Cisco Technology, Inc.

Andrew E Ossipov

Kent Kinchu Leung

Zhijun Liu

Xun Wang

Jonathan Augustine Kunder

Jianxin Wang

Pradeep Patel

Aaron Troy Woland

Ashish K Dey

Jayaraman R Iyer

Hari Shankar

Chandrodaya Prasad

Daryl Odnert

Manju Radhakrishnan

Janardhanan Radhakrishnan

Soumya Kumar Kalahasti

Vivek Santuka

Hy Quoc Pham

Steven H Chimes

Robert Tappenden

Louis Zhijun Liu

David Cherkus

Weiwei Kang

Kevin A Buchanan

Moses Hernandez

Kevin Buchanan

Techniques for using an end-to-end policy controller to utilize an inventory of enforcement points to generate a chain of enforcement points having capabilities to enforcement individual operations of an intent-based security policy associated with an entity accessing a resource. A network controller may intelligently split an intent-based security policy and send portions thereof to enforcement points along a path configured for an entity to access a resource. For example, a portion of a security policy corresponding to an operation may be mapped to and implemented by an enforcement point having a capability to perform the operation. Once each operation of a security policy has been mapped to an enforcement point, a chain of enforcement points may be generated.

Using an end-to-end policy controller to split policies between enforcement points in a network

A first packet of a packet flow is received at a classifying network device. The first packet is forwarded from the classifying network device to a firewall network device. An indication that the packet flow is to be offloaded is received at the classifying network device. Data is stored at the classifying network device indicating that the packet flow is to be offloaded. A non-control packet of the packet flow is received at the classifying network device. A determination is made that the non-control packet belongs to the packet flow by comparing data contained in the non-control packet to the stored data. The non-control packet of the packet flow is directed to a processing entity in response to the determining. A control packet of the packet flow is received at the classifying network device. The control packet of the packet flow is directed to the firewall network device.

Selective offloading of packet flows with flow state management

A network security device has at least one Fully Qualified Domain Name (FQDN) access policy that permits traffic to flow to at least one resource associated with at least one FQDN. The network security device receives, from a managed endpoint device, a packet directed to the at least one resource associated with the at least one FQDN. The network security device obtains DNS information associated with the managed endpoint device and, based on the domain name system (DNS) information, substitutes a network address of the at least one resource into the at least one FQDN access policy to open a traffic flow to the at least one resource associated with the at least one FQDN. The network security device then provides the packet to the at least one resource associated with the at least one FQDN.

Endpoint-assisted access control for network security devices

Techniques and architecture are described for providing broadcast/multicast support using VXLAN in and among private on-premises/cloud networks and public cloud networks by defining peer groups comprising VXLAN tunnel endpoints (VTEPs) within clustered network security devices. For example, a static peer group comprising two or more virtual extensible local access network (VXLAN) tunnel end points (VTEPs) is defined. The two or more VTEPs may each comprise a data interface of a network security device. Based at least in part on the static peer group, an overlay network comprising the two or more VTEPs is defined. A network security device discovers available VTEPs within the static peer group. The network security device establishes a mesh network of available VTEPs.

Method to provide broadcast/multicast support in public cloud

Methods and apparatuses providing file type inspection in firewalls by moving the flow between deep inspection file and lightweight accelerated paths. The method includes obtaining, by a network security device, a packet flow of a file transfer session in which at least two files are transferred and determining, by the network security device, at least an offset parameter based on at least one attribute of at least a first packet in the packet flow. The offset parameter is for a first file being transferred of the at least two files and relates to an expected positon of a control data sequence within the packet flow. In this method, based on the offset parameter, directing, by the network security device, to an accelerated packet inspection path instead of to a deep packet inspection path, a portion of the packet flow including one or more packets that follow the first packet.

Contextual engagement and disengagement of file inspection

A method is performed by a master network device among network devices of a cluster. The master network device receives cluster configuration information including a set of Internet Protocol (IP) addresses and a pool of port blocks associated with the IP addresses. Each port block includes multiple ports, and the pool of the port blocks is to be shared across the network devices for port address translation. The master network device divides the port blocks in the pool into multiple buckets. The master network device allocates to each network device in the cluster a corresponding one of the buckets, and reserves each bucket that is not allocated for allocation to a potential new network device. When a new network device joins the cluster, the master network device allocates to the new network device the port blocks from a corresponding one of the reserved buckets.

Port address translation scalability in stateful network device clustering

A method is provided including obtaining at a newly added flow mapper node of a plurality of flow mapper nodes, from a first flow locator node of a plurality of flow locator nodes, a flow owner lookup request for flow state information that includes identification of a particular flow locator that is to handle processing of a packet flow. The newly added flow mapper node determines whether it has stored flow state information. When the newly added flow mapper node does not have stored flow state information, the newly added flow mapper node identifies a particular flow mapper node of the plurality of flow mapper nodes which has stored flow state information for the particular packet flow and services the flow owner lookup request using flow state information stored by the particular flow mapper node.

High performance for efficient auto-scaling of stateful service

A method for selecting either a first malware analysis system or a second malware analysis system to analyze a file is disclosed. The method includes obtaining, at a network security element, a file sent between a first device and a second device, the file having one or more associated attributes; analyzing, at the network security element, the one or more attributes of the file; selecting, based on the analyzing, either the first malware analysis system or the second malware analysis system as a selected malware analysis system for malware analysis of the file; and providing the file to the selected malware analysis system.

Dynamic routing of files to a malware analysis system

An example method for facilitating hierarchical clustering in a geographically dispersed network environment is provided and includes receiving a packet at one of a plurality of adaptive security appliance (ASA) units in one of a plurality of ASA clusters in a cluster domain of a network environment, identifying the packet as matching an inter-data center live traffic profile, identifying a target ASA cluster in the plurality of ASA clusters in the cluster domain, querying a domain director in the target ASA cluster for a flow owner, and if the flow owner is identified by the domain director, forwarding the packet to the flow owner in the target cluster, and if the flow owner is not identified by the domain director, and the domain director includes a flow state for a flow to which the packet belongs, designating the ASA unit as the flow owner.

Hierarchical clustering in a geographically dispersed network environment

A method is performed by a master network device among network devices of a cluster. The master network device receives cluster configuration information including a set of Internet Protocol (IP) addresses and a pool of port blocks associated with the IP addresses. Each port block includes multiple ports, and the pool of the port blocks is to be shared across and used by the network devices for port address translation on network connections with the network devices. The master network device divides the port blocks in the pool into multiple buckets. The master network device first allocates to each network device in the cluster a corresponding one of the buckets, and reserves each bucket that is not allocated for allocation to a potential new network device. When a new network device joins the cluster, the master network device second allocates to the new network device the port blocks from a corresponding one of the reserved buckets.

An intermediate device (such as a firewall) is disposed between first and second devices (such as a client and a server device, respectively). Communications between the first and second devices are intercepted in both directions by the intermediate device, which spoofs the receiving device by modifying messages sent by the transmitting device. The modified message uses a key held by the intermediate device instead of a key belonging to the sending device.

Control of out-of-band multipath connections

A method operable in a security device cluster having a plurality of security devices each configured to receive respective data flows. The method includes receiving a first segment of a flow at a first security device of the plurality of security devices, sending the first segment of the flow toward a destination node without the first security device of the plurality of security devices asserting ownership over the flow, receiving, from the destination node, a second segment of the flow at a second security device of the plurality of security devices, the second segment of the flow being responsive to the first segment, asserting, by the second security device of the plurality of security devices, ownership over the flow, and forwarding, from the first security device, packets of the flow subsequently received by the first security device to the second security device.

Stateful connection processing in a security device cluster

In one embodiment, network address translated (NAT) mapped addresses are selectively used based on their prior network reachability. One embodiment maintains for each particular mapped address (e.g., NAT public address pool member), a reachability status level based on prior usage of the particular mapped address to communicate with external destinations. By continuously monitoring the reachability 'health' of mapped addresses, problem-experiencing mapped addresses can be avoided. One embodiment monitors the success and/or failure rates of connection attempts over a rolling time period to provide an up-to-date current view of the reachability status level of corresponding mapped addresses. In one embodiment, a network address translation device assigns, based on their reachability status level, these mapped addresses. One embodiment provides an administrative notification for particular mapped address or ceases using the particular mapped address in response to its reachability status level falling outside a predetermined or calculated level.

Growing community of inventors

Richardson, TX, United States of America

Andrew E Ossipov