Cisco Technology, Inc.

Gautam M Aggarwal

Dana Lynn Blair

Plamen Nedeltchev

Pritam Shah

Ajith Thrivikramannair

Pedro Leonardo

David Sisto Iacobacci

Parag Pritam Thakore

Helder F Antunes

Anuj Sawani

Max Pritikin

Siva S Jayasenan

Indrajanti Sukiman

William C Melohn

In one embodiment, a device and a services provisioning system establish an over-the-air connection with each other, and perform device posture validation to obtain a unique identification (ID) of the device at the provisioning system. The device and provisioning system then participate in device and user authentication in response to a confirmed unique ID by a backend access control system, where the device generates a secure key pair after successful user authentication. In response to the device being approved for services (e.g., checked by the provisioning system via a registration system), the provisioning system provides a root certificate to the device, and the device sends a certificate enrollment request back to the provisioning system. In response to a certificate authority signing the certificate request, the provisioning system returns a valid certificate to the device, and the valid certificate is installed on the device.

Secure over-the-air provisioning solution for handheld and desktop devices and services

Secure over-the-air provisioning for handheld and desktop devices and services

In one embodiment, a plurality of spoke-to-hub virtual private network (VPN) tunnels are established from a spoke router located at an edge of a spoke network to a hub network. The spoke router is configured as an optimized edge routing (OER) node. The spoke router monitors a network statistic for each of a plurality of prefixes on each of the plurality of spoke-to-hub VPN tunnels. The monitored network statistic is analyzed to determine whether a distribution of traffic between the spoke network and the hub network can be optimized. In the event the distribution of traffic between the spoke network and the hub network can be optimized, traffic is redistributed on a per-prefix basis among the plurality of spoke-to-hub VPN tunnels based on the monitored network statistic, such that at least a portion of the traffic is routed over each of the plurality of spoke-to-hub VPN tunnels.

Technique for using OER with an ECT solution for multi-homed sites

A technique dynamically utilizes a plurality of multi-homed Virtual Private Network (VPN) tunnels from a client node to one or more enterprise networks in a computer network. According to the technique, a VPN client node, e.g., a 'spoke,' creates a plurality of multi-homed VPN tunnels with one or more servers/enterprise networks, e.g., 'hubs.' The spoke designates (e.g., for a prefix) one of the tunnels as a primary tunnel and the other tunnels as secondary (backup) tunnels, and monitors the quality (e.g., loss, delay, reachability, etc.) of all of the tunnels, such as, e.g., by an Optimized Edge Routing (OER) process. The spoke may then dynamically re-designate any one of the secondary tunnels as the primary tunnel for a prefix based on the quality of the tunnels to the enterprise. Notably, the spoke may also dynamically load balance traffic to the enterprise among the primary and secondary tunnels based on the quality of those tunnels.

A technique dynamically creates and utilizes a plurality of multi-homed Virtual Private Network (VPN) tunnels from a client node of one spoke network to a client node of another spoke network in a computer network. According to the technique, a VPN client node, e.g., a 'spoke,' creates at least one VPN tunnel with an enterprise network, e.g., a 'hub.' Once the spoke-to-hub tunnel is established, the spoke may dynamically create a plurality of VPN tunnels with a peer spoke network, e.g., a &#x201c;peer spoke.&#x201d; The spoke designates (e.g., for a prefix) one of the tunnels as a primary tunnel and the other tunnels as secondary tunnels, and monitors the quality (e.g., loss, delay, reachability, etc.) of all of the dynamic tunnels, such as, e.g., by an Optimized Edge Routing (OER) process. The spoke may then dynamically re-designate any one of the secondary tunnels as the primary tunnel for a prefix based on the quality of the tunnels to the peer spoke. Notably, the spoke may also dynamically load balance traffic to the peer spoke among the primary and secondary tunnels based on the quality of those tunnels.

Technique for using OER with an ECT solution for multi-homed spoke-to-spoke sites

According to an approach for securely deploying and configuring network devices, a secure introduction connection is established between a network device being deployed and a registrar. The secure introduction connection may conform to a secure communications protocol, such as HTTPS. The registrar provides bootstrap configuration data to the network device over the secure introduction connection. The bootstrap configuration data is used to establish a secure management connection between the network device and a secure management gateway. The secure management connection may conform to a secure communications protocol, such as IPsec or HTTPS. The secure management gateway provides user-specific configuration data and security policy data to the network device over the secure management connection. The user-specific configuration data and policy data are used to establish a secure data connection, such as a Dynamic Multipoint Virtual Private Network (DMVPN) connection, between the network device and the secure data gateway.

Approach for securely deploying network devices

According to an approach for assigning network addresses to network devices, an authentication request that requests authentication of identification data that uniquely identifies a network device is generated and sent to an authentication mechanism. An authentication response is received from the authentication mechanism that indicates whether the network device is authorized to access a first network. If the authentication response indicates that the network device is authorized to access the first network, then a first network address on a first network is assigned to the network device. If the authentication response indicates that the network device is not authorized to access the first network, then a second network address on a second network to the network device is assigned. If no authentication response is received from the authentication mechanism, then the second network address on the second network is assigned to the network device.

Growing community of inventors

San Ramon, CA, United States of America

Gautam M Aggarwal