Cisco Technology, Inc.

Ali Sajassi

Samer Salam

Samir D Thoria

Mankamana Prasad Mishra

Patrice Brissette

Sami Boutros

Ijsbrand Wijnands

Mei Zhang

Norman William Finn

Keyur Patel

Krishnaswamy Muddenahally Ananthamurthy

Dhananjaya Rao

Eric Albin Voit

Pradeep Kumar Kathail

Lukas Krattiger

Swadesh Agrawal

Satya Ranjan Mohanty

Jose Antonio Liste

Vi Vu

David A Maluf

Francois Edouard Tallet

Neeraj Malhotra

Tapraj Singh

Stephane Litkowski

Anuj Budhiraja

Dezhong Cai

Pascal Thubert

Nitin Kumar

Manoj Kumar Pandey

Derek Man-Kit Yeung

Balaji Pitta Venkatachalapathy

Jayashree Subramanian

Arman Rezaee

Clarence Filsfils

Eric Michel Levy-Abegnoli

Srinath Gundavelli

Stefano Benedetto Previdi

Dino Farinacci

Rex Emmanuel Fernando

Chandrashekhar Appanna

Ramanathan Lakshmikanthan

Stig Ingvar Venaas

Pradosh Mohapatra

Luca Martini

Thomas Eric Ryle

Robert Goguen

Sri Gundavelli

Daniel A Alvarez

Ashok Narayanan

Harshavardhan Parandekar

John Mullooly

Ravindra Nandalal Rathi

Nathan Allen Mitchell

Yves Hertoghs

Mrinmoy Ghosh

John M Zwiebel

Luc Andre Burdet

Sanjay Dhar

Yushun Zhang

Richard Thomas Wood

Frank Brockners

William Mark Townsley

George Swallow

Ayan Banerjee

Elango Ganesan

Alessandro Erta

Wojciech Dec

Hong Zhang

Thomas David Nadeau

Richard Mandfred Pruss

Christopher Metz

Jerome Tollet

Richard W Bradford

Roberto Mitsuo Kobo

Lester C Ginsberg

Matthew Stephen MacPherson

Aloÿs Christophe Augustin

Manas Pati

Rajesh Sharma

Samuel G Henderson

Steve Phillips

Kesavan Thiruvenkatasamy

Vijay Nain

Arvind Venkateswaran

Nathan Roland Maryan Skrzypczak

Aparna Pattekar

Suma Kachinthaya

Pedro Miguel Martins Roque Marques

Chiara Regale

Shobana Biederman

Robert G Pothier

Samir Vapiwala

Chuanfa Wang

Vibov Bhan

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

In one embodiment, a method includes receiving, by a first router, data from a network component. The method also includes determining, by the first router, a first link bandwidth capacity between the first router and a host device and determining, by the first router, a first score for the first router based on the first link bandwidth capacity. The method also includes determining, by the first router, a second link bandwidth capacity between a second router and the host device and determining, by the first router, a second score for the second router based on the second link bandwidth capacity. The method further includes comparing, by the first router, at least the first score and the second score to determine a highest score and assigning, by the first router, an edge router associated with the highest score to communicate the data to the host device.

Systems and methods for determining network component scores using bandwidth capacity

In one embodiment, a method includes receiving, by a route reflector, a subscription request from a first provider edge node in a network and generating a subscription policy for the first provider edge node. The method also includes receiving a first Ethernet Virtual Private Network (EVPN) Type 2 Route from a second provider edge node, assigning a sequence number to the first EVPN Type 2 Route, and communicating the first EVPN Type 2 Route with the sequence number to the first provider edge node. The method further includes receiving a second EVPN Type 2 Route from a third provider edge node, generating an updated sequence number in response to receiving the second EVPN Type 2 Route from the third provider edge node, and communicating the second EVPN Type 2 Route with the updated sequence number to the first provider edge node and the second provider node.

Systems and methods for subscription based selective EVPN route distribution

In one aspect, a method of IP obfuscation of a user device includes receiving, over an Extendible Authentication Protocol (EAP) session between a user device and a network access point, location preferences of the user device, generating, based on the location preferences or a network policy, a geohash for the user device, identifying, for the user device, an IP anchor, sending, over the EAP session, the geohash to the user device, and receiving, from the user device, network traffic, wherein the network access point utilizes the geohash and the IP anchor to route the network traffic for the user device and obfuscate IP address of the user device from third-party access.

Technique for eliminating ingress-proxy in the multi-relay approach for privacy

Techniques are described herein for resolving conflicts in role statuses assigned to a customer edge device by multiple provider edge devices in communication with that customer edge device. In embodiments, such techniques may involve receiving information about a customer edge device in communication with the first provider edge device and storing, based on the information about the customer edge device, an indication of a first role status of the customer edge device. The techniques may further involve receiving, from at least one second provider edge device in communication with the customer edge device, an advertisement message that includes a second role status of the customer edge device, comparing the first role status to the second role status, and upon determining that the first role status does not match the second role status, updating the first role status of the customer edge device.

Techniques for providing role status conflict resolution with EVPN multi-homing

A system and method for handling multicast traffic in Ethernet Virtual Private Network multi-homed networks includes receiving a first route table for a first route, determining that the first route table is associated with another peer device in the multi-home network, generating a second route table for a second route, determining a route to transmit data and the determined route is the first route or the second route based on the first preference value and the second preference value, and transmitting the data using the determined route.

System and method for EVPN multicast optimization for source handling

Stateless network address privacy may be provided. A data packing may be received with an obfuscated destination address and an un-obfuscated source address. An un-obfuscated destination address may be determined based on the obfuscated destination address. An obfuscated source address may be determined based on the un-obfuscated source address. The obfuscated destination address may be replaced with the un-obfuscated destination address and the un-obfuscated source address may be replaced with the obfuscated source address. The packet may be forwarded.

Stateless network address privacy (SNAP)

Described herein are techniques for routing communications to a destination node within a LEO satellite network. The techniques may comprise receiving, at a satellite node in a network of satellites, a communication directed to an address for a destination satellite, determining whether the satellite node is the destination satellite, upon determining that the satellite node is the destination satellite, transmitting the communication to a ground station in communication range of the satellite node, and upon determining that the satellite node is not the destination satellite: identifying, via a local routing table, a second satellite node associated with the address for the destination satellite, and forwarding the communication to the second satellite node.

Communication routing between nodes in a LEO satellite network

According to an embodiment, a node comprises one or more processors operable to execute instructions to cause the node to perform operations. The operations comprise determining a link quality associated with each satellite link of a plurality of satellite links and applying load balancing to the plurality of satellite links. The load balancing is based at least in part on the respective link quality associated with each satellite link. The load balancing comprises determining which of the satellite links to include in an active set selected to communicate data to or from the node and, for each satellite link in the active set, determining a portion of the data to communicate via the respective satellite link. The operations further comprise transmitting or receiving the data via the satellite links in the active set. Each satellite link in the active set communicates its respective portion of the data.

Adaptive load balancing in a satellite network

A system and associated methods provide solutions for reducing a volume of traffic through a multicast network attributed to repeated maintenance messages, which are required in order to maintain a multicast connection. The system configures provider edge devices to generate and send maintenance messages on behalf of members of a multicast group to establish and maintain the multicast connection and provides options for determining unknown locations of sources and/or subscribers, thereby reducing the overall volume of traffic transmitted over the multicast network.

PIM proxy over EVPN fabric

Systems, methods, and computer-readable media are provided for securely advertising autoconfigured prefixes in a cloud environment. In some examples, a method can include, receiving, by a first router, an indication of an available network address prefix. In some aspects, the method can also include selecting, by the first router, a first network address prefix that is within the available network address prefix, wherein the first network address prefix provides at least one route to one or more network elements associated with the first router. In some cases, the method may further include sending, to a second router, a message including a stub registration option that indicates the first network address prefix.

Secured advertisement of autoconfigured internet protocol prefixes in a cloud environment

A system and associated methods provide a scalable solution for managing multiple multicast flows within a multicast group of a multicast network. The system groups redundant sources of the multicast group according to their associated multicast flows, assigns flow identifiers to each redundant source indicative of their associated multicast flows, and facilitates Single Forwarder election to select a Single Forwarder that belongs to the appropriate multicast flow. The system provides control plane extensions that enable signaling of which redundant source belongs to which multicast flow.

Multicast redundancy in EVPN networks

This disclosure describes methods of operating a leaf node device, such as a switch device, connected to a switch fabric of a network. The leaf node device receives, from another leaf node device via the switch fabric, an indication of a secure route to a host device. In response to receiving the indication of the secure route, the leaf node device creates or updates a routing entry for the host device in a routing information base of the leaf node device and creates or updates an entry for the host device in a Dynamic Host Configuration Protocol (DHCP) snoop database of the leaf node device. The leaf node may thereby communicate with the host device that is attached to the leaf node device as a result of moving from the other leaf node device.

DHCP snooping with host mobility

A computer network efficiently provides a multicast network flow to a multicast recipient across a multihomed network element. The multihomed network element includes network devices that receive multicast data from a source of a multicast network flow. Each particular network device that received the multicast data publishes a notification indicating that the multicast network flow is available from the particular network device. The computer network receives a subscription to the multicast network flow from a multicast recipient, and determines whether to bridge the multicast data across the multihomed network element based on a multicast configuration of the computer network. The multihomed network element provides the multicast data to the multicast recipient from at least one of the particular network devices that received the multicast data from the source of the multicast network flow.

Multicast traffic optimization in multihomed edge network elements

Systems and techniques are provided for synchronizing DHCP snoop information. In some examples, a method can include, performing, by a first PE device from a plurality of PE devices, DHCP snooping of a first plurality of DHCP messages between a DHCP client and a DHCP server, wherein the plurality of PE devices is part of an ethernet segment for multihoming the DHCP client. In some aspects, the method includes determining, based on snooping the first plurality of DHCP messages, an association between an IP address corresponding to the DHCP client and a MAC address corresponding to the DHCP client. In some examples, the method includes sending, by the first PE device to at least one other PE device from the plurality of PE devices, a first route advertisement that includes the association between the IP address corresponding to the DHCP client and the MAC address corresponding to the DHCP client.

Synchronizing dynamic host configuration protocol snoop information

Growing community of inventors

San Ramon, CA, United States of America

Ali Sajassi