Big Switch Networks, Inc.

Gregor Maier

Srinivasan Ramasubramanian

Sudeep Modi

Mei Yang

Robert Wesley Sherwood

Kanzhe Jiang

Mandeep Singh Dhami

Vishnu Emmadi

Rajneesh Bajpai

Kuang-Ching Wang

Xin Wu

Shrinivasa Kini

Jason Parraga

Ning Song

Kenneth Hsinchao Chiang

Carl D Roth

Andreas Wundsam

Richard Lane

Richard Leegan Lane, Ii

Jeffrey Townsend

Sumit Arun Naiksatam

Cham Ho Li

Michael Cohen

Tomasz Klimczyk

Methods, systems, and computer programs are presented for creating a secure network fabric and for adding trusted devices to an existing secure network fabric. One method includes an operation for setting a switch into a provisioning mode where the switch does not enforce secure communications. While the switch is in provisioning mode, the method performs operations including establishing a connection from the switch to a provisioning controller, sending a certificate signing request (CSR) from the switch to the provisioning controller, and receiving, from the provisioning controller, a security certificate generated by a certificate authority. The method further includes an operation for entering a lockdown mode by the switch after receiving the security certificate, where the switch, while in lockdown mode, secures communications utilizing the security certificate.

Systems and methods to securely construct a network fabric

Methods, systems, and computer programs are presented for distributing network address translation (NAT) operations to a plurality of network devices on a network. One method includes an operation for identifying, by a controller that controls a network fabric, a plurality of switches in the network fabric, each switch having a module for NAT and being configured to forward packets received at the switch. The controller identifies hosts having at least one internal Internet Protocol (IP) address, and for each of the hosts, the controller selects one of the switches from the plurality of switches for performing the NAT for the host. Further, the controller configures the network fabric to cause the selected switch to perform the NAT for the host to enable the host to communicate with an external network. In case of switch failure, the system reallocates NAT loads to other switches for high availability.

Systems and methods for network address translation

A network of switches having ports coupled to other switches or end hosts may be controlled by a controller. The controller may identify whether any switch ports have failed. In response to identifying that a port has failed at a first switch, the controller may modify link aggregation group mappings of the other switches to handle failover. The controller may modify the link aggregation group mapping of each other switch to include a first mapping that includes ports coupled to the first switch and a second mapping that does not include any ports coupled to the first switch. The controller may configure forwarding tables at the switches to forward network packets using the first or second mappings based on network topology information maintained by the controller.

Systems and methods for handling link aggregation failover with a controller

A controller implemented on computing equipment may be used to control switches in a network. End hosts may be coupled to the switches. The controller may generate a virtual network topology of virtual switches, virtual routers, and virtual system routers that are distributed over underlying switches in the network. The controller may form virtual switches from respective groups of end hosts, virtual routers from groups of virtual switches that include virtual interfaces that are coupled to virtual switches, and a virtual system router from groups of virtual routers that includes virtual system router interfaces that are coupled to the virtual routers. The controller may control the virtual network topology by generating respective flow table entries based on identified network policies for each of the virtual routers, virtual system routers, and virtual switches. The controller may control the virtual system routers to route packets between the virtual routers.

Systems and methods for performing logical network forwarding using a controller

A packet forwarding network may include switches that forward network traffic between end hosts that are coupled to the forwarding network. An analysis network may be connected to the forwarding network. A controller may control the switches in the forwarding network to implement desired forwarding paths. The controller may configure the switches to form switch port groups. The controller may identify a port group that is connected to the analysis network. The controller may select a subset of the forwarded packets and may control selected switches to copy the subset to the identified port group. The controller may establish network tunnels between the switches and the port group. In this way, the controller may control the switches to perform efficient traffic monitoring regardless of the location on the forwarding network at which the traffic monitoring network is connected and without interfering with normal packet forwarding operations through the forwarding network.

Systems and methods for controlling switches to capture and monitor network traffic

A controller implemented on computing equipment may control switches in a network. The controller may provide flow tables that implement network policies to the switches to control packet forwarding through the network. The controller may provide debug table entries to the switches for use in a debug table that is separate from the flow table. The debug table entries may match incoming network packets and increment corresponding counters on the switches. The controller may retrieve count information from the counters for performing debugging operations on the network. For example, the controller may identify conflicts between fields of a selected flow table entry, determine whether elephant packet flows are present between switches, determine whether desired load balancing is being performed, determine whether a network path has changed, determine whether packet loss has occurred, and/or determine whether network packets are taking undesired paths based on the retrieved count information.

Systems and methods for performing debugging operations on networks using a controller

A controller implemented on computing equipment may be used to control switches in a network. End hosts and service devices may be coupled to the switches in the network. The controller may generate a virtual network topology of virtual switches and virtual routers. The controller may control the virtual routers and/or virtual switches to perform service insertion. The controller may perform service insertion by controlling the virtual routers and/or virtual switches to redirect network traffic through one or more selected service devices. The controller may determine which network traffic is to be redirected to which service devices based on a service insertion policy that identifies network traffic and services to be performed on the network traffic.

Systems and methods for performing network service insertion

Growing community of inventors

Alameda, CA, United States of America

Gregor Maier