Juniper Networks, Inc.

International Business Machines Corporation

Goutham Kondapavuluru

Vijay Sai Ram Paruchuri

Sharanagoud B Devaraddi

Ramesh Biradar

Sarvesh K Batta

Rajesh S

Indrakumar M

Gang Tang

Ming Shuang Xian

Lei Bao

Ranjan Sinha

Provided are a method, system, and computer program product in which a cross virtual private cloud (VPC) network connectivity is configured, wherein one or more policies have been defined by entities in the VPC. Policy changes are monitored, and based on the one or more policies, an adding of endpoints or topology information from a source VPC to a target VPC is performed, in response to a policy definition allowing the adding of the endpoints. Operations are performed for removing external endpoints or topology information from an affected VPC, in response to receiving a denial indication.

Distributed transit gateway

A network device may create an encrypted packet and may duplicate the encrypted packet to create a plurality of encrypted packets that includes a first set of encrypted packets that is associated with a first receiving network device and a second set of encrypted packets that is to be associated with a second receiving network device. The network device may modify the second set of encrypted packets by replacing a first virtual destination address in the second set of the plurality of encrypted packets with a second virtual destination address that identifies a virtual tunnel endpoint of the second receiving network device. The network device may encapsulate and may send, based on the first virtual destination address and the second virtual destination address, individual encapsulated encrypted packets to the first receiving network device or the second receiving network device.

Efficient encryption and decryption of duplicate packets communicated via a virtual private network

A device may transmit a packet for communicating via a tunnel. The packet may be associated with a protocol. The device may determine that the packet has been dropped by a security device. The device may selectively encrypt, after determining that the packet has been dropped, the packet using a null encryption for transport layer security (TLS) or a combination of encryption associated with the protocol and TLS encryption to generate an encrypted packet. The device may transmit the encrypted packet for communicating via the tunnel.

Selective transport layer security encryption

A first network device may communicate, in association with a tunnel establishment network protocol, with a second network device to cause a network tunnel between the first network device and the second network device to be established. The first network device may determine, based on communicating with the second network device to cause the network tunnel to be established, that the network tunnel is to support network micro-tunnel functionality within the network tunnel. The first network device may communicate, based on determining that the network tunnel is to support network micro-tunnel functionality, with the second network device to identify a traffic class, of one or more traffic classes, to which network micro-tunnel functionality within the network tunnel is to be applied. The first network device may cause a network micro-tunnel to be established within the network tunnel for traffic associated with the traffic class.

Establishing a network micro-tunnel within a network tunnel

A network device may receive, from a transmitting network device, a packet, wherein the packet includes a first outer internet protocol (IP) header, a Generic Routing Encapsulation (GRE) header, a second outer IP header, an Encapsulating Security Payload (ESP) header, and an inner packet, wherein the inner packet is encapsulated by the ESP header, the ESP header is encapsulated by the second outer IP header, the second outer IP header is encapsulated by the GRE header, and the GRE header is encapsulated by the first outer IP header. The network device may decapsulate the packet to remove the first outer IP header and the GRE header from the packet. The network device may decrypt, after decapsulating the packet, the packet to identify the inner packet. The network device may cause one or more actions associated with the inner packet to be performed.

Transmitting multiple copies of an encrypted packet via multiple tunnels between a transmitting network device and a receiving network device

A network node may receive a packet having an inner internet protocol (IP) header and an outer IP header. The inner IP header may be encrypted. A loose source routing (LSR) field of the outer IP header may identify a recipient address. The network node may determine, based on the recipient address identified in the LSR field, a tunnel endpoint associated with a receiving network node. The network node may update the outer IP header of the packet to obtain an updated packet with an updated outer IP header. A source address of the updated outer IP header may be updated to a tunnel endpoint associated with the network node, and the destination address of the updated outer IP header may be updated to a tunnel endpoint associated with the receiving network node. The network node may route the updated packet according to the updated outer IP header.

GRE tunneling with reduced packet encryption at intermediate routers using loose source routing

A network node may receive a packet having an inner internet protocol (IP) header and an outer IP header. The inner IP header may be encrypted. The network node may generate a copy of the packet to obtain a copied packet. The network node may perform decryption on one of the packet or the copied packet to identify a recipient address of the inner IP header. The network node may update the outer IP header of the other of the packet or the copied packet to obtain an updated packet with an updated outer IP header. A destination address of the updated outer IP header may be updated to a tunnel endpoint of a receiving network node that is associated with the recipient address. The network node may route the updated packet according to the updated outer IP header.

Growing community of inventors

Bengaluru, India

Goutham Kondapavuluru