Cisco Technology, Inc.

Graphiant, Inc.

Other

Cisco Systems Inc.

Ijsbrand Wijnands

Gregory J Shepherd

Arjen Boers

Neale D R Ranns

Christian J Martin

Mankamana Prasad Mishra

Nagendra Kumar Nainar

Stefan Olofsson

Pascal Thubert

Ali Sajassi

Hendrikus G P Bosch

Toerless Eckert

Rajiv Asati

Jeffrey Michael Napper

Stefano Benedetto Previdi

Dino Farinacci

Alton Lo

Sape Jurriën Mullender

Carlos M Pignataro

David Delano Ward

Anubhav Gupta

Samir D Thoria

John H W Bettink

Stig Ingvar Venaas

Krishnaswamy Muddenahally Ananthamurthy

Stephane Litkowski

Jesper Skriver

Neale David Raymond Ranns

Patrick Wetterwald

Alessandro Duminuco

Alfred C Lindem, Iii

Peter Psenak

Patrice Bellagamba

David Richard Barach

Xiaorong Wang

Swadesh Agrawal

Thomas Kernen

Satya Ranjan Mohanty

Anuj Budhiraja

Gaofeng Tao

Lianxiang Wang

Fang Yang

Nagendra B Kumar

Yicheng Liu

John S Meylor

Neale Ranns

Jean-Philippe Vasseur

Nitin Kumar

William Mark Townsley

Andre Surcouf

Humberto Jose La Roche

Subhasri Dhesikan

Pierre Pfister

Eric C Rosen

Yiqun Cai

W Mark Townsley

Ramakrishnan Chokkanathapuram Sundaram

Jayashree Subramanian

Keith Burns

Nidhi Bhaskar

Gregory A Shepherd

Clarence Filsfils

Eric Michel Levy-Abegnoli

Frank Brockners

Stewart Frederick Bryant

Lukas Krattiger

Lorenzo Vicisano

Luca Martini

Syed Kamran Raza

Robert Goguen

Christopher Metz

Robert H Thomas

Daniel A Alvarez

Pratima Pramod Sethi

Mahesh Sivakumar

Giovanni Meo

Michael Francis O'Gorman

Lester C Ginsberg

Tony Speakman

Alex E Raj

Frederic R P Detienne

Nagendra Kumar

Luc De Ghein

Mandeep Rohilla

David Carrel

Brian Christopher Farnham

Greg Shepherd

Najam Saquib

Arjen Beers

Khalid Raza

Cameron Ferdinands

In one embodiment, a router includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the router to perform operations including receiving software-defined networking in a wide area network (SD-WAN) policies from a component of an SD-WAN network. The operations also include establishing a session with a mobile device and receiving information associated with the mobile device in response to establishing the session with the mobile device. The operations further include filtering the SD-WAN policies based on the information associated with the mobile device to generate SD-WAN device-specific policies and communicating the SD-WAN device-specific policies to the mobile device.

Systems and methods for distributing SD-WAN policies

The present disclosure is directed to BIER forwarding over varying BSL domains, the methods including the steps of receiving, at a border node, a packet comprising a BIER header having a BIER bit string with a first bit string length; reading an incoming label of the packet comprising instructions to split the BIER header into a plurality of smaller headers associated with a plurality of smaller bit strings; generating a set of split bit masks; performing a separate bitwise AND operation on each split bit mask and the BIER bit string to generate the plurality of smaller bit strings, each copied to a corresponding smaller header of the plurality of smaller headers; and performing a lookup for each of the plurality of smaller headers on a respective forwarding table to determine one or more egress routers to which to transmit the packet.

Efficient BIER forwarding over varying BSL domain using header stitching

In one embodiment, an apparatus includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the apparatus to perform operations including receiving a user credential from a remote access client within a network and communicating the user credential to an authentication, authorization and accounting (AAA) server within the network. The operations also include receiving a user attribute from the AAA server and generating a contextual label based on the user attribute. The contextual label includes routing instructions associated with traffic behavior within the network. The operations further include advertising a control message, which includes the contextual label, to the remote access client.

Systems and methods for generating contextual labels

Embodiments for bounded broadcast encryption key management in a peer-to-peer network are described. To realize bounded broadcast encryption key management, a second peer of the peer-to-peer network receives a first broadcast message from a first peer. The first broadcast message includes at least a public key associated with the first peer. The second peer then generates a key seed in response to receiving the first broadcast message, and creates a second message that includes the key seed encapsulated with the public key. The second peer then transmits the second message to the first peer, and in response to the transmission of the second message, receives a packet from the first peer. The packet includes data encrypted using a secret key derivable from the key seed and one or more portions of the second message.

Bounded broadcast encryption key management

Embodiments of a secure communication network are disclosed. To implement the embodiments, an ingress core node that includes a processor and a memory storing computer-executable instructions, is presented. The instructions, when executed, cause the processor to receive a data packet. The instructions further cause the processor to compare a slice identifier (ID) associated with the received data packet with one or more slice IDs in an access control list (ACL). The instructions further cause the processor to filter the received data packet based on the comparison indicating an occurrence of a match between the slice ID associated with the data packet and one of the one or more slice IDs in the ACL. The instructions further cause the processor to transmit the filtered data packet to an egress core node of the core network via one or more intermediate core nodes of the core network.

Method and system for filtering data packets to prevent crosstalk

A computer network efficiently provides a multicast network flow to a multicast recipient across a multihomed network element. The multihomed network element includes network devices that receive multicast data from a source of a multicast network flow. Each particular network device that received the multicast data publishes a notification indicating that the multicast network flow is available from the particular network device. The computer network receives a subscription to the multicast network flow from a multicast recipient, and determines whether to bridge the multicast data across the multihomed network element based on a multicast configuration of the computer network. The multihomed network element provides the multicast data to the multicast recipient from at least one of the particular network devices that received the multicast data from the source of the multicast network flow.

Multicast traffic optimization in multihomed edge network elements

Various systems and methods for performing bit indexed explicit replication (BIER) using multiprotocol label switching (MPLS). For example, one method involves receiving a packet that includes a MPLS label. The packet also includes a multicast forwarding entry. The method also involves determining, based on the value of the MPLS label, whether to use the multicast forwarding entry to forward the packet. The method further includes forwarding the packet.

Bit indexed explicit replication using multiprotocol label switching

A method comprises, at a first router configured to perform Bit Index Explicit Replication (BIER) for forwarding of multicast packets in a network, storing configuration information that indicates that the first router belongs to multiple subdomains of a BIER domain, and is able to forward the multicast packets for a virtual private network on the multiple subdomains. The method further comprises, during an auto-discovery procedure, generating an auto-discovery message to include an auto-discovery route and route attributes that indicate the multiple subdomains, and sending the auto-discovery message to a second router of the virtual private network the network.

BIER overlay signaling enhancement

In one embodiment, an offload platform is an compute platform, adjunct to a router or other packet switching device, that performs packet processing operations including determining an egress forwarding value corresponding to the next-hop node of the packet switching device to which to send an offload-platform processed packet. The offload platform downloads forwarding information from the router, and augments it, such as, but not limited to, representing interfaces of the router as identifiable virtual interface(s) on the offload platform, and including each of one or more next-hop nodes of the router represented as an identifiable virtual adjacency and identifiable tunnel (e.g., identified by the egress forwarding value). In one embodiment, the egress forwarding value is an Multiprotocol Label Switching (MPLS) label or Segment Routing Identifier. The router identifies packets of certain packet flows to send to the adjunct offload platform, rather than processing per its routing information base.

Processing packets by an offload platform adjunct to a packet switching device

Methods for establishing a stateless extranet in a secure communication network include transmitting a consumer NHOP to a provider CPE from a consumer CPE in a control plane. The consumer NHOP is associated with at least one attribute of an NHOP, including an encryption key available with the consumer CPE, to establish a secure communication tunnel in a data plane. The consumer CPE receives a service definition over the control plane associated with a service available with the provider CPE. A service anchor point is created based on an identifier of the service definition. A network address translation (NAT) IP request is transmitted to the provider CPE. The consumer CPE receives a NAT IP from the provider CPE in response to the NAT IP request. The NAT IP is associated with the service anchor point of the consumer CPE. A stateless service is thereby instantiated on the consumer CPE.

System and method for instantiation of stateless extranets

A networking environment includes a first node and a second node configured as Ethernet Virtual Private Networking (EVPN) peers on an EVPN subnet that is coupled to a Layer 3 VPN over a core network. The first node receives a first multicast join request from a third node in the core network, the first multicast join request including a source address and multicast group address of a source of a multicast stream. The first node determines that the source address and the multicast group address for the source are behind the EVPN subnet at the second node. The first node sends to the second node, a control plane join request message that includes a receiver identifier that identifies the third node as a receiver of the multicast stream, the receiver identifier enabling the second node to forward the multicast stream directly into the core network to the third node.

Selective multicast ethernet tag extension for optimal source driven multicast forwarding

Embodiments of a method of communicating a packet by a network address translation (NAT) enabled router, are described. In an embodiment, the method includes receiving a return packet to be communicated to a destination. The destination is associated with a first source address in the context of a forward packet. The method further includes determining a return path to transmit the return packet to the destination based on security association data. The security association data is pre-recorded in a routing table of the NAT enabled router when the forward packet is received, prior to receiving the return packet, over a forward path established between the NAT enabled router and an enterprise node. The security association data uniquely identifies the forward path as the return path.

Network address translation with in-band return path resolution

Growing community of inventors

Leuven, Belgium

Ijsbrand Wijnands