DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 5/28/2024 was filed in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites “receiving a packet at the first node within the first stateless VPN; transmitting the packet from the first node; and receiving the packet at the first node from the second node after the packet was received at the second node as return traffic” However, it is not clear how the same transmitted packet, i.e., “transmitting the packet from the first node”, is received, “receiving the packet at the first node”. Therefore, the metes and bounds of claim are not clear.
Similarly, Claims 8 and 15 recite the similar issue.
Claims 2-7, 9-14, and 16-20 are rejected for their dependency to claims 1, 8, and 15.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-3, 5-10, 12-17 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over Xie et al. (US20180246791A1, hereinafter Xie) in view of Cisco (Cisco SD-WAN Design Guide, hereinafter Cisco) and Duan et al. (US20210306261A1 hereinafter Duan).
For claim 1, Xie teaches a method comprising ([Para. 0014], Methods are described for an improved architecture and design of high-availability clusters): establishing, by a first node of a high availability cluster (HA cluster), a first stateless virtual private network (first stateless VPN) designating the first node as an active node and designating a second node of the HA cluster as a standby node ([Para. 0034] and [FIG. 2], network device 202 a can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 a and can be further configured to form a backup connection with a disabled interface of cluster unit 206 b. [Examiner’s Note: Cluster unit 206 a is the first node and 206 b the second node. The connections constitute the first VPN as Cisco teaches below]. [Para. 0040], in each HA cluster, one cluster unit 206 can be configured as a master unit 206. [Para. 0011], master cluster unit 106 a operates in its normal master mode to process traffic from one or more computing devices 102 and assigns one or more of other computing devices 102 to slave cluster unit 106 b [Examiner’s Note: Cluster unit 206 a can be the master unit. That the master unit assigns network devices to cluster units indicates that the master unit such as cluster unit 206 a establishes the active and backup connections with cluster units 206 a and 206 b]), establishing, by the first node of the HA cluster, a second stateless VPN designating the first node as the standby node and the second node as the active node ([Para. 0037] and [FIG. 2], network device 202 b can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 b and can be further configured to form a backup connection with a disabled interface of cluster unit 206 a. [Para. 0011], master cluster unit 106 a operates in its normal master mode to process traffic from one or more computing devices 102 and assigns one or more of other computing devices 102 to slave cluster unit 106 b [Examiner’s Note: The connections constitute the second VPN]), receiving a packet at the first node within the first stateless VPN ([Para. 0035], When first cluster unit 206 a fails, disabled interface of second cluster unit 206 b is enabled and backup connection of unit 206 b is used causing all subsequent packets originated by network device 202 a to be transmitted onto external network 204 a to be received and processed by second cluster unit 206 b. [Para. 0036], when cluster unit 206 a regains operations, the then disabled interface of cluster unit 206 a is enabled and device 202 a automatically starts sending or receiving traffic to/from Internet 204 a by disabling the interface of cluster unit 206 b [Examiner’s Note: Cluster unit 206 a receives packets from device 202 a]), transmitting the packet from the first node ([Para. 0035], When first cluster unit 206 a fails, disabled interface of second cluster unit 206 b is enabled and backup connection of unit 206 b is used causing all subsequent packets originated by network device 202 a to be transmitted onto external network 204 a to be received and processed by second cluster unit 206 b. [Para. 0036], when cluster unit 206 a regains operations or is able to access external network 204 a, the then disabled interface of cluster unit 206 a is enabled and device 202 a automatically starts sending or receiving traffic to/from Internet 204 a by disabling the interface of cluster unit 206 b [Examiner’s Note: Cluster unit 206 a sends packets to network 204 a]).
Although teaching establishing VPNs with active and standby nodes and transmitting packets from the active node, Xie does not explicitly disclose and receiving the packet at the first node from the second node after the packet was received at the second node as return traffic,
Cisco teaches and receiving the packet at the first node from the second node after the packet was received at the second node as return traffic ([Page 65, second and fourth paragraphs], WAN Edge Deployment. A second WAN Edge router is recommended to be added for redundancy. IPsec-encapsulated tunnels encrypt data traffic to other WAN Edge router locations, User traffic originating from the service VPNs is directed to the tunnels. [Page 15, TLOC section], A Transport Location (TLOC) is the attachment point where a WAN Edge router connects to the WAN transport network. [Page 68, second paragraph] and [FIG. 59], TLOC extensions allow each WAN Edge router to access the opposite transport through a TLOC-extension interface on the neighboring WAN Edge router. WAN Edge 1 connects directly to the MPLS transport and uses the TLOC extension interface on WAN Edge 2 to connect to the INET transport. WAN Edge 2 connects directly to the INET transport and uses the TLOC extension interface on WAN Edge 1 to connect to the Multiprotocol Label Switching (MPLS) transport. [Page 70, second paragraph] and [FIG. 61], If subnet A is in a private address space, then NAT should be configured on WAN Edge 2’s ge0/4 transport interface to ensure traffic can be routed back from the Internet to WAN Edge 1 over the TLOC Extension [Examiner’s Note: That traffic is routed back over subnet A indicates the traffic is the return packets received at the second node and forwarded to the first node by the second node]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie, so that the return traffic received at the redundant router is forwarded to the transmitting edge router, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture is facing (Cisco [Page 3, second and third paragraphs]).
Although Xie and Cisco teach that the traffic routed back to the first node is the return packets received at the second node, Dan more specifically discloses and receiving the packet at the first node from the second node after the packet was received at the second node as return traffic.
Duan is directed to providing avoiding asymmetric routing in an SD-WAN by dynamically setting BGP attributes within routing information advertised by an SD-WAN appliance. More specifically, Duan teaches and receiving the packet at the first node from the second node after the packet was received at the second node as return traffic ([Para. 0003], An SDWAN controller congregates parallel links to offer intelligent load balance schemes. However, sometimes the existence of parallel links results in asymmetric routing, a situation where a packet traverses one path from a source to a destination and takes a different path while returning traffic from the destination to the source. Such asymmetric routing is generally undesired for stateful-based network functionalities. [Para. 0049], Border Gateway Protocol (BGP) daemons of upstream SDWAN devices configure their respective local route-maps based on the received routing information to facilitate appropriate routing of upstream and downstream network traffic. The return route selected by the upstream SDWAN device will be the preferred route selected by the controller [Examiner’s Note: Duan teaches that return packets may be received a SDWAN device different the uplink upstream SDWAN]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie and Cisco, so that the return packets are received at the upstream device, as taught by Duan. The modification would have avoided undesired for stateful-based network functionalities (Duan [Para. 0003]).
For claim 2, Xie, Cisco and Duan teach the method of claim 1. The references further teach wherein receiving the packet at the first node from the second node is conducted across an HA peer link of the HA cluster (Xie [Para. 0036] and [FIG. 2], data transfer settings between cluster units 206 a and 206 b is enabled through HA link(s) 208 between the cluster units. Cisco [Page 68, second paragraph] and [FIG. 59], WAN Edge 1 connects directly to the MPLS transport and uses the TLOC extension interface on WAN Edge 2 to connect to the INET transport. WAN Edge 2 connects directly to the INET transport and uses the TLOC extension interface on WAN Edge 1 to connect to the Multiprotocol Label Switching (MPLS) transport. Cisco [Page 70, second paragraph] and [FIG. 61], If subnet A is in a private address space, then NAT should be configured on WAN Edge 2’s ge0/4 transport interface to ensure traffic can be routed back from the Internet to WAN Edge 1 over the TLOC Extension).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie and Duan, so that the return traffic received at the redundant router is forwarded to the transmitting edge router, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture is facing (Cisco [Page 3, second and third paragraphs]).
For claim 3, Xie, Cisco and Duan teach the method of claim 1. The references further teach further comprising transmitting the packet out of the HA cluster with the first node after receiving the packet from the second node (Cisco [Page 8, first paragraph under Secure Direct Internet Access], Internet traffic from a branch site is backhauled to a central data center site. Cisco [Page 68, second paragraph] and [FIG. 59], WAN Edge 1 connects directly to the MPLS transport and uses the TLOC extension interface on WAN Edge 2 to connect to the INET transport. WAN Edge 2 connects directly to the INET transport and uses the TLOC extension interface on WAN Edge 1 to connect to the Multiprotocol Label Switching (MPLS) transport. Cisco [Page 70, second paragraph] and [FIG. 61], If subnet A is in a private address space, then NAT should be configured on WAN Edge 2’s ge0/4 transport interface to ensure traffic can be routed back from the Internet to WAN Edge 1 over the TLOC Extension. Cisco [Page 70, last paragraph], A very common transport combination is MPLS and Internet. MPLS can be used for business-critical traffic, while Internet can be used for bulk traffic and other data. When one transport is down, the other transport can be used to route traffic to and from the site [Examiner’s Note: That the other transport can be used to route traffic to and from the site and the sites include branch site and date center site indicates that the return traffic received at an edge router from the other edge router is transmitted from the receiving edge router to reach branch site or date center sites]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie and Duan, so that the return traffic received at the redundant router is forwarded to the other edge router and then transmitted by the other edge router to reach the branch site or data center site, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture is facing (Cisco [Page 3, second and third paragraphs]).
For claim 5, Xie, Cisco and Duan teach the method of claim 1. The references further teach further comprising determining which of the first node and the second node is the active node (Xie [Para. 0034] and [FIG. 2], network device 202 a can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 a and can be further configured to form a backup connection with a disabled interface of cluster unit 206 b. [Para. 0035], network device 202 a continues to receive and process packets for external network 204 a through its respective active connection till the time the first cluster unit 206 a remains operational [Examiner’s Note: A node is determined to be active for transmitting traffic]), receiving a packet at the first node within the first stateless VPN (Xie [Para. 0035], When first cluster unit 206 a fails, disabled interface of second cluster unit 206 b is enabled and backup connection of unit 206 b is used causing all subsequent packets originated by network device 202 a to be transmitted onto external network 204 a to be received and processed by second cluster unit 206 b. Xie [Para. 0036], when cluster unit 206 a regains operations or is able to access external network 204 a, the then disabled interface of cluster unit 206 a is enabled and device 202 a automatically starts sending or receiving traffic to/from Internet 204 a by disabling the interface of cluster unit 206 b [Examiner’s Note: Cluster unit 206 a receives packets from device 202 a]).
For claim 6, Xie, Cisco and Duan teach the method of claim 5. The references further teach wherein determining which of the first node and the second node is the active node is conducted by inspecting a label of the packet and determining that the label designates the first stateless VPN or the second stateless VPN as a VPN responsible for routing the packet (Cisco [Page 6, first paragraph] and [FIG. 2], Traffic that enters the router is assigned to a VPN When traffic is transmitted across the WAN, a label is inserted after the ESP header to identify the VPN that the user’s traffic belongs to when it reaches the remote destination [Examiner’s Note: The VPN label is after ESP header indicates that the VPN label encapsulates the packet before the packet enters VPN tunnel at the HA node. The VPN label is inspected by the destination to identify the VPN that the packet belongs to]. Xie [Para. 0034] and [FIG. 2], network device 202 a can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 a and can be further configured to form a backup connection with a disabled interface of cluster unit 206 b. Xie [Para. 0035], network device 202 a continues to receive and process packets for external network 204 a through its respective active connection till the time the first cluster unit 206 a remains operational. Xie [Para. 0037], network device 202 b can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 b and can be further configured to form a backup connection with a disabled interface of cluster unit 206 a. [Examiner’s Note: Xie teaches that for the two VPNs, the active node transmits traffic and standby node does not transmit traffic. Cisco teaches a packet is encapsulated with the VPN label designating the first or second VPN. The teaching of Xie and Cisco indicates that first node is determined to be the active node if the packet from network device 202 a carries VPN label designating the first VPN and to be transmitted by the active node]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie and Duan, so that the packets are encapsulated with VPN label designating a VPN, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture are facing (Cisco [Page 3, second and third paragraphs]).
For claim 7, Xie, Cisco and Duan teach the method of claim 1. The references further teach wherein the standby node performs packet processing on the packet (Cisco [Page 68, second paragraph] and [FIG. 59], WAN Edge 1 connects directly to the MPLS transport and uses the TLOC extension interface on WAN Edge 2 to connect to the INET transport. WAN Edge 2 connects directly to the INET transport and uses the TLOC extension interface on WAN Edge 1 to connect to the Multiprotocol Label Switching (MPLS) transport. Cisco [Page 70, second paragraph] and [FIG. 61], If subnet A is in a private address space, then NAT should be configured on WAN Edge 2’s ge0/4 transport interface to ensure traffic can be routed back from the Internet to WAN Edge 1 over the TLOC Extension [Examiner’s Note: That subnet A is in private address and NAT is configured in WAN Edge 2 indicates that NAT changes the destination address in the return packet received at WAN Edge 2 to the private address of subnet A to be received by WAN Edge 1. Changing destination address is the packet processing]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie and Duan, so that the destination IP address is changed by NAT at the redundant router to the private address of the subnet, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture is facing (Cisco [Page 3, second and third paragraphs]).
For claim 8, Xie teaches a first node of a HA cluster ([Para. 0026], An apparatus for practicing various embodiments of the present invention), the first node comprising: a storage configured to store instructions ([Para. 0026], An apparatus for practicing various embodiments of the present invention may involve storage systems containing computer program(s)); and at least one processor configured to execute the instructions and cause the at least one processor to (An apparatus for practicing various embodiments of the present invention may involve one or more computers (or one or more processors and storage systems containing computer program(s). [Para. 0024], The steps may be embodied in machine-executable instructions, which may be used to cause a general-purpose or special-purpose processor programmed with the instructions to perform the steps): establish, by a first node of a high availability cluster (HA cluster), a first stateless virtual private network (first stateless VPN) designating the first node as an active node and designating a second node of the HA cluster as a standby node ([Para. 0034] and [FIG. 2], network device 202 a can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 a and can be further configured to form a backup connection with a disabled interface of cluster unit 206 b. [Examiner’s Note: Cluster unit 206 a is the first node and 206 b the second node. The connections constitute the first VPN as Cisco teaches below]. [Para. 0040], in each HA cluster, one cluster unit 206 can be configured as a master unit 206. [Para. 0011], master cluster unit 106 a operates in its normal master mode to process traffic from one or more computing devices 102 and assigns one or more of other computing devices 102 to slave cluster unit 106 b [Examiner’s Note: Cluster unit 206 a can be the master unit. That the master unit assigns network devices to cluster units indicates that the master unit such as cluster unit 206 a establishes the active and backup connections with cluster units 206 a and 206 b]), establish, by the first node of the HA cluster, a second stateless VPN designating the first node as the standby node and the second node as the active node ([Para. 0037] and [FIG. 2], network device 202 b can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 b and can be further configured to form a backup connection with a disabled interface of cluster unit 206 a. [Para. 0011], master cluster unit 106 a operates in its normal master mode to process traffic from one or more computing devices 102 and assigns one or more of other computing devices 102 to slave cluster unit 106 b [Examiner’s Note: The connections constitute the second VPN]), receive a packet at the first node within the first stateless VPN ([Para. 0035], When first cluster unit 206 a fails, disabled interface of second cluster unit 206 b is enabled and backup connection of unit 206 b is used causing all subsequent packets originated by network device 202 a to be transmitted onto external network 204 a to be received and processed by second cluster unit 206 b. [Para. 0036], when cluster unit 206 a regains operations or is able to access external network 204 a, the then disabled interface of cluster unit 206 a is enabled and device 202 a automatically starts sending or receiving traffic to/from Internet 204 a by disabling the interface of cluster unit 206 b [Examiner’s Note: Cluster unit 206 a receives packets from device 202 a]), transmit the packet from the first node ([Para. 0035], When first cluster unit 206 a fails, disabled interface of second cluster unit 206 b is enabled and backup connection of unit 206 b is used causing all subsequent packets originated by network device 202 a to be transmitted onto external network 204 a to be received and processed by second cluster unit 206 b. [Para. 0036], when cluster unit 206 a regains operations or is able to access external network 204 a, the then disabled interface of cluster unit 206 a is enabled and device 202 a automatically starts sending or receiving traffic to/from Internet 204 a by disabling the interface of cluster unit 206 b [Examiner’s Note: Cluster unit 206 a sends packets to network 204 a]).
Although teaching establishing VPNs with active and standby nodes and transmitting packets from the active node, Xie does not explicitly disclose and receive the packet at the first node from the second node after the packet was received at the second node as return traffic,
Cisco teaches and receive the packet at the first node from the second node after the packet was received at the second node as return traffic ([Page 65, second and fourth paragraphs], WAN Edge Deployment. A second WAN Edge router is recommended to be added for redundancy. IPsec-encapsulated tunnels encrypt data traffic to other WAN Edge router locations, User traffic originating from the service VPNs is directed to the tunnels. [Page 15, TLOC section], A Transport Location (TLOC) is the attachment point where a WAN Edge router connects to the WAN transport network. [Page 68, second paragraph] and [FIG. 59], TLOC extensions allow each WAN Edge router to access the opposite transport through a TLOC-extension interface on the neighboring WAN Edge router. WAN Edge 1 connects directly to the MPLS transport and uses the TLOC extension interface on WAN Edge 2 to connect to the INET transport. WAN Edge 2 connects directly to the INET transport and uses the TLOC extension interface on WAN Edge 1 to connect to the Multiprotocol Label Switching (MPLS) transport. [Page 70, second paragraph] and [FIG. 61], If subnet A is in a private address space, then NAT should be configured on WAN Edge 2’s ge0/4 transport interface to ensure traffic can be routed back from the Internet to WAN Edge 1 over the TLOC Extension [Examiner’s Note: That traffic is routed back over subnet A indicates the traffic is the return packets received at the second node and forwarded to the first node by the second node]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the apparatus of Xie, so that the return traffic received at the redundant router is forwarded to the transmitting edge router, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture are facing (Cisco [Page 3, second and third paragraphs]).
Although Xie and Cisco teach that the traffic routed back to the first node is the return packets received at the second node, Dan more specifically discloses and receive the packet at the first node from the second node after the packet was received at the second node as return traffic.
Duan is directed to providing avoiding asymmetric routing in an SD-WAN by dynamically setting BGP attributes within routing information advertised by an SD-WAN appliance. More specifically, Duan teaches and receive the packet at the first node from the second node after the packet was received at the second node as return traffic ([Para. 0003], An SDWAN controller congregates parallel links to offer intelligent load balance schemes. However, sometimes the existence of parallel links results in asymmetric routing, a situation where a packet traverses one path from a source to a destination and takes a different path while returning traffic from the destination to the source. Such asymmetric routing is generally undesired for stateful-based network functionalities. [Para. 0049], Border Gateway Protocol (BGP) daemons of upstream SDWAN devices configure their respective local route-maps based on the received routing information to facilitate appropriate routing of upstream and downstream network traffic. The return route selected by the upstream SDWAN device will be the preferred route selected by the controller [Examiner’s Note: Duan teaches that return packets may be received a SDWAN device different the uplink upstream SDWAN]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the apparatus of Xie and Cisco, so that the return packets are received at the upstream device, as taught by Duan. The modification would have avoided undesired for stateful-based network functionalities (Duan [Para. 0003]).
Claims 9-10 and 12-14 are apparatus claims and they do not teach or further define over the limitations recited in claims 2-3 and 5-7 respectively. Therefore, claims 9-10 and 12-14 are rejected for similar reasons set forth in claims 2-3 and 5-7.
For claim 15, Xie teaches a non-transitory computer-readable storage medium including instructions ([Para, 0025], present invention may be provided as a computer program product, which may include a machine-readable storage medium tangibly embodying thereon instructions. The machine-readable medium may include fixed (hard) drives) that, when executed by at least one processor, cause the at least one processor to ([Para. 0024], The steps may be embodied in machine-executable instructions, which may be used to cause a general-purpose or special-purpose processor programmed with the instructions to perform the steps): establish, by a first node of a high availability cluster (HA cluster), a first stateless virtual private network (first stateless VPN) designating the first node as an active node and designating a second node of the HA cluster as a standby node ([Para. 0034] and [FIG. 2], network device 202 a can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 a and can be further configured to form a backup connection with a disabled interface of cluster unit 206 b. [Examiner’s Note: Cluster unit 206 a is the first node and 206 b the second node. The connections constitute the first VPN as Cisco teaches below]. [Para. 0040], in each HA cluster, one cluster unit 206 can be configured as a master unit 206. [Para. 0011], master cluster unit 106 a operates in its normal master mode to process traffic from one or more computing devices 102 and assigns one or more of other computing devices 102 to slave cluster unit 106 b [Examiner’s Note: Cluster unit 206 a can be the master unit. That the master unit assigns network devices to cluster units indicates that the master unit such as cluster unit 206 a establishes the active and backup connections with cluster units 206 a and 206 b]), establish, by the first node of the HA cluster, a second stateless VPN designating the first node as the standby node and the second node as the active node ([Para. 0037] and [FIG. 2], network device 202 b can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 b and can be further configured to form a backup connection with a disabled interface of cluster unit 206 a. [Para. 0011], master cluster unit 106 a operates in its normal master mode to process traffic from one or more computing devices 102 and assigns one or more of other computing devices 102 to slave cluster unit 106 b [Examiner’s Note: The connections constitute the second VPN]), receive a packet at the first node within the first stateless VPN ([Para. 0035], When first cluster unit 206 a fails, disabled interface of second cluster unit 206 b is enabled and backup connection of unit 206 b is used causing all subsequent packets originated by network device 202 a to be transmitted onto external network 204 a to be received and processed by second cluster unit 206 b. [Para. 0036], when cluster unit 206 a regains operations or is able to access external network 204 a, the then disabled interface of cluster unit 206 a is enabled and device 202 a automatically starts sending or receiving traffic to/from Internet 204 a by disabling the interface of cluster unit 206 b [Examiner’s Note: Cluster unit 206 a receives packets from device 202 a]), transmit the packet from the first node ([Para. 0035], When first cluster unit 206 a fails, disabled interface of second cluster unit 206 b is enabled and backup connection of unit 206 b is used causing all subsequent packets originated by network device 202 a to be transmitted onto external network 204 a to be received and processed by second cluster unit 206 b. [Para. 0036], when cluster unit 206 a regains operations or is able to access external network 204 a, the then disabled interface of cluster unit 206 a is enabled and device 202 a automatically starts sending or receiving traffic to/from Internet 204 a by disabling the interface of cluster unit 206 b [Examiner’s Note: Cluster unit 206 a sends packets to network 204 a]).
Although teaching establishing VPNs with active and standby nodes and transmitting packets from the active node, Xie does not explicitly disclose and receive the packet at the first node from the second node after the packet was received at the second node as return traffic,
Cisco teaches and receive the packet at the first node from the second node after the packet was received at the second node as return traffic ([Page 65, second and fourth paragraphs], WAN Edge Deployment. A second WAN Edge router is recommended to be added for redundancy. IPsec-encapsulated tunnels encrypt data traffic to other WAN Edge router locations, User traffic originating from the service VPNs is directed to the tunnels. [Page 15, TLOC section], A Transport Location (TLOC) is the attachment point where a WAN Edge router connects to the WAN transport network. [Page 68, second paragraph] and [FIG. 59], TLOC extensions allow each WAN Edge router to access the opposite transport through a TLOC-extension interface on the neighboring WAN Edge router. WAN Edge 1 connects directly to the MPLS transport and uses the TLOC extension interface on WAN Edge 2 to connect to the INET transport. WAN Edge 2 connects directly to the INET transport and uses the TLOC extension interface on WAN Edge 1 to connect to the Multiprotocol Label Switching (MPLS) transport. [Page 70, second paragraph] and [FIG. 61], If subnet A is in a private address space, then NAT should be configured on WAN Edge 2’s ge0/4 transport interface to ensure traffic can be routed back from the Internet to WAN Edge 1 over the TLOC Extension [Examiner’s Note: That traffic is routed back over subnet A indicates the traffic is the return packets received at the second node and forwarded to the first node by the second node]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the apparatus of Xie and Duan, so that the return traffic received at the redundant router is forwarded to the transmitting edge router, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture are facing (Cisco [Page 3, second and third paragraphs]).
Although Xie and Cisco teach that the traffic routed back to the first node is the return packets received at the second node, Dan more specifically discloses and receive the packet at the first node from the second node after the packet was received at the second node as return traffic.
Duan is directed to providing avoiding asymmetric routing in an SD-WAN by dynamically setting bgp attributes within routing information advertised by an SD-WAN appliance. More specifically, Duan teaches and receive the packet at the first node from the second node after the packet was received at the second node as return traffic ([Para. 0003], An SDWAN controller congregates parallel links to offer intelligent load balance schemes. However, sometimes the existence of parallel links results in asymmetric routing, a situation where a packet traverses one path from a source to a destination and takes a different path while returning traffic from the destination to the source. Such asymmetric routing is generally undesired for stateful-based network functionalities. [Para. 0049], Border Gateway Protocol (BGP) daemons of upstream SDWAN devices configure their respective local route-maps based on the received routing information to facilitate appropriate routing of upstream and downstream network traffic. The return route selected by the upstream SDWAN device will be the preferred route selected by the controller [Examiner’s Note: Duan teaches that return packets may be received a SDWAN device different the uplink upstream SDWAN]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the apparatus of Xie and Cisco, so that the return packets are received at the upstream device, as taught by Duan. The modification would have avoided undesired for stateful-based network functionalities (Duan [Para. 0003]).
Claims 16-17 and 19 are apparatus claims and they do not teach or further define over the limitations recited in claims 2-3 and 5 respectively. Therefore, claims 16-17 and 19 are rejected for similar reasons set forth in claims 2-3 and 5.
For claim 20, Xie, Cisco and Duan teach The non-transitory computer-readable storage medium of claim 15. The references further teach wherein the instructions to determine which of the first node and the second node is the active node includes inspecting a label of the packet and determining that the label designates the first stateless VPN or the second stateless VPN as a VPN responsible for routing the packet (Cisco [Page 6, first paragraph] and [FIG. 2], Traffic that enters the router is assigned to a VPN When traffic is transmitted across the WAN, a label is inserted after the ESP header to identify the VPN that the user’s traffic belongs to when it reaches the remote destination [Examiner’s Note: The VPN label is after ESP header indicates that the VPN label encapsulates the packet before the packet enters VPN tunnel at the HA node. The VPN label is inspected by the destination to identify the VPN that the packet belongs to]. Xie [Para. 0034] and [FIG. 2], network device 202 a can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 a and can be further configured to form a backup connection with a disabled interface of cluster unit 206 b. Xie [Para. 0035], network device 202 a continues to receive and process packets for external network 204 a through its respective active connection till the time the first cluster unit 206 a remains operational. Xie [Para. 0037], network device 202 b can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 b and can be further configured to form a backup connection with a disabled interface of cluster unit 206 a. [Examiner’s Note: Xie teaches that for the two VPNs, the active node transmits traffic and standby node does not transmit traffic. Cisco teaches a packet is encapsulated with the VPN label designating the first or second VPN. The teaching of Xie and Cisco indicates that first node is determined to be the active node if the packet from network device 202 a carries VPN label designating the first VPN and to be transmitted by the active node]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie and Duan, so that the packets are encapsulated with VPN label designating a VPN, as taught by Cisco. The modification would have provided solutions to address the challenges that the legacy WAN architecture are facing (Cisco [Page 3, second and third paragraphs]).
Claims 4, 11 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Xie et al. (US20180246791A1, hereinafter Xie) in view of Cisco (Cisco SD-WAN Design Guide, hereinafter Cisco) and Duan et al. (US20210306261A1 hereinafter Duan), and further in view of Gupta et al. (US20220255900A1, hereinafter Gupta).
For claim 4, Xie, Cisco and Duan teach the method of claim 1. The references further teach wherein the first stateless VPN and the second stateless VPN designate the active node as a routing device responsible for routing traffic that is more critical than the traffic routed by the standby node (Xie [Para. 0034] and [FIG. 2], network device 202 a can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 a and can be further configured to form a backup connection with a disabled interface of cluster unit 206 b. Xie [Para. 0037], network device 202 b can be configured to form an active connection through one of its ports or connection interface devices with an enabled interface of cluster unit 206 b and can be further configured to form a backup connection with a disabled interface of cluster unit 206 a).
Although teaching VPNs at active and standby nodes, the references do not explicitly disclose wherein the first stateless VPN and the second stateless VPN designate the active node as a routing device responsible for routing traffic that is more critical than the traffic routed by the standby node.
Gupta is direct to providing methods and systems to dynamically select vpnc gateway and on-demand vrf-id configuration based on behavioral pattern of user. More specifically, Gupta teaches wherein the first stateless VPN and the second stateless VPN designate the active node as a routing device responsible for routing traffic that is more critical than the traffic routed by the standby node ([Para. 0017], a secured tunnel can be formed between Branch Office gateway (BG) and each VPN concentrator (VPNC). An order of preference for routing traffic to each VPNC in a VPNC cluster can be established in the software defined WAN (SD-WAN). A VPNC can be designated as a primary VPNC, another VPNC in the VPNC cluster can be designated as a secondary VPNC. According to this defined preference for VPNCs in the cluster, traffic is largely routed to the primary VPNC. Alternatively, there are some instances where traffic is routed to the secondary VPNC. [Para. 0046], For all of the ECMP routes, traffic is sent to the same primary VPNC gateway. However, if the health of the primary VPNC gateway goes below a defined health/performance threshold value, the branch gateway can dynamically adjust to start sending the traffic from clients that are identified less critical users to the secondary VPNC gateway. [Para. 0031], it is desirable to establish VPN tunnels with a plurality of branch gateways. [Examiner’s Note: It is obvious that the distribution of traffic between primary and secondary VPN routers over a VPN tunnel based on whether the traffic being critical can be applied to all VPN tunnels]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Xie, Cisco and Duan, so that the traffic less critical is routed by the secondary VPN router, as taught by Gupta. The modification would have allowed the system to adjust how traffic is selectively distributed to the VPNCs in real-time and/or based on current conditions on the network (Gupta [Para. 0018]).
Claims 11 and 18 are apparatus claims and they do not teach or further define over the limitations recited in claim 4. Therefore, claims 11 and 18 are rejected for similar reasons set forth in claim 4.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHU LIU whose telephone number is (571)272-5186. The examiner can normally be reached Monday - Friday 9:00 am - 5:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, REBECCA E SONG can be reached at (571)270-3667. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/S.L./Examiner, Art Unit 2417
/REBECCA E SONG/Supervisory Patent Examiner, Art Unit 2417
Prosecution Insights