> may include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disc, a magneto-optical disc, magnetic tape, or a Universal Serial Bus (USB) drive or a combination of two or more of these.

As an example, and not by way of limitation, an I/O device may include a keyboard, keypad, microphone, monitor, mouse, printer, scanner, speaker, still camera, stylus, tablet, touch screen, trackball, video camera, another suitable I/O device or a combination of two or more of these.

In particular embodiments, communication interface <NUM> includes hardware, software, or both providing one or more interfaces for communication (such as, for example, packet-based communication) between computer system <NUM> and one or more other computer systems <NUM> or one or more networks. In particular embodiments, communication interface <NUM> may facilitate communication between computer system <NUM> and manager <NUM>, controller <NUM>, edge router (e.g., <NUM>-<NUM> or <NUM>-<NUM>), or an end device. As an example, and not by way of limitation, communication interface <NUM> may include a network interface controller (NIC) or network adapter for communicating with an Ethernet or other wire-based network or a wireless NIC (WNIC) or wireless adapter for communicating with a wireless network, such as a WI-FI network. This disclosure contemplates any suitable network and any suitable communication interface <NUM> for it. As an example, and not by way of limitation, computer system <NUM> may communicate with an ad hoc network, a personal area network (PAN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), or one or more portions of the Internet or a combination of two or more of these. One or more portions of one or more of these networks may be wired or wireless. As an example, computer system <NUM> may communicate with a wireless PAN (WPAN) (such as, for example, a BLUETOOTH WPAN), a WI-FI network, a WI-MAX network, a cellular telephone network (such as, for example, a Global System for Mobile Communications (GSM) network, a Long-Term Evolution (LTE) network, or a <NUM> network), or other suitable wireless network or a combination of two or more of these. Computer system <NUM> may include any suitable communication interface <NUM> for any of these networks, where appropriate. Communication interface <NUM> may include one or more communication interfaces <NUM>, where appropriate. Although this disclosure describes and illustrates a particular communication interface, this disclosure contemplates any suitable communication interface.

In summary, in one embodiment, a method includes providing a first profile to a plurality of edge routers of the SD-WAN, the plurality of edge routers operable to interface a plurality of devices to the SD-WAN. The first profile enables the plurality of edge routers to discover which devices of the plurality of devices support a first application. The method includes receiving, from one or more of the edge routers, information indicating which devices of the plurality of devices support the first application and building a first application fabric based on the information indicating which devices of the plurality of devices support the first application.

Claim 1:
A method for use by a controller of a software-defined wide area network, SD-WAN, the method comprising:
providing (<NUM>, <NUM>) a first profile to a plurality of edge routers of the SD-WAN, the plurality of edge routers operable to interface a plurality of devices to the SD-WAN, wherein the first profile enables the plurality of edge routers to discover which devices of the plurality of devices support a first application;
receiving (<NUM>, <NUM>), from one or more of the edge routers, information indicating which devices of the plurality of devices support the first application; and
building (<NUM>, <NUM>) a first application fabric based on the information indicating which devices of the plurality of devices support the first application, wherein the first application fabric corresponds to a portion of the SD-WAN operable to communicate messages associated with the first application.