Cisco Technology, Inc.

Cloudgenix, Inc.

Palo Alto Networks, Inc.

Arivu Mani Ramasamy

Venkataraman Anand

Navneet Yadav

Kumar Ramachandran

Aaron Edwards

Anand K Oswal

Gopal Reddy

Martin Cieslak

Giorgio Valentini

Natarajan Chidambaram

Hui Wang

Aamer Saeed Akhter

Bhaskar Bhupalam

Shu Lin

Arindam Paul

Daniel Kaminsky

Jim Philip Ervin

Michael A DeMoney

Mukund Trimbak Ingle

Etai Lev Ran

Siddharth Vajirkar

Tom Black

Vijay Sagar

Zachary Seils

Nagaraj Bagepalli

Rajeev Koodli

Swaminathan Sankar

Paul J Aitken

Pankaj Bhagra

Anil Kumar Reddy Sirigiri

Arun Kumar Palani

Derek L Huckaby

Venkata Sarat Kumar Vajrapu

Mark Gillott

Srinivasan Komandoor Santhanam

Bala Gautama

Aniket Ghule

Prashant Murlidhar Dave

Zach Seils

Scott Alexander

Steven Rempe

Abdolreza Saadat

Deepak S Khanorkar

Jim Ervin

Zachary A Seils

Techniques for load balancing secure network traffic are disclosed. A system, process, and/or computer program product for load balancing secure network traffic includes monitoring network traffic for one branch of a plurality of branches for an enterprise network, and splitting the network traffic of the one branch into a plurality of network segments based on a determination that the network traffic exceeds traffic capacity of at least one security processing node (SPN) of a plurality of SPNs using a network load balancer (NLB) in communication with a plurality of Network Processing Nodes (NPNs), the plurality of monitored branches being distributed to the plurality of SPNs via a plurality of tunnels.

Load balancing secure network traffic

A network controller in an overlay network maintains collective sets of identity-based policies and identity mappings for onboarded users of the network for informed distribution to network elements across the network. As new users are onboarded, the controller identifies a site of the network at which the user was onboarded and determines identity mappings of the user and applicable policies for distribution to a network element at the identified site. The controller assigns index values to each identity and communicates the indices to network elements with the corresponding identity mappings and policies. The network elements encapsulate cross-site traffic with the index values corresponding to senders so recipient network elements can obtain the index value from encapsulation header formats, query the controller for the corresponding identity mappings, and apply policies to the traffic that are determined to be pertinent based on the sender's identity mappings obtained from the controller.

Scalable distribution of identity information in overlay networks with identity-based policies

Techniques for providing consistent monitoring and analytics for security insights for network and security functions for a security service are disclosed. In some embodiments, a system/process/computer program product for providing consistent monitoring and analytics for security insights for network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; inspecting the flow to determine whether the flow is associated with a split tunnel; and monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service.

Consistent monitoring and analytics for security insights for network and security functions for a security service

A method includes allocating an identifier to each of a plurality of policies each comprising a network-isolation identifier associated with a VXWAN directive and transmitting each of the plurality of policies to one or more devices in a network.

Methods and systems for application and policy based network traffic isolation and data transfer

Various techniques for dynamic path selection and data flow forwarding are disclosed. For example, various systems, processes, and computer program products for dynamic path selection and data flow forwarding are disclosed for providing dynamic path selection and data flow forwarding that can facilitate preserving/enforcing symmetry in data flows as disclosed with respect to various embodiments.

Dynamic path selection and data flow forwarding

Techniques for providing flow meta data exchanges between network and security functions for a security service are disclosed. In some embodiments, a system/process/computer program product for providing flow meta data exchanges between network and security functions for a security service includes receiving a flow at a network gateway of a security service from a software-defined wide area network (SD-WAN) device; inspecting the flow to determine meta information associated with the flow; and communicating the meta information associated with the flow to the SD-WAN device.

Flow metadata exchanges between network and security functions for a security service

A method includes receiving from a networked spoke device information describing network flows to and from an application, analyzing the information to characterize the application in at least one dimension selected from the group consisting of bi-directional bandwidth usage, network response times, application response times, a number of idle and active application sessions and a maximum number of concurrent application sessions and transmitting the dimensions to at least one networked spoke device as traffic profile information.

Methods and systems for application session modeling and prediction of granular bandwidth requirements

A method includes determining a network requirement for at least one application, dynamically determining a link suitable for data transmission in accordance with a policy based at least in part on a current network condition to meet the network requirement and routing one or more application network data flows associated with the at least one application over the link.

Methods and systems for business intent driven policy based network traffic characterization, monitoring and control

A method includes monitoring a plurality of network devices to collect network performance data comprising data flow records of each device on the network and to create a network topology database, accessing the network topology database comprising information on an entry and exit point of each device, the manner in which the devices are connected and a plurality of data flow records on a single data flow from multiple devices on the network and utilizing the network topology database to perform an asymmetric detection algorithm to identify one or more data flows that exited a device via a first path and returned to the device via a different second path.

Methods and systems for detection of asymmetric network data traffic and associated network devices

A method includes detecting a data flow and an associated originating interface on a network, determining a first link over which to forward the data flow, transmitting the data flow over the determined link, receiving a return data flow and moving a forward direction of the return data flow to a new path if the return data flow arrived via a link other than the first link, wherein all packets following a first packet on the flow are forwarded on the same path as the first packet.

Methods and systems for dynamic path selection and data flow forwarding

Growing community of inventors

San Jose, CA, United States of America

Arivu Mani Ramasamy