Patent Description:
Enterprise Software-Defined (SD)-Wide Area Network (WAN) (SD-WAN) fabrics are made up of edge routers with multiple virtual private networks (VPNs) utilizing point-to-point encryption overlay tunnels (e.g., IPsec). These tunnels traverse one or more underlay networks utilizing a variety of connection methods (e.g., dedicated MPLS links, broadband internet or cellular networks). Edge routers and intermediate routers within an SD-WAN may apply SD-WAN policies to a data packet while the data packet is routed from the source to the destination. The SD-WAN policies may be determined based on a source group to which the source node belongs and/or a destination group to which the destination node belongs.

<CIT> relates to the field of computer networking and, more particularly, to techniques for smart mapping between the overlay and the underlay networks. <CIT> relates to techniques for optimizing egress tunnel router failure scenarios in intelligent wide area networks.

In particular embodiments, a first network node configured to operate at a first site of a network may receive a data packet from a first host located in the first site. The data packet may be destined to a second host located in a second site that may be different from the first site. The first network node may determine that an identity of a second group to which the second host belongs is not available at the first network node. The first network node may, in response to the determination, send a request for an identifier of the second group to a second network node. The request may comprise an address of the second host. The first network node may receive a response comprising the identifier of the second group from the second network node. The first network node may determine that the second group is a destination group based on the received identifier. The first network node may apply one or more policies associated with the destination group to the data packet. The first network node may cause the data packet to be routed to the second host.

<FIG> illustrates an example architecture of an SD-WAN. In particular embodiments, a network <NUM> may be a Software-Defined (SD)-Wide Area Network (WAN) which is a virtual overlay network based on tunnels that carry traffic between a plurality of sites over one or more underlay networks <NUM>. The example illustrated in <FIG> shows two sites: a first site <NUM> and a second site <NUM>. Each site may connect to the network <NUM> via one or more WAN-edge routers. For example, the first site <NUM> connects to the network <NUM> through an edge router <NUM>, and the second site <NUM> connects to the network <NUM> through an edge router <NUM>. A site connected to the network <NUM> may have a data plane connection to each of the other sites through Internet Protocol Security (IPSec) tunnels. The edge routers <NUM> and <NUM> may have a data plane connection over the underlay network <NUM>. The underlay network <NUM> may comprise Multiprotocol Label Switching (MPLS), Internet, and cellular networks. An SD-WAN control plane may comprise a controller <NUM> that may maintain a centralized routing table and the routing policies to program the forwarding behavior of the data plane. The controller <NUM> may maintain direct control plane connection to each edge router. The controller <NUM> may provision, maintain, and secure the entire overlay network. The SD-WAN network <NUM> may also comprise management/orchestration plane <NUM>. Although this disclosure describes a SD-WAN network in a particular manner, this disclosure contemplates a SD-WAN network in any suitable manner.

In particular embodiments, the first site may comprise a first host. The first host may belong to a first group. A switch to which the first host is connected may learn an identifier of the first group. The switch may add the identifier of the first group as a source group to data packets originated from the first host. In particular embodiments, the switch may learn the identifier of the first group using one of one or more dynamic mechanisms. In particular embodiments, the first host may perform an authentication procedure. The switch may learn the identifier of the first group during the authentication procedure of the first host.

<FIG> illustrates an example authentication procedure for a host. As an example and not by way of limitation, illustrated in <FIG>, a first host <NUM> may be activated at step <NUM>. The switch <NUM> may detect the first host <NUM> and may enable a port connected to the first host <NUM> in an "unauthorized" state. The "unauthorized" state may only allow <NUM>. 1X traffic, while other traffic may be dropped. At step <NUM>, the switch <NUM> may initiate an authentication by periodically transmitting Extensible Authentication Protocol (EAP)-Request Identity frames to a special Layer <NUM> address (<NUM>:<NUM>:C2:<NUM>:<NUM>:<NUM>) on the local network segment. The first host <NUM> may listen on this address. On receipt of the EAP-Request Identity frame, the first host <NUM> may, at step <NUM>, respond with an EAP-Response Identity frame containing an identifier for the first host <NUM> such as a User ID. At step <NUM>, the switch <NUM> may encapsulate the Identity response received from the first host <NUM> in a RADIUS Access-Request packet and may forward the RADIUS Access-Request packet to an authentication server <NUM>. At step <NUM>, the authentication server <NUM> may send a reply (encapsulated in a RADIUS Access-Challenge packet) to the switch <NUM>. At step <NUM>, the switch <NUM> may encapsulate the EAP Request in an EAP Over LAN (EAPOL) frame and transmit the EAPOL frame to the first host <NUM>. At step <NUM>, the first host <NUM> may send an EAP response to the switch. At step <NUM>, the switch may encapsulate the received EAP Response in a RADIUS Access-Request packet and forward the RADIUS Access-Request packet to the authentication server <NUM>. At step <NUM>, the authentication server may respond with either an EAP-Success message (encapsulated in a RADIUS Access-Accept packet). The EAP-Success message may comprise an identifier of a first group to which the first host belongs. The switch <NUM> may learn the identifier of the first group from the EAP-Success message. The switch <NUM> may forward the EAP-Success message to the first host <NUM> at step <NUM>. On receiving the EAP-Success, the switch <NUM> may set the port to the "authorized" state and may allow normal traffic. The switch <NUM> may add the identifier of the first group to data packets originated from the first host <NUM>. In particular embodiments, the switch <NUM> may learn the identifier of the first group using one of one or more static mechanisms. In particular embodiments, the switch <NUM> may maintain a mapping table between IP addresses and their corresponding groups. The switch <NUM> may learn the identifier of the first group based on an IP address associated with the first host <NUM>. Although this disclosure describes learning an identifier of a group to which the first host belongs in a particular manner, this disclosure contemplates learning an identifier of a group to which the first host belongs in any suitable manner.

In particular embodiments, the first network node <NUM> may receive a data packet from a first host <NUM> located in the first site <NUM>. The data packet may be destined to a second host <NUM> located in a second site <NUM>. The first site <NUM> may be apart from the second site <NUM>. The first site <NUM> and the second site <NUM> may be connected through the SD-WAN network <NUM>. The switch <NUM> connected to the first host <NUM> may add the identifier of the first group as the source group to the data packet, thus the data packet may comprise the identifier of the first group. The first network node <NUM> may update local database with a mapping of an IP address of the first host <NUM> and the identifier of the first group in the data packet. As an example and not by way of limitation, the first host <NUM> located in the first site <NUM> may belong to an HR group in an enterprise. The group identifier for the HR group may be <NUM>. The first host <NUM> may send a data packet to the second host <NUM> located in the second site <NUM>. The second host <NUM> may belong to an engineering group in the enterprise. The group identifier for the engineering group may be <NUM>. The switch <NUM> connected to the first host <NUM> may add the group identifier <NUM> to the data packet. The data packet may arrive at the source edge router <NUM> that connect the first site <NUM> to the SD-WAN network <NUM>. The source edge router <NUM> may update the local database with a mapping of the IP address of the first host <NUM> and the group identifier <NUM> for the HR group. Although this disclosure describes receiving a data packet comprising a source group identifier in a particular manner, this disclosure contemplates receiving a data packet comprising a source group identifier in any suitable manner.

In particular embodiments, the first network node <NUM> may determine that an identity of a second group is not available at the first network node <NUM>, where the second group is a group to which the second host <NUM> belongs. In particular embodiments, the first network node <NUM> may determine whether the identity of the second group is available at the first network node <NUM> by searching a local database at the first network node <NUM>. As an example and not by way of limitation, continuing with a prior example, the source edge router <NUM> may try to determine the identifier of the second group upon receiving the data packet from the first host <NUM> to the second host <NUM>. The source edge router <NUM> may look-up the IP address of the second host <NUM> to identify the identifier of the second group. The source edge router <NUM> may determine that the identifier for the second group is not available when no record for the IP address of the second host exists in the local database. Although this disclosure describes determining that an identifier for the destination group of a data packet is not available at the source edge router in a particular manner, this disclosure contemplates determining that an identifier for the destination group of a data packet is not available at the source edge router in any suitable manner.

In particular embodiments, the first network node <NUM> may, in response to the determination, send a request for an identifier of the second group to a second network node. The request may comprise an address of the second host. Although this disclosure describes sending a request for an identifier for a destination group in a particular manner, this disclosure contemplates sending a request for an identifier for a destination group in any suitable manner.

<FIG> illustrates an example flow for fetching a destination group from a destination edge router. In the example illustrated in <FIG>, the first host <NUM> may send a data packet to the second host <NUM>. The first host <NUM> may be located in the first site <NUM>. The second host <NUM> may be located in the second site <NUM>. The first host <NUM> may belong to an HR group in an enterprise. The group identifier for the HR group may be <NUM>. The second host <NUM> may belong to an engineering group in the enterprise. The group identifier for the engineering group may be <NUM>. At step <NUM>, the data packet may be forwarded to the switch <NUM> that is connected to the first host <NUM>. The switch <NUM> may add the identifier <NUM> for the HR group to the data packet. The switch <NUM> may have learned the identifier for the HR group during the authentication procedure of the first host <NUM>. At step <NUM>, the switch <NUM> may forward the data packet to the source edge router <NUM> that connects the first site <NUM> to the SD-WAN network <NUM>. The data packet may comprise the identifier <NUM> for the HR group.

In particular embodiments, the second network node may be a WAN-edge router <NUM> configured to operate at the second site <NUM>. The second network node may determine the identifier of the second group by communicating with a local fabric control plane <NUM> associated with the second site <NUM>. The source edge router <NUM> may receive a response comprising the identifier of the second group from the second edge router <NUM>. The source edge router <NUM> may determine that the second group is a destination group based on the received identifier. As an example and not by way of limitation, continuing with a prior example illustrated in <FIG>, the source edge router <NUM> may send a control message to the destination side WAN-edge router <NUM>. The control message may comprise a destination IP address of the data packet at step <NUM>. The destination edge router <NUM> may look-up its local database to find an identity of a destination group to which the second host <NUM> belongs. If the destination group is not available in the local database, the destination edge router <NUM> may query a local fabric control plane controller <NUM> at step <NUM>. The local fabric control plane controller <NUM> may have learned the destination group identifier <NUM> for the engineering group from an authentication server <NUM> located in the second site <NUM>. At step <NUM>, the local fabric control plane controller <NUM> may send a response to the destination edge router <NUM>. At step <NUM>, the destination edge router may send a control message to the source edge router <NUM>, where the control message may comprise the identifier <NUM> for the engineering group. Upon receiving the control message, the source edge router <NUM> may determine that the engineering group is the destination group. As the source edge router <NUM> knows both the source group identity and the destination group identity, the source edge router <NUM> may apply one or more appropriate policies to the data packet. The source edge router <NUM> may forward the data packet to the destination edge router <NUM> through the underlay network <NUM>. The destination edge router <NUM> may forward the data packet to the switch <NUM> connected to the second host <NUM> at step <NUM>. The switch <NUM> may forward the data packet to the second host <NUM> at step <NUM>. Although this disclosure describes fetching a destination group identifier from a destination edge router in a particular manner, this disclosure contemplates fetching a destination group identifier from a destination edge router in any suitable manner.

In particular embodiments, the request sent at step <NUM> and the response sent at step <NUM> may be control messages sent over Orderly Management Protocol (OMP). OMP is a newly introduced protocol that forms the heart of an overlay network. OMP is a protocol that runs inside the Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS) tunnels formed between the edge router and control plane controller. OMP is control protocol that is used to exchange the routing, policy, and management information between the controllers and edge routers in the overlay network. Although this disclosure describes sending control messages in a particular manner, this disclosure contemplates sending control messages in any suitable manner.

In particular embodiments, the request sent at step <NUM> and the response sent at step <NUM> may be control messages sent over WebSocket. WebSocket is a communications protocol, providing full-duplex communication channels over a single TCP connection. WebSocket enables streams of messages on top of TCP. TCP alone deals with streams of bytes with no inherent concept of a message. Although this disclosure describes sending control messages in a particular manner, this disclosure contemplates sending control messages in any suitable manner.

In particular embodiments, the second network node may be an SD-WAN fabric control plane controller <NUM>. The second network node may maintain group identifiers associated with hosts in the network. The first network node <NUM> may receive a response comprising the identifier of the second group from the second network node. <FIG> illustrates an example flow for fetching a destination group from an SD-WAN fabric control plane. As an example and not by way of limitation, illustrated in <FIG>, a controller <NUM> within the SD-WAN fabric control plane may receive information associated with the identifier of the first group associated with the first host <NUM> from the authentication server <NUM> in the first site <NUM> when the first host <NUM> performs an authentication procedure. The controller <NUM> may receive information associated with the identifier of the second group associated with the second host <NUM> from the authentication server <NUM> in the second site <NUM> when the second host <NUM> performs an authentication procedure. When the first host <NUM> sends a data packet to the second host <NUM>, the data packet may be forwarded to the switch <NUM> connected to the first host <NUM> at step <NUM>. The switch <NUM> may add the identifier of the first group as the source group to the data packet and forward the data packet to the source edge router <NUM> at step <NUM>. The source edge router <NUM> may try to determine an identifier for the destination group by looking up the IP address of the second host <NUM>, the destination host, in the local database. If the source edge router <NUM> fails to find a record for the IP address of the second host <NUM>, the source edge router <NUM> may send a request to the controller <NUM> in the SD-WAN fabric control plane at step <NUM>. The request may comprise the IP address of the destination host, i.e., the second host <NUM>. The controller <NUM> may find an identifier for the second group from its own database. The controller <NUM> may respond with the identifier for the second group to the source edge router <NUM> at step <NUM>. The request and the response at step <NUM> and step <NUM> may be control plane messages. The source edge router <NUM> may determine that the second group is the destination group based on the received identifier. The source edge router <NUM> may determine policies corresponding to the data packet based on the destination group identity. In particular embodiments, the source edge router <NUM> may determine policies corresponding to the data packet based on the first group identity. The source edge router <NUM> may apply the determined policies to the data packet. At step <NUM>, the source edge router <NUM> may cause the data packet to be delivered to the destination edge router <NUM> through the underlay network <NUM>. The destination edge router <NUM> may try to determine the destination group identity by looking up the IP address of the destination host, i.e., the second host <NUM> in its local database. If the destination edge router <NUM> fails to look up the destination IP address in the local database, the destination edge router <NUM> may send a request to the controller <NUM>, which is not shown in <FIG>. The destination edge router <NUM> may determine policies corresponding to the data packet based on the destination group identity. In particular embodiments, the destination edge router <NUM> may determine policies corresponding to the data packet based on the source group identity. The destination edge router <NUM> may apply the policies to the data packet. At step <NUM>, the destination edge router <NUM> may forward the data packet to the switch <NUM> connected to the second host <NUM>. At step <NUM>, the switch may forward the data packet to the second host <NUM>. Although this disclosure describes fetching a destination group identifier from an SD-WAN fabric control plane in a particular manner, this disclosure contemplates fetching a destination group identifier from an SD-WAN fabric control plane in any suitable manner.

In particular embodiments, the first network node <NUM> may determine one or more policies corresponding to the data packet. In particular embodiments, the one or more policies may be associated with a destination group. In particular embodiments, the one or more policies may be associated with a source group. The first network node <NUM> may apply the one or more policies to the data packet. <FIG> illustrates an example determination of policies for a data packet. As an example and not by way of limitation, illustrated in <FIG>, the source edge router <NUM> may utilize a policy engine <NUM> to determine one or more policies corresponding to a data packet. In particular embodiments, the policy engine <NUM> may be within the source edge router <NUM>. In particular embodiments, the policy engine <NUM> may be located remote from the source edge router <NUM>. The source edge router <NUM> may provide an identifier for the source group corresponding to the data packet to the policy engine <NUM> as an input. The source edge router <NUM> may provide an identifier for the destination group corresponding to the data packet to the policy engine <NUM> as an input. The policy engine <NUM> may produce one or more policies corresponding to the data packet. The one or more policies may comprise an admission control, a routing-path selection, security policies, a Quality of Service (QoS) service, and a traffic policing. The source edge router <NUM> may apply the determined one or more policies to the data packet. Any router in the routing path within the SD-WAN network <NUM> may determine one or more policies corresponding to the data packet and apply the one or more policies to the data packet. Although this disclosure describes determining one or more policies corresponding to a data packet and applying the policies to the data packet in a particular manner, this disclosure contemplates determining one or more policies corresponding to a data packet and applying the policies to the data packet in any suitable manner.

In particular embodiments, the one or more policies may comprise an admission control. The network <NUM> may restrict traffic to access the network based on a source group identity, based on a destination group identity, or based on a combination of the source group and the destination group. As an example and not by way of limitation, the policy engine <NUM> may reject the data packet from being routed through the SD-WAN network <NUM> based on the determined source group identity and/or the determined destination group identity. Then, the source router <NUM> may drop the data packet without causing the data packet to be routed through the SD-WAN network <NUM>. Although this disclosure describes enforcing an admission control policy to a data packet in a particular manner, this disclosure contemplates enforcing an admission control policy to a data packet in any suitable manner.

In particular embodiments, the one or more policies may comprise a routing-path selection. The routing-path selection may be performed based on the destination group identity. In particular embodiments, the routing-path selection may be performed based on the source group identity. Dynamic routing may be one of major characteristics of SD-WAN. The first network node <NUM> may route the data packet through one of a plurality of available routing paths based on the source group identity and/or the destination group identity. As an example and not by way of limitation, the policy engine <NUM> may generate a routing path for the data packet based on the source group identity and/or the destination group identity. The source edge router <NUM> may cause the data packet to be routed through the generated routing path towards the destination edge router <NUM>. Although this disclosure describes enforcing a routing-path selection based at least on the destination group identity in a particular manner, this disclosure contemplates enforcing a routing-path selection based at least on the destination group identity in any suitable manner.

In particular embodiments, the one or more policies may comprise a security policy. The security policy may be determined based on the destination group identity. In particular embodiments, the security policy may be determined based on the source group identity. As an example and not by way of limitation, the policy engine <NUM> may generate a set of firewall rules for the data packet based on the source group identity and/or the destination group identity. The source edge router <NUM> may apply the generated firewall rules to the data packet. In particular embodiments, the source edge router <NUM> may drop the data packet if the data packet fails to meet the generated firewall rules. Although this disclosure describes enforcing a security policy to a data packet based at least on the destination group identity in a particular manner, this disclosure contemplates enforcing a security policy to a data packet based at least on the destination group identity in any suitable manner.

In particular embodiments, the one or more policies may comprise a Quality of Service (QoS) policy. The QoS policy may be determined based on the destination group identity. In particular embodiments, the QoS policy may be determined based on the source group identity. A plurality of QoS parameters may be determined based on a QoS class of the data packet. The QoS class may be determined based on the source group identity and/or the destination group identity for traffic. As an example and not by way of limitation, the policy engine <NUM> may determine that the data packet is a best-effort class traffic based on the source group identity and/or the destination group identity. The source edge router <NUM> may apply a plurality of QoS parameters associated with the best-effort class traffic to the data packet. Although this disclosure describes enforcing a QoS policy based at least on the destination group identity in a particular manner, this disclosure contemplates enforcing a QoS policy based at least on the destination group identity in any suitable manner.

In particular embodiments, the one or more policies may comprise a traffic policing that may enforce a pre-determined maximum data rate. The pre-determined maximum data rate may be determined based on the destination group identity. In particular embodiments, the pre-determined maximum data rate may be determined based on the source group identity. As an example and not by way of limitation, the policy engine <NUM> may determine that the maximum data rate for the traffic from the first group to the second group is <NUM> Mbps. The source edge router <NUM> may enforce the determined maximum data rate for traffic from the first host <NUM> to the second host <NUM>. Although this disclosure describes enforcing maximum data rate based at least on the destination group identity in a particular manner, this disclosure contemplates enforcing maximum data rate based at least on the destination group identity in any suitable manner.

In particular embodiments, the first network node <NUM> may cause the data packet to be routed to the second host <NUM>. As an example and not by way of limitation, the source edge router <NUM> may cause the data packet to be routed to the destination edge router <NUM> via one of one or more IPSec tunnels between the source edge router <NUM> and the destination edge router <NUM> through the underlay network <NUM>. Upon receiving the data packet, the destination edge router <NUM> may route the data packet toward the second host <NUM> based on local routing policies in the second site <NUM>. Although this disclosure describes causing a data packet to be routed to a destination host in a particular manner, this disclosure contemplates causing a data packet to be routed to a destination host in any suitable manner.

In particular embodiments, the first network node <NUM> may receive a second data packet destined to the first host <NUM> from the second host <NUM>. The first network node <NUM> may identify a source group identifier based on a source group identifier field in the second data packet. In particular embodiments, the first network node <NUM> may determine that the source group identifier is not identical to the second group identifier in the record. In response to the determination, the first network node <NUM> may update the identifier of the second group in the record with the source group identifier. As an example and not by way of limitation, upon receiving the first data packet from the first host <NUM>, the second host <NUM> may respond with a second data packet to the first host <NUM>. The second data packet may arrive at the first edge router <NUM> within the first site <NUM>. The first edge router <NUM> may determine a source group identifier of the second data packet based on a source group identifier filed in the second data packet. The first edge router <NUM> may compare the source group identifier of the second data packet with the second group identifier corresponding to the second host <NUM> in the local database. If the source group identifier does not match the second group identifier in the local database, the first edge router <NUM> may update the second group identifier in the local database with the source group identifier of the second data packet. Although this disclosure describes updating a group identifier for a remote host based on a data packet originated from the remote host in a particular manner, this disclosure contemplates updating a group identifier for a remote host based on a data packet originated from the remote host in any suitable manner.

<FIG> illustrates an example method <NUM> for enforcing policies based on a destination group identity at a SD-WAN edge router. The method may begin at step <NUM>, where a first network node configured to operate at a first site of a network may receive a data packet destined to a second host located in a second site from a first host located in the first site. The first site and the second site may be different. At step <NUM>, the first network node may determine whether an identity of a second group to which the second host belongs is available at the first network node. At step <NUM>, the first network node may, in response to the determination, send a request for an identifier of the second group to a second network node. The request may comprise an address of the second host. At step <NUM>, the first network node may receive a response comprising the identifier of the second group from the second network node. The first network node may determine that the second group is a destination group based on the received identifier. At step <NUM>, the first network node may apply one or more policies associated with the destination group to the data packet. At step <NUM>, the first network node may cause the data packet to be routed to the second host. Particular embodiments may repeat one or more steps of the method of <FIG>, where appropriate. Although this disclosure describes and illustrates particular steps of the method of <FIG> as occurring in a particular order, this disclosure contemplates any suitable steps of the method of <FIG> occurring in any suitable order. Moreover, although this disclosure describes and illustrates an example method for enforcing policies based on a destination group identity at a SD-WAN edge router including the particular steps of the method of <FIG>, this disclosure contemplates any suitable method for enforcing policies based on a destination group identity at a SD-WAN edge router including any suitable steps, which may include all, some, or none of the steps of the method of <FIG>, where appropriate. Furthermore, although this disclosure describes and illustrates particular components, devices, or systems carrying out particular steps of the method of <FIG>, this disclosure contemplates any suitable combination of any suitable components, devices, or systems carrying out any suitable steps of the method of <FIG>.

<FIG> illustrates an example computer system <NUM>. In particular embodiments, one or more computer systems <NUM> perform one or more steps of one or more methods described or illustrated herein. In particular embodiments, one or more computer systems <NUM> provide functionality described or illustrated herein. In particular embodiments, software running on one or more computer systems <NUM> performs one or more steps of one or more methods described or illustrated herein or provides functionality described or illustrated herein. Particular embodiments include one or more portions of one or more computer systems <NUM>. Herein, reference to a computer system may encompass a computing device, and vice versa, where appropriate. Moreover, reference to a computer system may encompass one or more computer systems, where appropriate.

In particular embodiments, processor <NUM> includes hardware for executing instructions, such as those making up a computer program. As an example and not by way of limitation, to execute instructions, processor <NUM> may retrieve (or fetch) the instructions from an internal register, an internal cache, memory <NUM>, or storage <NUM>; decode and execute them; and then write one or more results to an internal register, an internal cache, memory <NUM>, or storage <NUM>. In particular embodiments, processor <NUM> may include one or more internal caches for data, instructions, or addresses. This disclosure contemplates processor <NUM> including any suitable number of any suitable internal caches, where appropriate. As an example and not by way of limitation, processor <NUM> may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). Instructions in the instruction caches may be copies of instructions in memory <NUM> or storage <NUM>, and the instruction caches may speed up retrieval of those instructions by processor <NUM>. Data in the data caches may be copies of data in memory <NUM> or storage <NUM> for instructions executing at processor <NUM> to operate on; the results of previous instructions executed at processor <NUM> for access by subsequent instructions executing at processor <NUM> or for writing to memory <NUM> or storage <NUM>; or other suitable data. The data caches may speed up read or write operations by processor <NUM>. The TLBs may speed up virtual-address translation for processor <NUM>. In particular embodiments, processor <NUM> may include one or more internal registers for data, instructions, or addresses. This disclosure contemplates processor <NUM> including any suitable number of any suitable internal registers, where appropriate. Where appropriate, processor <NUM> may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors <NUM>. Although this disclosure describes and illustrates a particular processor, this disclosure contemplates any suitable processor.

In particular embodiments, memory <NUM> includes main memory for storing instructions for processor <NUM> to execute or data for processor <NUM> to operate on. As an example and not by way of limitation, computer system <NUM> may load instructions from storage <NUM> or another source (such as, for example, another computer system <NUM>) to memory <NUM>. Processor <NUM> may then load the instructions from memory <NUM> to an internal register or internal cache. To execute the instructions, processor <NUM> may retrieve the instructions from the internal register or internal cache and decode them. During or after execution of the instructions, processor <NUM> may write one or more results (which may be intermediate or final results) to the internal register or internal cache. Processor <NUM> may then write one or more of those results to memory <NUM>. In particular embodiments, processor <NUM> executes only instructions in one or more internal registers or internal caches or in memory <NUM> (as opposed to storage <NUM> or elsewhere) and operates only on data in one or more internal registers or internal caches or in memory <NUM> (as opposed to storage <NUM> or elsewhere). One or more memory buses (which may each include an address bus and a data bus) may couple processor <NUM> to memory <NUM>. Bus <NUM> may include one or more memory buses, as described below. In particular embodiments, one or more memory management units (MMUs) reside between processor <NUM> and memory <NUM> and facilitate accesses to memory <NUM> requested by processor <NUM>. In particular embodiments, memory <NUM> includes random access memory (RAM). This RAM may be volatile memory, where appropriate. Where appropriate, this RAM may be dynamic RAM (DRAM) or static RAM (SRAM). Moreover, where appropriate, this RAM may be single-ported or multi-ported RAM. This disclosure contemplates any suitable RAM. Memory <NUM> may include one or more memories <NUM>, where appropriate. Although this disclosure describes and illustrates particular memory, this disclosure contemplates any suitable memory.

In particular embodiments, communication interface <NUM> includes hardware, software, or both providing one or more interfaces for communication (such as, for example, packet-based communication) between computer system <NUM> and one or more other computer systems <NUM> or one or more networks. As an example and not by way of limitation, communication interface <NUM> may include a network interface controller (NIC) or network adapter for communicating with an Ethernet or other wire-based network or a wireless NIC (WNIC) or wireless adapter for communicating with a wireless network, such as a WI-FI network. This disclosure contemplates any suitable network and any suitable communication interface <NUM> for it. As an example and not by way of limitation, computer system <NUM> may communicate with an ad hoc network, a personal area network (PAN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), or one or more portions of the Internet or a combination of two or more of these. One or more portions of one or more of these networks may be wired or wireless. As an example, computer system <NUM> may communicate with a wireless PAN (WPAN) (such as, for example, a BLUETOOTH WPAN), a WI-FI network, a WI-MAX network, a cellular telephone network (such as, for example, a Global System for Mobile Communications (GSM) network, a Long-Term Evolution (LTE) network, or a <NUM> network), or other suitable wireless network or a combination of two or more of these. Computer system <NUM> may include any suitable communication interface <NUM> for any of these networks, where appropriate. Communication interface <NUM> may include one or more communication interfaces <NUM>, where appropriate. Although this disclosure describes and illustrates a particular communication interface, this disclosure contemplates any suitable communication interface.

In summary, in one embodiment, a method includes receiving a data packet from a first host located in the first site, where the data packet may be destined to a second host located in a second site that may be different from the first site, sending a request for an identifier of the second group to a second network apparatus, where the request may comprise an address of the second host, receiving a response comprising the identifier of the second group from the second network apparatus, determining that the second group is a destination group, applying one or more policies associated with the destination group to the data packet, and causing the data packet to be routed to the second host.

Claim 1:
A method comprising, by a first network apparatus configured to operate at a first site of a network:
receiving (<NUM>), from a first host located in the first site, a data packet destined to a second host located in a second site, wherein the first site and the second site are different, and wherein the data packet comprises an identifier of a first group to which the first host belongs;
determining, based on the identifier of the first group in the data packet, that the first group is a source group;
determining (<NUM>) that an identity of a second group to which the second host belongs is not available at the first network node;
sending (<NUM>), to a second network apparatus, a request for an identifier of the second group to which the second host belongs, wherein the request comprises an address of the second host;
in response to sending the request for the identity of the second group, receiving (<NUM>), from the second network apparatus, a response comprising the identifier of the second group;
determining, based on the received identifier, that the second group is a destination group;
applying (<NUM>), to the data packet, one or more policies determined based on a combination of the source group and the destination group; and
causing (<NUM>) the data packet to be routed to the second host.