Cisco Technology, Inc.

Palo Alto Networks, Inc.

Ericsson Ab

Telefonaktiebolaget Lm Ericsson (publ)

Anand K Oswal

Jayaraman R Iyer

Sanjay Kumar Hooda

Balaji Sundararajan

Rajesh S Pazhyannur

Arun G Khanna

Timothy Peter Stammers

Chandramouli Balasubramanian

Parviz Yegani

Mark Grayson

Viren K Malaviya

Vivek Agarwal

Sudhir Kumar Jain

John Gary Waclawsky

Kevin Shatzkamer

Vamsidhar Valluri

Muninder Singh Sambi

Arivu Mani Ramasamy

Dana Lynn Blair

Alfred C Lindem, Iii

Rex Emmanuel Fernando

Bhaskar Bhupalam

Saravanan Radhakrishnan

Michael Lee Sullenberger

Michael Lindsay Shannon

Khalil A Jabr

Solomon Thiruvarutselvan Lucas

Brian Donald Hart

Kent Kinchu Leung

Paul Jeffrey Stager

Victor Manuel Moreno

David Stuart Kloper

Fred Jay Anderson

Rajeev Koodli

Duanpei Wu

Oliver James Bull

Darren Russell Dukes

Qing Zhao

Nehal Bhau

Jie Cheng Jiang

Darrin Joseph Miller

Renhua Wen

Chandrodaya Prasad

Steven W Wood

Shih-cheng Stan Yang

David Lindert

Kausik Majumdar

Venkatesh Ramachandra Gota

Navan Narang

Srinath Gundavelli

Daniel George Wing

Fabio Rodolfo Maino

Vimal Srivastava

Chris O'Rourke

Shree N Murthy

Ram Dular Singh

Gangadharan Byju Pularikkal

Parameswaran Kumarasamy

Parag Pritam Thakore

Alberto Rodriguez Natal

Shu Lin

Vinay Prabhu

Ashwin Kumar

Kumar Ramachandran

Marco Cesare Centemeri

Kedar Krishnanand Gaonkar

Yegappan Lakshmanan

Sarah Adelaide Evans

Richard Kyle Forster

Shivangi Sharma

Suraj Rangaswamy

Sachin G Gorde

Wenyi Wang

Kiritkumar B Joshi

Kedar Karmarkar

Jeevan Sharma

Paul Wayne Bigbee

Sireesha Yeruva

Chethan Channappa

Robert Michael Batz

Elango Ganesan

Herbert Michael Wildfeuer

Ramanathan Lakshmikanthan

Joseph Salowey

Francois Le Faucheur

Pritam Shah

Munish Mehta

Jing Li

Ramesh Nethi

Liming Wei

Michael A DeMoney

Abhishek Bhattacharyya

Jagdish Girimaji

Anal Srivastava

Ashish A Chandwadkar

Syam Sundar Appala

Rong Wang

Manish Kumar

Venkateshwara Sastry

Rajesh Tarakkad Venkateswaran

Systems, methods, and computer-readable media for interconnecting SDWANs through segment routing. A first SDWAN and a second SDWAN of a SDWAN fabric can be identified. A segment routing domain that interconnects the first SDWAN and the second SDWAN can be formed across a WAN underlay of the SDWAN fabric. Data transmission between the first SDWAN and the second SDWAN can be controlled by performing segment routing through the segment routing domain formed between the first SDWAN and the second SDWAN.

Policy plane integration across multiple domains

The present disclosure is directed to systems and methods for dynamic firewall discovery on a service plane. The method includes the steps of identifying a source data packet for transmission from a source machine at a source site to a destination machine at a destination site, wherein the source data packet corresponds to a request for connection between the source machine and the destination machine over a WAN, inspecting the source data packet at a first firewall associated with the source site, marking the source data packet with a marker to indicate inspection by the first firewall, transmitting the marked source data packet to the destination site, determining at the destination site that the source data packet has been inspected based on the marker, and forwarding the source data packet to the destination machine at the destination site, without inspection of the source data packet by a second firewall associated with the destination site.

Dynamic firewall discovery on a service plane in a SDWAN architecture

Systems, methods, and computer-readable media for an integrated Wi-Fi Access Point and cellular network Radio Unit (RU) include a communication system interfacing with a wired network for communicating Wi-Fi traffic and cellular network traffic, the communication system integrating a Wi-Fi Access Point (AP) with a cellular network Radio Unit (RU). The Wi-Fi traffic and cellular network traffic can be processed in the communication system. The communication system can interface with at least one programmable Radio Frequency (RF) front end configured for wireless communication over one or more frequency bands for Wi-Fi traffic and one or more frequency bands for cellular network traffic (e.g., 5G, LTE, Wi-Fi).

Integration of a Wi-Fi access point with a cellular radio unit

Techniques for providing consistent monitoring and analytics for security insights for network and security functions for a security service are disclosed. In some embodiments, a system/process/computer program product for providing consistent monitoring and analytics for security insights for network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; inspecting the flow to determine whether the flow is associated with a split tunnel; and monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service.

Consistent monitoring and analytics for security insights for network and security functions for a security service

Systems and methods for managing traffic in a hybrid environment include monitoring traffic load of a local network to determine whether the traffic load exceeds or is likely to exceed a maximum traffic load, where the maximum traffic load is a traffic load for which a service can be provided by the local network, based on a license. An excess traffic load is determined if the traffic load exceeds or is likely to exceed the maximum traffic load. One or more external networks which have a capacity to provide the service to the excess traffic load are determined, to which the excess traffic load is migrated. The local network includes one or more service instances for providing the service for up to the maximum traffic load, and the service to the excess traffic load is provided by one or more additional service instances in the one or more external networks.

License based traffic management in hybrid networks

Cloud delivered access may be provided. A network device may provide a client device with a pre-authentication virtual network and a pre-authentication address. Next, a policy may be received in response to the client device authenticating. The client device may then be moved to a post-authentication virtual network based on the policy. A post-authentication address may then be obtained for the client device in response to moving the client device to a post-authentication virtual network. Traffic for the client device may then be translated to the post-authentication address.

Cloud delivered access

The present disclosure is directed to managing industrial internet of things end points and includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause one or more switches to perform operations comprising: identifying a first end point using a protocol associated with the first end point, determining a classification for the identified first end point based on one or more attributes of the first end point, identifying one or more related end points having the classification in common with the first end point, segmenting the first end point with the identified one or more related end points, and applying one or more policies to the segmented first end point and the one or more related end points.

Automating a software-defined wide area network policy for internet of things end points

An enterprise controller of an enterprise network sends to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network. Responsive to the sending, the enterprise controller receives from the service gateway the network slice information including identifiers of and properties associated with the network slices. Responsive to receiving a request for the network slice information from a network device at a border of a forwarding plane of the enterprise network, the enterprise controller sends the network slice information to the network device to cause the network device to perform configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers to the data plane of the service provider network.

Enabling enterprise segmentation with 5G slices in a service provider network

Techniques for providing network traffic security in a virtualized environment are described. A threat aware controller uses a threat feed provided by a threat intelligence service to establish a threat detection engine on virtual switches. The threat aware controller and threat detection engine work together to detect any anomalous or malicious behavior of network traffic on the virtual switch and established virtual network functions to quickly detect, verify, and isolate network threats.

Virtual switch-based threat defense for networks with multiple virtual network functions

Secure network segmentation using logical subnet segments is described. A single network segment or subnet provided by a third party is mapped into multiple layer-3 virtual or logical segments without requiring separate subnets. This mapping is accomplished by using virtual routing functions (VRFs) per logical subnet segment while retaining a single subnet across the segments. The logical subnet segments interact with the single network segment provided by the third party (ISP). The layer-3 VRF instances are created without the need for separate IP subnet pools per layer-3 segment. Each VRF instance for the various logical subnet segments is mapped to an identifier and tag.

Micro and macro segmentation in enterprise networks without a per segment layer-3 domain

Systems and methods are provided for receiving, at a network device, a first set of rules from a security controller of an enterprise network, the first set of rules being different from a second set of rules provided to a firewall by the security controller, implementing, at the network device, the first set of rules received from the security controller, generating, at the network device, a first log including metadata based on the first set of rules, the first log being generated on a per flow basis, notifying, at the network device, a NetFlow of the first log including the metadata of the first set of rules, and providing, from the network device, the first log to a cloud-log store by the NetFlow of the network device, the cloud-log store receiving the first log from the network device and a second log from the firewall.

Distribution of stateless security functions

Systems and methods provide for provisioning a dynamic intent-based firewall. A network controller can generate a master route table for network segments reachable from edge network devices managed by the controller. The controller can receive zone definition information mapping the network segments into zones and Zone-based Firewall (ZFW) policies to apply to traffic between a source and destination zone specified by each ZFW policy. The controller can evaluate a ZFW policy to determine first edge network devices that can reach first network segments mapped to the source zone specified by the ZFW policy, second edge network devices that can reach second network segments mapped to the destination zone specified by the ZFW policy, and routing information (from the route table) between the first network segments, the first and second edge network devices, and the second network segments. The controller can transmit the routing information to the edge network devices.

Dynamic intent-based firewall

In one embodiment, an electronic device maintains one or more tunnel-based overlays for a communication network. The communication network includes two or more physical provider networks. The device maintains a mapping between a particular application and the one or more overlays for the communication network. The device adjusts the mapping between the particular application and the one or more overlays for the communication network. The device causes one or more routers in the communication network to route traffic for the particular application according to the adjusted mapping between the application and the one or more overlays for the communication network.

Intelligent wide area network (IWAN)

Certain embodiments disclose systems and methods for creating a user private network (UPN) based on 11ay technology. Methods of the present disclosure include creating a personal basic service set (PBSS) having a service device and one or more 11ay devices, the service device configured to wirelessly communicate with the one or more 11ay devices in the PBSS, creating a UPN having an access point located in communicative proximity with the service device, and associating at least one 11ay device of the one or more 11ay devices with the UPN, wherein the at least one 11ay device is configured to establish a wireless connection with the one or more 11ay devices using the service device when within a coverage area of the PBSS, and to establish a wireless connection with the one or more 11ay devices using the access point when outside the coverage area of the PBSS.

Creating a user private network based on 802.11ay Wi-Fi technology

Growing community of inventors

Sunnyvale, CA, United States of America

Anand K Oswal