Cisco Technology, Inc.

Janardhanan Radhakrishnan

Navindra Yadav

Sunil Gupta

Shashi Gandham

Supreeth Rao

Darshan Shrinath Purandare

Praneeth Vallem

Jothi Prakash Prabakaran

Xuan Zou

Umesh Paul Mahindra

Hoang-Nam Nguyen

Joseph Daniel Beshay

Andrew E Ossipov

Chandrodaya Prasad

Paul Mach

Gabriel J Fontenot

Robert Tappenden

Troy Michael Traina

Jorge Quintero

Girish Anant Kalele

Akshay Srirangam

Devices, systems, methods, and processes for automatically generating, at least in part, a segmentation strategy. Users of workload protection solutions can initiate a process to deploy various agents onto a network with one or more operating systems. The initial scope may be defined via one or more best practices to generate a scope tree. Associated labels may be defined based on the scope design and any subnets learned from the installed agent interface subnets. Common services can also be defined based on well known ports and/or protocols. Agent-based host names can also be evaluated to define potential application groupings. A generated application dependency mapping can be applied to understand potential application boundaries and potential policy recommendations. These steps can help a user to begin their segmentation strategy when deploying a workload protection solution.

Zero touch policy provisioning in workload protection solutions

Techniques for using an end-to-end policy controller to utilize an inventory of enforcement points to generate a chain of enforcement points having capabilities to enforcement individual operations of an intent-based security policy associated with an entity accessing a resource. A network controller may intelligently split an intent-based security policy and send portions thereof to enforcement points along a path configured for an entity to access a resource. For example, a portion of a security policy corresponding to an operation may be mapped to and implemented by an enforcement point having a capability to perform the operation. Once each operation of a security policy has been mapped to an enforcement point, a chain of enforcement points may be generated.

Using an end-to-end policy controller to split policies between enforcement points in a network

Aspects of the subject technology relate to a system configured to receive a set of network snapshot segments from an output stream of a stream processing service, compile the set of network snapshot segments from the set of messages into a first network snapshot and a second network snapshot, and compare the first network snapshot and the second network snapshot to identify a difference between the first network snapshot and the second network snapshot.

Mechanism for identifying differences between network snapshots

Aspects of the disclosed technology relate to ways to authenticate customer/subscriber access to a policy update stream. A process of the technology can include steps for instantiating a network monitoring device in response to a request, the request comprising one or more configuration parameters for the network monitoring device, and receiving a first certificate from the network monitoring device, wherein the first certificate is based on the one or more configuration parameters. In some aspects, the steps can further include sending the first certificate to a processing pipeline for authentication, wherein the processing pipeline is configured to authenticate the first certificate based on a second certificate received by the processing pipeline from the network monitoring device. Systems and machine readable media are also provided.

Secure publishing for policy updates

Disclosed is a system configured to receive a set of network snapshot segments from an output stream of a stream processing service, compile the set of network snapshot segments from the set of messages into a first network snapshot and a second network snapshot, and compare the first network snapshot and the second network snapshot to identify a difference between the first network snapshot and the second network snapshot.

Aspects of the subject technology relate to a system configured to receive, from a stream processing service, a first network snapshot segment. The first network snapshot segment is associated with metadata that is used to determine that at least one additional network snapshot segment associated with the output stream has not been previously received. The system is configured to request, from the stream processing service, the at least one additional network snapshot segment and generate a first network snapshot by compiling the first network snapshot segment and the at least one additional network snapshot segment.

Mechanism for facilitating efficient policy updates

Growing community of inventors

Dublin, CA, United States of America

Janardhanan Radhakrishnan