Cisco Technology, Inc.

Juniper Networks, Inc.

Guy Fedorkow

Gary S Muntz

Mark Andrew Gustlin

Mohammed Ismael Tatar

Promode Nedungadi

Garry Paul Epps

Steven Philip Holmes

Steven E Jacobs

Sambasiva Rao Katta

Randall A Johnson

David Doak

Robert C Olsen

Alon Shlomo Bernstein

Ofer Weill

Kenneth Harvey Potter, Jr

Kenneth H Potter

Kent A Watsen

Christopher J Kappler

Ramesh Sivakolundu

Michael F Keohane

John A Joyce

Timothy Patrick Donahue

Kent H Hoult

William P Brandt

John P Prokopik

Michael J Taylor

Ori Finkelman

Vijay J Savla

Michael E Wildt

Maruthingendra P Rachepalli

Nagarajan Swaminathan

Michael B Milano

Gaash Hazan

A network device may receive a redundant identifier certificate associated with a redundant routing module, and may provide, to a bootstrap device, a primary identifier certificate associated with a primary routing module associated with the network device. The network device may establish a secure connection with the bootstrap device based on the bootstrap device verifying an authenticity of the primary routing module via the primary identifier certificate. The network device may provide, to the bootstrap device via the secure connection, a redundant routing module identifier associated with the redundant routing module and may receive, from the bootstrap device via the secure connection, a signed certificate chain associated with the redundant routing module. The network device may verify the signed certificate chain and may verify the redundant identifier certificate, associated with the redundant routing module, based on verifying the signed certificate chain.

Facilitating authentication of routing modules associated with one or more network devices to allow zero touch provisioning

Techniques are disclosed for performing secure remote bootstrapping operations of a network device such that sensitive configuration resides in volatile memory or is inaccessible upon power loss. In one example, a network device performs a first request for onboarding information. In response to determining that a first initialization of the network device has not occurred, the network device performs the first initialization by configuring, with the onboarding information, the network device to mount a portion of a file system to a volatile memory and not a non-volatile memory. After rebooting, the network device performs a second request for the onboarding information. In response to determining that the first initialization of the network device has occurred, the network device performs a bootstrapping operation of the network device. The bootstrapping operation may configure the network device for remote management such that any subsequent configuration obtained remotely is not retained on power loss.

Secure remote bootstrapping of network device

In one example, a Cable Modem Termination System (CMTS) analyzes received service flow traffic to estimate Quality of Experience (QoE) at the endpoints. An admission control system on the CMTS uses the QoE estimate to determine whether to admit new service flows.

QoE based admission control

A dispatching technique dispatches packets to a plurality of service control engines (SCEs) which in aggregate may be configured to handle traffic produced by a high-speed high-capacity data link. Upstream and downstream packets that are associated with a data flow between a subscriber and a destination node in a communication network are received from by a dispatcher which is located in a path used by the data flow. For each packet, the dispatcher identifies an SCE from among a plurality of SCEs that is to receive the packet based upon an address contained in the packet. The packet is then dispatched by the dispatcher to the identified SCE which processes the packet accordingly. After processing the packet, the SCE returns the packet to the dispatcher which further processes the packet including transferring the packet onto the communication network towards its destination.

Technique for dispatching data packets to service control engines

Presently disclosed is an apparatus and method for returning control of bandwidth allocation and packet scheduling to the routing engine in a network communications device containing an ATM interface. Virtual circuit (VC) flow control is augmented by the addition of a second flow control feedback signal from each virtual path (VP). VP flow control is used to suspend scheduling of all VCs on a given VP when traffic has accumulated on enough VCs to keep the VP busy. A new packet segmenter is employed to segment traffic while preserving the first in, first out (FIFO) order in which packet traffic was received. Embodiments of the invention may be implemented using a two-level (per-VC and per-VP) scheduling hierarchy or may use as many levels of flow control feedback-derived scheduling as may be necessitated by multilevel scheduling hierarchies.

Hierarchical flow control for router ATM interfaces

A port adapter for connecting zero or more network interfaces to a host system having a SPI-4 bus is disclosed. The port adapter comprises zero or more network interfaces; a SPI-4 bus coupled to a host system to provide a communication channel between the host and the network interfaces; a control bus coupled to the host system for controlling and monitoring the port adapter; and interface logic that interfaces the SPI-4 bus and the control bus to the network interfaces. Methods are provided for selecting and using one of a small plurality of different packet formats for various networking technologies, so that the port adapter can hide details of the technology that it handles from the host system, and for operating the host system's SPI-4 bus at one of several speeds based on bandwidth requirements of the port adapter.

Port adapter for high-bandwidth bus

In one embodiment, an intermediate node includes one or more active forwarding planes and one or more redundant forwarding planes. The intermediate node may also include one or more active control planes and one or more redundant control planes. A test packet is generated, in some cases by a redundant control plane, and transferred to a redundant forwarding plane. The operational state of the redundant forwarding plane is verified, at least in part, by using operational software and hardware contained in the redundant forwarding plane to forward the test packet from the redundant forwarding plane to a target line card. The target line card loops the test packet back to the redundant forwarding plane as part of the verification process. In some cases, the redundant control plane processes the looped-back test packet.

Method for verifying function of redundant standby packet forwarder

An aggregation router architecture comprises a plurality of line cards coupled to at least one performance routing engine (PRE) via an interconnect system. The line cards include input cards having input ports coupled to subscribers and at least one trunk card configured to aggregate packets received from the subscriber inputs over at least one output port. The PRE performs packet forwarding and routing operations, along with quality of service functions for the packets received from each input line card over the interconnect system. The interconnect system comprises a plurality of high-speed unidirectional (i.e., point-to-point) links coupling the PRE to each line card. The point-to-point links couple the line cards to a novel logic circuit of the PRE that is configured to interface the line cards to a packet buffer and a forwarding engine of the PRE.

High performance interface logic architecture of an intermediate network node

A flow bit mechanism and technique conveys per-channel flow control information pertaining to the status of output buffers located on line cards to at least one performance routing engine (PRE) of an intermediate network node, such as an aggregation router. Each line card generates a flow bit for each of its output buffers associated with an output channel. The state of the flow bit denotes a threshold reading on the depth of the output buffer, which is preferably organized as a first-in, first-out (FIFO) queue. The depth of the output queue is compared with a predetermined threshold value. If the depth of the FIFO is below the threshold, the state of the flow bit returned to the PRE indicates that more traffic can be accepted for that channel. If the depth of the FIFO is above the threshold, the state of the flow bit indicates that further traffic is denied for the channel until there is more space on the queue. The flow bit reflects the current state of the associated output queue rather than the change in state of that queue.

Apparatus and technique for conveying per-channel flow control information to a forwarding engine of an intermediate network node

An apparatus and technique configures an intermediate network node, such as an aggregation router, to implement automatic protection switching (APS) redundancy among its line cards in the event of a failure to one of those cards. The APS line card redundancy provides redundancy among a pair of line cards connected to a performance routing engine of the router. Internal APS data paths are implemented in the router through the provision of an alias logic circuit that selects packet data from one of an adjacent pair of line cards and sends identical copies of data to that adjacent pair of line cards.

Automatic protection switching line card redundancy within an intermediate network node

A bound mode mechanism and technique efficiently accommodates high-bandwidth data traffic flow within an intermediate node of a computer network. The bound mode mechanism combines two half-slot line card connectors of a backplane in an aggregation router into a single full-slot line card arrangement to thereby increase the bandwidth provided to a high-speed, full-height line card of the router. The technique is also capable of accommodating generic half-slot (i.e., subslot) connectors, each of which is capable of supporting a variety of data formats. The bound mode mechanism further allows use of a high-speed trunk card without the penalty of supporting high trunk level bandwidth on all of the slot connectors of the router. The mechanism enables use of a simple backplane, while also maintaining a low pin count on a backplane logic circuit of the router.

Bound mode technique for accommodating high-bandwidth data flow within an intermediate network node

To ensure fair access to upstream trunk bandwidth among a plurality of interface units, a plurality of queues is provided in a first unit. One of the queues is associated with the first interface unit. Each of the remaining queues is associated with one of a plurality of second interface units. Local data is received by the first interface unit and forwarded to the associated queue. Data received from a second, subtended interface unit is forwarded to a queue which associated with the second interface unit. Data is then issued from the queues according to a fairness algorithm. A unique identifier is assigned to each interface unit. Associating a queue with an interface unit is done by associating the queue with the respective interface unit's identifier. In each interface unit, local data is tagged with the instant interface unit's identifier, and received data is forwarded to a queue according to the data's tag. For ATM traffic, data can be tagged by inserting the receiving interface unit's identifier into the generic flow control (GFC) field. Alternatively, a table of associations between virtual channel identifiers (VCIs) and interface unit identifiers may be maintained, and the received data is forwarded to a queue according to the interface unit identifier associated with the data's VCI.

Ensuring fair access to upstream trunk bandwidth in ATM subtended configurations

A network node destination module for ensuring proper reception and transmission of information over a network having an optional network reference clock including an input stage for receiving the information, a synchronous residual time stamp (SRTS) timing control stage for implementing digital phase comparison techniques utilizing the network reference clock, and a clock generation stage for generating a transmit clock in response to a control value generated by the SRTS timing control stage. The SRTS timing control stage maintains a constant phase offset between the receive clock of the source node and the transmit clock of the destination node. The SRTS timing control stage includes an RTS sample generator for generating a local RTS sample for comparison with the source RTS sample to determine a current phase offset between the source and clocks. The current phase offset is then compared to a target phase offset stored in a phase register to generate a control value. The clock generation stage adjusts the transmit clock in response to a filtered control value and transmits the source data to the destination CPE at the adjusted transmit clock frequency. By maintaining a constant phase offset, the frequencies of the receive clock of the source node and the transmit clock of the destination node are synchronized, thereby providing CBR service. In addition to performing SRTS clock recovery techniques, the destination module may also be configured to perform adaptive clock recovery (ACR) and synchronous network clock (SNC) techniques.

Growing community of inventors

Bedford, MA, United States of America

Guy Fedorkow