Hewlett Packard Enterprise Development LP

Hewlett-packard Development Company, L.p.

Craig Joseph Mills

Charles F Clark

Shaun Wakumoto

Kaushik Datta

Parvez Syed Mohamed

Shaun Wackerly

Frank J Wood

Venkatavaradhan Devarajan

Duane Edward Mentze

Ramachandra Yalakanti

Jechun Chiu

Christopher Wild

Ryan Curcio

A network configuration development environment is disclosed. In particular, an editor configured to interface with multiple network devices simultaneously, to view and adjust their device configuration settings, is provided. The network configuration development environment allows a system administrator to manage configuration definitions (e.g., run-time or start-up device configuration parameters) relative to a plurality of network devices simultaneously to achieve correctness and appropriate consistency for each of those devices in a network infrastructure. The network development environment may include an ability to apply changes directly to one or more network devices or to apply changes to stored 'configuration files' that are associated with individual devices. Changes to stored configurations may be applied automatically, for example, within a maintenance window for the network, in a controlled manner with a 'roll-back' capability in the event of failure or unexpected result as a consequence of the automatically applied changes.

System for simultaneous viewing and editing of multiple network device configurations

Examples include blocking an interface of a sponsor networking device from receiving data packets and receiving at the sponsor networking device an authentication packet from a first networking device. The first networking device is physically connected to the interface. Examples also include automatically setting by the first networking device, a unique local address for the first networking device; receiving, at the sponsor networking device, a local data packet from the first networking device, and translating, by the sponsor networking device, the local data packet to an off-fabric data packet.

Self forming local fabric

A network configuration change validation environment is disclosed. In particular, this disclosure is related to an interface to initiate automated test actions (e.g., network monitoring commands, application monitoring commands, etc.) and to view results in an efficient manner to support a network communication infrastructure. In one example, results of a set of commands executed prior to a configuration change may serve as a baseline and one or more results of the same set of commands may be intelligently compared to the baseline to identify any potential issues that have arisen. For example, as a result of a specific network configuration change or application update. The disclosed network change validation command initiator and validation report viewer represent part of an overall network configuration change validation environment that includes automated techniques such that it may be used within a given change window.

System and method for validating correctness of changes to network device configurations

Systems and methods to identify a plurality of different snapshot versions for a rollback to a previous configuration for subsets of network infrastructure devices is disclosed. A plurality of different network device configuration snapshots is identified and a set of snapshot checkpoints that each include a set of related parameter settings for each different network device are selected as a rollback configuration snapshot for that device. Each device may be associated with automated validation capabilities to validate a proposed rollback version. The computer system may iterate through a set of versions of snapshots and automatically initiate validation capabilities to validate a proposed rollback for the first logical grouping. Determination of a set of configurations may be based on a version control tag to restore a network to an operational state, never before seen in operation, that has a high degree of confidence, in part, because validation tests were successful.

Intelligent rollback analysis of configuration changes

A network configuration development environment including an insights enabled editor is disclosed. In particular, this disclosure is related to an editor that provides just-in-time information in an insights area to assist a network developer to configure parameter settings for one or more network devices. In one example, attributes of a switch are the area of focus of a current edit session, and, based on this area of focus, the insights editor may query the switch to obtain current information. Information returned from the switch may be provided in an 'insights area' visible to the user about to edit settings for that same switch. The disclosed insights editor represents part of an overall network configuration development environment that includes automated techniques to assist with network configuration, design and maintenance.

System and method to provide network insights for correct and efficient network configuration

Methods, network controllers, and machine-readable and executable instructions are provided for network controller provisioned MACsec keys. A network controller can provision a first network device with a media access control security (MACsec) key for a MACsec flow. The network controller can provision a second network device with the MACsec key for the MACsec flow.

Network controller provisioned MACsec keys

Examples disclose a system comprising an integrated circuit to determine whether a data packet should be processed by a shared security engine associated with a secure link. Additionally, the examples disclose a first media access control (MAC), associated with the shared security engine, to receive the data packet for transmission on the secure link based on the determination the data packet should be processed by the shared security engine.

Routing a data packet to a shared security engine

Network service insertion includes determining a tunnel interface corresponding to a service entity to which an incoming packet is to be directed, the tunnel interface being determined based on software defined network (SDN) flow rules. Further, the incoming packet can be encapsulated based on a tunnel configuration corresponding to the tunnel interface to generate an encapsulated packet such that the encapsulated packet includes media access control (MAC) address headers and a virtual local area network (VLAN) tag associated with the incoming packet. The encapsulated packet can be sent to the service entity through the tunnel interface for network service insertion.

Network service insertion

Applying an MSTP configuration can include instructing a plurality of network devices to disable non-MSTP links in response to a verification of receipt of the MSTP configuration and instructing the plurality of network devices to apply the MSTP configuration in response to a verification that each of the plurality of network devices disabled the non-MSTP links.

Applying a multi-instance spanning tree protocol (MSTP) configuration

Methods, network controllers, and machine-readable and executable instructions are provided to determine a secure path between a source device and a destination device. The secure path may be via a plurality of network devices. The secure path may be determined based on a security capability of each of the plurality of network devices in the secure path. Data may be forwarded between the source device and the destination device, via the plurality of network devices, based on the determined path.

Secure path determination between devices

Systems and methods for provisioning and managing of certificates in a network are described. In one implementation, a signing certificate is generated by a network device based on a root certificate of the network device. Based on the signing certificate of the network device, a client-device certificate is signed for a client device. The signed client-device certificate is provided to the client device for allowing the client device to access a secure service provided by the network device.

Provisioning and managing certificates for accessing secure services in network

A certificate grant list is provided. The certificate grant list may be stored in a memory, at the network device. The certificate grant list may store information associated with a client-device certificate, where the client-device certificate permits the client-device access to a secure service.

Certificate grant list at network device

A network-based application can establish a secure network connection to a switch. A unique identifier (UID) is generated for the network-based application, and a secure authentication request is generated from the network-based application. The UID for the network-based application is embedded in the secure authentication request. The secure authentication request is communicated to the switch. A response to the secure authentication request is received from the switch. One or more operations are performed that utilize the UID to establish a secure communication channel between the network-based application and the switch.

Securely establishing a communication channel between a switch and a network-based application using a unique identifier for the network-based application

Growing community of inventors

Roseville, CA, United States of America

Craig Joseph Mills