Cisco Technology, Inc.

Earl Hardin Booth, Iii

William Mark Townsley

W Mark Townsley

Christopher Metz

Wei Luo

W Scott Wainner

Greg Weber

James Neil Guichard

Wojciech Dec

Luca Martini

Daniel C Tappan

Mohammed Azhar Sayeed

Bertrand Duvivier

David Delano Ward

Stefano Benedetto Previdi

John William Marshall

Thomas David Nadeau

Jean-Philippe Champagne

Richard Manfred Pruss

Jeffrey David Haag

Robert Leroy King

James Ronald Holland, Jr

George Wilkie

Andrew William Keep

In an example, there is disclosed a computing system, including: a processor; a memory; a configuration interface to a logic configuration unit; and a system compiler including: a first block compiler to compile logic for a first logical block in a first language, the first language being a domain-specific language (DSL) and the first logical block being switching logic for a network switch; a second block compiler to compile logic for a second logical block in a second language, the second language being a non-DSL and providing an external accelerator method not supported by the first language; and an interface compiler to define input/output channels for encapsulated data interchange between the first logical block and the second logical block, wherein the encapsulated data interchange is to target a resident instance of the external accelerator method.

Tightly integrated accelerator functions

In one implementation, an original physical profile file and a configuration baseline are stored for a virtual machine. The physical profile file includes physical characteristics of a physical device running the virtual machine. The configuration baseline includes configuration settings or attributes of the instance of the virtual machine. A network device detects current value for at least one physical characteristic and compares the current value to the original physical profile file. When the current values deviate enough from the original physical profile file to exceed a threshold amount of deviation that is permissible, the network device determines that the virtual machine has been moved to another physical device. In response, the network device monitors current configuration settings or attributes with respect to the configuration baseline in order to detect an unauthorized usage of the virtual machine.

Detection of unauthorized use of virtual resources

A method and apparatus for providing information in a network by way of a Pseudowire switching TLV is presented. A second device in the network receives a first message having information relating to a first device in the network. The second device appends information relating to the second device (by way of a Pseudowire switching TLV) to the first message, resulting in a second message. The second message is then forwarded to a third device in the network.

Pseudowire (PW) switching type-length-value (TLV)

In an example embodiment, a method is provided to receive a request message. A client that transmitted the request message then is identified. Here, the client is associated with a client identifier. The client identifier is inserted into a response message, and this response message includes a redirect to a portal. The response message then is transmitted.

Providing identity to a portal with a redirect

Techniques for operating a network interface include automatically determining whether communications are terminated over a particular attachment circuit on a network interface on an intermediate network node at an edge of a provider network, whereby a sign of death (SOD) on the particular attachment circuit is indicated. The attachment circuit is switched with a particular virtual private network that is a link layer virtual private network (VPN) encapsulated in a higher layer protocol. The provider network is a packet-switched network. The network interface is for a direct communication link to a customer network node outside the provider network. If it is determined that there is an indication of the SOD, then a new network action is initiated in response to the SOD on the particular attachment circuit. These techniques allow for automatic logging of usage, billing, and fault detection, as well as for over-subscription of network resources for multiple VPNs.

Techniques for oversubscribing edge nodes for virtual private networks

In one embodiment, a method includes establishing a control channel across a wide area network (WAN) from a first gateway that has a first public internetwork layer (L3) address to a second gateway that has a second public L3 address. Each gateway connects a local area network (LAN) to the WAN. Negotiations over the control channel establish a first set of private L3 addresses for the first LAN and a non-overlapping second set for the second LAN. A different address from the first set is provided for each different node in the first LAN. A discovery packet is received from the first LAN. The discovery packet is encapsulated in a tunnel packet directed to the second public L3 address. The tunnel packet is sent over the WAN to the second gateway which extracts the discovery packet. The second gateway sends the discovery packet over the second LAN.

Simple virtual private network for small local area networks

A method, apparatus and computer program product for routing data within a packet-switched network using a PW wherein the PW is terminated directly on the layer-3 routing device such that certain services and applications can be utilized is presented. The method, apparatus and computer program product receives an encapsulated layer-2 Protocol Data Unit (PDU) from a pseudowire emulating a service. The encapsulation is removed from the encapsulated layer-2 PDU and a layer-2 circuit associated with the pseudowire is terminated. The circuit is treated as an interface and the PDU is forwarded based on upper layer protocol information within the PDU.

Psuedowire termination directly on a router

In one embodiment, software code in a respective computer system such as one or more data communication devices establishes multiple layer 2 network links between a first data communication device and a second data communication device. The first data communication device and the second data communication device include corresponding layer 3 interfaces enabling layer 3 network communications over each of the multiple layer 2 network links. The first and second data communication devices route traffic over one (e.g., a primary layer 2 link) of the multiple layer 2 network links using the layer 3 network communications. The private links are media independent. Upon detection of a failure associated with the primary layer 2 link, the data communication devices can automatically switch to sending traffic over a backup link of the multiple layer 2 network links without disrupting publicly advertised routing topology information.

Communication techniques and generic layer 3 automatic switching protection

Techniques for configuring a particular network interface on a particular node at an edge of a provider network to support a particular virtual private network include receiving customer input data. The provider network is a packet-switched network and the particular virtual private network is a link layer virtual private network. The customer input data indicates a topology for customer equipment devices outside the provider network on the particular virtual private network, and may include properties for corresponding interfaces that connect the customer equipment devices to the edge nodes. Based on the customer input data, configuration data is determined for configuring the particular interface at the particular node. The particular node is caused to configure the particular interface based on the configuration data without human intervention. Among other effects, these techniques support zero-touch provisioning of virtual private networks.

Techniques for customer self-provisioning of edge nodes for a virtual private network

Conventional network packet traffic loss/drop monitoring mechanisms, such as that employed for pseudowire, IP flow and tunnel traffic monitoring, do not process or diagnose the aggregate counts from both endpoints of a particular pseudowire. A packet loss and detection mechanism periodically exchanges traffic packet counts to maintain an accurate diagnosis of the pseudowire health from either endpoint. Further, the raw packet counts are analyzed to identify misrouted and lost packets, as both should be considered to assess network health and congestion. The pseudowire statistics are maintained for each pseudowire emanating from a particular edge router, providing a complete view of pseudowire traffic affecting a particular edge router. Such statistics are beneficial for problem detection, diagnosis, and for verification of throughput criteria such as those expressed in Quality of Service (QOS) terms and/or SLAs (service level agreements).

Method and apparatus for packet loss detection

A method and apparatus for processing a signal on an intermediate network node at an edge of a provider packet-switched network to support a link-layer virtual private network includes receiving a signal on a particular interface. The particular interface is for a direct communication link to a customer network node outside the provider network. It is determined whether the signal indicates that the particular interface is changing from an inactive state to an active state, whereby the signal is called first sign of life (FSOL). If it is determined that the signal is FSOL, then configuration data is determined for configuring the particular interface for the particular virtual private network. The signal is processed based on the configuration data. These techniques allow a dynamic response to new signals on a customer interface without human intervention by the provider.

Techniques for using first sign of life at edge nodes for a virtual private network

A method and apparatus for performing Layer 2 (L2) interworking is presented. A L2 Protocol Data Unit (PDU) is received at an L2 Switching Entity (SE). The L2 PDU is converted to a normalized Pseudowire (PW) PDU. The normalized PW PDU is then forwarded to a Layer 3 (L3) Routing Entity (RE). The normalized PDU may be in the form of a predetermined L2 protocol or a L2 agnostic protocol.

Layer-two interworking applied to L2-L3 pseudowires

A method and apparatus for configuring a network interface to support a virtual private network includes storing configuration data at a server on a host computer on the provider network. It is determined whether conditions are satisfied for sending the configuration data to a particular node at an edge of the provider network. If it is determined that conditions are satisfied, then the configuration data is sent to the particular node to cause the particular node to configure a particular interface for supporting a virtual private network over the provider network based on the configuration data without human intervention. The provider network is a packet-switched network and the particular virtual private network is a link layer virtual private network. The particular node is different from the host. The particular interface is for a direct communication link to a customer network node outside the provider network.

Growing community of inventors

Raleigh, NC, United States of America

Earl Hardin Booth, Iii