Cisco Technology, Inc.

Avinash Shah

Balaji Sundararajan

Ganesh Devendrachar

Laxmikantha Reddy Ponnuru

Pritam Baruah

Arul Murugan Manickam

Samir D Thoria

Preety Mordani

Satish Mahadevan

Steven W Wood

Satyajit Das

Ramakumara Kariyappa

Venkatesh Nataraj

Vishali Somaskanthan

Deepa Rajendra Sangolli

Michael John Moskal

Techniques are described for avoiding data packet fragmentation in a routing device such as a router or network switch. Path Maximum Transport Unit (PMTU) values are monitored for a plurality of egress links of a networking device. A statistical analysis of fragmentation rates is performed. The statistical analysis can be performed on a per-link basis, per-flow basis or both per-link and per-flow basis. If the packet fragmentation rate of data flows through a particular egress link exceeds a determined threshold value, one or more data flows can be re-routed to a different egress link having a higher PMTU, thereby preventing data packet fragmentation.

Packet fragmentation prevention in an SDWAN router

Generally, Software-Defined Wide Area Networks (SD-WAN) generally do not support network segmentation. The concepts disclosed herein connects IPSec SD-WAN fabric to a Virtual Routing and Forwarding (VRF) router and make use of a Software Defined Cloud Interconnect (SDCI) Router to route traffic from IPSec SD-WAN to various cloud services from the SDCI Router in the fabric. The concepts disclosed herein also provides for tunnel multi-plexing that takes incoming and outgoing traffic and maps VPNs to any service VRF associated with the cloud based services.

Mapping of IPSec tunnels to SD-WAN segmentation

An efficient method to handle fragmented packets in multi-node all-active clusters. In one particular embodiment, a method includes receiving an initial fragment packet at a node in a cluster, creating a secondary flow table, linking the secondary flow table to a primary flow table, determining the primary flow owner of the initial fragment packet, and transmitting initial and succeeding fragment packets out of the cluster through, if possible, the primary flow owner.

Efficient handling of fragmented packets in multi-node all-active clusters

Techniques are described for suppressing data plane traffic using a service monitoring policy for data plane control. If a service provided to a router becomes nonfunctional, preventing the router from being able to forward traffic to a next-hop device, data plane traffic from client devices on the data plane that requires the use of the nonfunctioning service is suppressed. Additionally, new communication pathways to the router that will use the nonfunctioning service are prevented from being established. Traffic is redirected to another router with a functioning service. Thus, traffic that may normally be directed to the router with the nonfunctioning service and not able to be forwarded (e.g., blackholing of data) can be forwarded to the other router.

Service access awareness in a distributed architecture

Growing community of inventors

Pleasanton, CA, United States of America

Avinash Shah