Hewlett Packard Enterprise Development LP

Huazhe Wang

Puneet Sharma

Joon-Myung Kang

Joon Myung Kang

Example method includes: receiving a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule and an action to be performed by a network function on a network packet in response to the rule being matched; identifying a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions; creating an atomic address object representing the identified set of header address spaces; and verifying the plurality of intent-based network policies using the atomic address object.

Verifying intents in stateful networks using atomic address objects

Described herein are methods, network devices, systems, and computer-readable media that provide a technical solution for runtime monitoring and visualization of intent-based network policies in a manner that bridges the gap between high-level insights from runtime and low-level network device configurations. A network topology and a plurality of network configurations can be received in an intent-based network and a number of monitoring spots available within the network topology for runtime monitoring of an intent-based network policy among a plurality of intent-based policies can be determined. A plurality of runtime constraints including one or more of time, resource capacity, and bandwidth demand can then be determined based on the network topology and the plurality of network configurations. Based on the plurality of runtime constraints, a runtime monitoring schedule that includes at least a flow, a monitoring spot assigned for runtime monitoring of the flow, and a runtime monitoring rule to be applied at the assigned monitoring spot can be generated and implemented.

Runtime monitoring in intent-based networking

An example method including identifying an intent-based stateful network having a first endpoint, a second endpoint, and one or more devices performing stateful network functions between the first endpoint and the second endpoint. Further, constructing a causality graph of the network, the causality graph having a plurality of nodes for each of the one or more devices performing stateful network functions, wherein the connecting comprises connecting the first endpoint, the second endpoint, and the one or more devices performing stateful network functions to show causal relationships between the first endpoint and the second endpoint and the one or more devices performing stateful network functions. Also, determining whether the connections between the first endpoint, the second endpoint, and the one or more devices performing stateful network functions provide a path from the first endpoint and the second endpoint, and updating, incrementally, the causality graph as a change to the network occurs.

Incremental intent checking for stateful networks

Example method includes: identifying three relationships about a network function in an intent-based stateful network&#x2014;(1) the network function forwarding a network packet implies that at least one previous network packet was received by the network function in the same direction prior to the network packet is forwarded, (2) an established state in the network function implies that at least one previous network packet was received at the network function, (3) the network function receiving the network packet as a downward network function implies the network packet was previously sent by a second network function acting as an upward network function; encoding the network function using a combination of at least one of the three identified relationships; and verifying a plurality of network intents in the intent-based stateful network based at least in part on the encoding of the network function.

Growing community of inventors

Palo Alto, CA, United States of America

Huazhe Wang