Telefonaktiebolaget Lm Ericsson (publ)

Palo Alto Networks, Inc.

Cisco Technology, Inc.

Ericsson Ab

Brian Russell Kean

Jayant Jain

Mingfei Peng

Aditya Srinivasa Ivaturi

George Apostolopoulos

Chandramouli Balasubramanian

Suraj Jaiswal

Santosh Panattu Sethumadhavan

Mohit Sahni

Peter J Owens

Uttam Ramesh

Sanjay Kumar Hooda

Prashanth Venugopal

Ramanathan Lakshmikanthan

Renhua Wen

Srivatsan Rajagopal

Arunkumar M Desigan

Swapna Yelamanchi

Staffan Bonnier

Neelesh Bansod

Peter Owens

Srikanth Ramachandran

Sudhagar Chinnaswamy

Parag M Panse

Yakob Teplitsky

Harieasswar Lakshmidevi

Nidhi Shah

Jacob Rameen Chitsaz

Harish Kumar Lohar

Srikanth Mulakaluri

Techniques for wildcard based private application access are disclosed. In some embodiments, a system, a process, and/or a computer program product for wildcard based private application access includes receiving a request for access to an application over a secure access service edge (SASE) network for a user associated with an enterprise; determining if the request for access to the application matches a wildcard (e.g., the wildcard can be configured by an administrator of the enterprise for matching a fully qualified domain name (FQDN) for the application); and automatically configuring access information (e.g., IP address, protocol, and destination port) for the application that matches the wildcard.

Wildcard based private application access

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a tenant's network fabric, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port/protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a domain name system entry that resolves the application name to its virtual Internet Protocol (IP) address and destination network address translation rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

Configuring application availability using anycast addressing

A data packet is received. It is determined whether the data packet is encapsulated. One or more security policies are applied to the data packet based on whether the data packet is encapsulated.

Preserving security information over NAT enabled devices using encapsulation

A network controller communicates a wildcard domain name defined by a tenant and IP addresses of data centers for which a tenant has configured that wildcard to network elements of a network fabric through which the data centers are accessible. Each network element creates a rule to forward DNS requests with FQDNs that match the wildcard to each data center IP address. When a network element receives a DNS request indicating a FQDN that matches the wildcard, the network element forwards the DNS request to each data center IP address. Each data center element associated with one of the IP addresses receives the DNS request and determines if the FQDN can be resolved to an IP address in that data center. Data center elements for which domain name resolution is successful notify the network controller, which onboards the resource corresponding to the FQDN in that data center.

Multiple data center compatible deployment of applications matching a wildcard domain name

A controller can securely publish an application of a tenant by securely extending a network fabric into the networks of the tenant with virtual private networks and NAT. After a tenant deploys an application into one or more networks of the tenant, the tenant can indicate select applications to publish. The network controller assigns a network address from the routable address space of the network fabric to the application and a network address aggregate to each application connector that will front an instance of the application, which securely extends the network fabric into the tenant network. The network controller configures NAT rules in the network fabric and on the application connector to create a route for traffic of the application through the network fabric to the application instance using a fully qualified domain name assigned to the application without exposing a private network address of the application instance and preserving security of other resource on the tenant network.

Securely publishing applications from private networks

Present technology is directed to a system and method for implementing an offline scheme to automatically and efficiently transform a set of conventional IP-based Access Control Entries in a supplied configuration into compressed form that can then be represented as Object-Group based Access Control Entries. The compression is performed on contiguous blocks of the supplied Access Control List having a common prescribed filtering access. The compression is performed by iteratively selecting a data field with mismatching data values across the ACEs and merging the data values into a corresponding data field of the output ACE. The common values of other data fields are then imported to the corresponding data fields of the output ACE. The process is repeated in an iterative manner by assigning a different data field as the selected data field for each iteration round.

System and method for migrating existing access control list policies to intent based policies and vice versa

Each application executing on an application server uses an extended version of the Berkeley Packet Filter (BPF) language to define an application-specific rule set. The application server also includes a Just-In-Time compiler to compile the BPF rule set. The compiled rule set is downloaded to a Packet Forwarding Entity (PFE) in the network, and used to control how the PFE steers data packets generated by the application through a communications network.

Optimizing traffic load in a communications network

A method performed in a network element of a provider edge network to determine a downlink service path for a downlink packet. The method includes preserving an indication of the downlink service path while processing an uplink packet that has been transmitted from a subscriber end station toward a provider end station. The method also includes receiving the downlink packet at a line card of the network element. The downlink packet has been transmitted from the provider end station toward the subscriber end station. The method further includes determining, at the line card, the downlink service path for the downlink packet by using the indication of the downlink service path that was preserved while processing the uplink packet. The downlink service path is operable to identify a plurality of services and an order in which the plurality of services are to be performed on the downlink packet.

Downlink service path determination for multiple subscription based services in provider edge network

A packet gateway (PGW) receives a plurality of IP packet fragments from a network. The IP packet fragments comprise a head fragment and one or more trailing fragments, and are associated with a first IP packet. As the fragments are received, a controller at the PGW classifies the fragments. The controller applies a same selected service treatment to the head fragment and to each of the trailing fragments based on the classification of the head fragment. The PGW then sends each treated packet fragment to an end user device.

Policy control enforcement at a packet gateway

A set of forwarding elements act as a gateway to a data network for a subscriber end station. A controller network element includes a control plane operable to communicate with the forwarding elements, which are operable to communicate with the subscriber end station. The controller network element includes a quota management module, which determines a quota amount to be assigned to the forwarding elements for a traffic flow. The quota management module assigns portions of the quota amount to the forwarding elements. The quota management module determines to change the distribution of an unconsumed quota amount amongst the forwarding elements for the traffic flow, determine the unconsumed quota amount, and determine and assign portions of the unconsumed quota amount to the forwarding elements.

Intelligent traffic quota management in split-architecture networks

Methods and apparatus are disclosed for defining an optimized media path. In one exemplary method, a proxy session controller registers, for a plurality of realms, a plurality of Border Gateway Functions (BGFs) residing on a plurality of network nodes, with the registration including registering a preferred BGF colocated with a data network gateway on a single network node for a selected set of the realms. A request message is received from a user terminal, and if a realm associated with the request message is included in the selected set of realms, the controller assigns the preferred BGF to the user terminal to provide an optimized media path that includes the user terminal, the preferred BGF, and the data network gateway.

Media plane optimization for voice over LTE

A method and apparatus for brokering a transmission control protocol (TCP) session between two clients that are each situated behind a firewall that blocks incoming TCP session requests is described. Each of the two clients transmits a TCP session request to the other client in order to establish a TCP session between these clients. This brokering allows the two clients to establish the TCP session between the two clients.

Stateless transmission control protocol rendezvous solution for border gateway function

A network element acts as a gateway to a data network for a subscriber end station. The network element includes control plane operable to communicate with a first network processing unit (NPU) and a second NPU, which are operable to communicate with the subscriber end station. The control plane includes a quota management module, which determines a quota amount to be assigned to the first NPU and the second NPU. The quota management module assigns a portion of the quota amount to the first NPU and another portion of the quota amount to the second NPU. The quota management module may determine to change the distribution of an unconsumed quota amount between the first NPU and the second NPU, determine the unconsumed quota amount, and assign a portion of the unconsumed quota amount to the first NPU and another portion of the unconsumed quota amount to the second NPU.

Intelligent traffic quota management

A method for providing Quality of Service (QoS) for a Multilink Protocol (MP) subscriber at the subscriber level is described. In one embodiment of the invention, a network element fragments a packet destined for a subscriber into multiple fragments and adds any necessary encapsulations (e.g., MP protocol encapsulation, Point-to-Point protocol encapsulation, layer 2 encapsulations). The network element links the fragments together to form a MP batch packet. The network element sends the MP batch packet to a single egress queue associated with the subscriber. The fragments are distributively transmitted across the links associated with the subscriber. Other methods and apparatuses are also described herein.

Growing community of inventors

Cincinnati, OH, United States of America

Brian Russell Kean