Juniper Networks, Inc.

Jayanthi R

Chandrasekhar A

Premchandar N

Javier Antich

Bhaskar T Reddy

Nirmal Anburose

Gregory Allan Sidebottom

Harsha Lakshmikanth

Rahamath Sharif

Sri Sampath Mallipudi

Zhifei Fang

Ritesh Shelat

Viren L Shah

Gert Grammel

Patricio Giecco

Cyril Margaria

Hitesh Mali

Anand Beedi

A device may receive license data identifying device licenses and organization licenses associated with an organization of users of a multi-tenant system, and may identify, in the license data, entitlements for licenses associated with the organization. The device may combine the entitlements to generate combined entitlements, and may determine an entitlement count of the combined entitlements. The device may add quantities of new entitlements to the entitlement count, and may identify, in the license data, roles of the users and capabilities associated with each of the roles. The device may map the entitlements and the capabilities to generate a mapping, and may authorize a particular user based on the mapping. The device may process usage of the entitlements, with a machine learning model, to predict future usage of the entitlements, and may determine entitlement recommendations based on the future usage. The device may provide the entitlement recommendations for display.

Programmable model-driven license management and enforcement in a multi-tenant system

A device may receive a configuration of a network device, where the configuration includes configuration blocks with references to high level objects. The device may receive an out-of-band configuration change from the network device, and may compare the out-of-band configuration change and the configuration to identify an impacted high level object. The device may determine an impacted reference and an impacted configuration block associated with the impacted high level object, and may determine whether to reject the out-of-band configuration change, accept the out-of-band configuration change, or merge the out-of-band configuration change with the configuration based on the impacted high level object, the impacted reference, and the impacted configuration block. The device may perform one or more actions based on determining whether to reject the out-of-band configuration change, accept the out-of-band configuration change, or merge the out-of-band configuration change with the configuration.

Supporting out-of-band configuration changes in security policy management

A resource controller module of a network management system receives a request for an allocation of threads to perform a job associated with a job category for a tenant associated with the network management system. The resource controller module determines, based on the request, a number of available threads associated with the job category of the system at a particular time and causes, based on the request and the number of available threads associated with the job category at the particular time, a group of threads associated with the job category to be allocated to perform the job to be allocated to perform the job.

Network management software-as-a-service system for allocating resources (also termed threads) of containers for performance of a job

A system may identify a security intent policy model associated with an initial time. The system may generate one or more delta snapshots that respectively indicate one or more incremental changes to the security intent policy model at times subsequent to the initial time. The system may determine that the system is to deploy an updated version of the security intent policy model to a device and may thereby determine a previous deployment time at which the system deployed a previous version of the security intent policy model to the device. The system may generate, based on the one or more delta snapshots and the previous deployment time, a cumulative delta snapshot, and may thereby update a low-level security intent policy model associated with the device. The system may generate, based on the low-level security intent policy model, device-level security configuration information for the device.

Efficient updating of device-level security configuration based on changes to security intent policy model

Network elements are managed with a server to support client data models from heterogeneous data sources. A server receives a first query for configuration data of a network element to be returned in a first model. The server determines a model type for the configuration data of the network element. When the model type is a second model that is not the first model, the server sends a second query to the network element for the configuration data to be returned in the second model and transforms the configuration data received from the network element into the first model. Additionally, the server returns the configuration data in the first model as a response to the first query.

Server to support client data models from heterogeneous data sources

A system identifies a source intent policy model that is associated with a graph having a plurality of source nodes connected by a plurality of source edges, identifies a set of source nodes of the plurality of source nodes, and translates the set of source nodes to generate a set of target nodes. The system identifies a subset of target nodes, of the set of target nodes, that are not included in a target intent policy model that is associated with a graph having a plurality of target nodes connected by a plurality of target edges. The system determines a hierarchical order associated with the subset of target nodes and the plurality of target node, and causes the target intent policy model to be updated to include the subset of target nodes and the plurality of target nodes, such that the graph is ordered according to the hierarchical order.

Translation of a source intent policy model to a target intent policy model

A controller device manages a plurality of network devices. The controller device includes one or more processing units configured to receive an indication of a stateful intent, the data structure including a plurality of nodes and a plurality of edges, each node of the plurality of nodes being representative of a respective network device of the plurality of network devices. The one or more processing units are configured to determine, using an abstract function configured at a node of the plurality of nodes, a stateless intent for implementing the stateful intent and generate low level configuration data for the plurality of network devices based on the stateless intent. The one or more processing units are configured to interface with one or more of the plurality of network devices to configure the one or more of the plurality of network devices with the low level configuration data.

Business policy management for self-driving network

A system determines identification information associated with an endpoint device, which is associated with a tenant of the system, and the tenant. The system generates and sends, to the endpoint device, a certificate that includes the identification information. The system receives, from the endpoint device and as part of an attempt by the endpoint device to initiate a dial-out communication session with the system, the certificate. The system causes, based on the certificate, the dial-out communication session to be established and processes the certificate to determine the identification information. The system receives, from the endpoint device and via the dial-out communication session, one or more messages; modifies the one or more messages to include the identification information; and provides the one or more modified messages to facilitate provisioning of services or resources associated with the system to the endpoint device.

Network management system for dial-out communication sessions

A system identifies an intent policy model associated with an initial time. The system updates a data structure to cause the data structure to include one or more portions. Each portion of the data structure is associated with a start time and an end time. Each portion includes: a first delta snapshot that indicates one or more first changes to the intent policy model from the initial time to the start time associated with the portion, and one or more additional delta snapshots that respectively indicate one or more incremental changes to the intent policy model at times from the start time and to the end time associated with the portion of the data structure.

Using delta snapshots to facilitate intent policy model rollback and deployment

Techniques are disclosed for managing a network. In one example, a device configuration manager is configured to generate, in accordance with a device management protocol, a configuration change request representing a transaction having a first sub-transaction specifying a first configuration change for a network device of the network and a second sub-transaction specifying a second configuration change for the same network device. The device configuration manager is further configured to output the configuration change request to the network device and receive a reply message from the network device. The reply message includes a first response element specifying whether the first configuration change is successfully committed at the network device and a second response element specifying whether the second configuration change is successfully committed at the network device.

Concurrent transactions on NETCONF devices across network services

Some implementations described herein relate to a system that is configured to obtain one or more event logs associated with a tenant of the system. The system may be configured to determine, based on the one or more event logs, an event rate associated with the tenant and thereby determine, based on the event rate, a rotation interval. The system may be configured to cause, based on the rotation interval, a data structure to be generated for storing event logs associated with the tenant that are obtained during a time window. The system may be configured to obtain, within the time window, one or more additional event logs associated with the tenant and to cause, based on obtaining the one or more additional event logs within the time window, the one or more additional event logs to be stored in the data structure.

Event log management

Network management techniques are described. A controller device of this disclosure manages a device group of a network. The controller device includes processing circuitry in communication with the memory, the processing circuitry being configured to receive, using a programmable diagnosis service executed by the processing circuitry, a programming input, to form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group, to detect, using the programmable diagnosis service, an event affecting a first resource of the plurality of resources, and to identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources.

Programmable diagnosis model for correlation of network events

A controller device manages a plurality of network devices. The controller device includes one or more processing units configured to receive an upgrade request; obtain a redundancy model indicating network device redundancies or service redundancies; determine, based on the upgrade request and the redundancy model, an update graph having nodes each representing one of the network devices or one of the services, the update graph also having at least one edge that connects two of the nodes and that indicates the network redundancy or the service redundancy; determine, based on the update graph including the at least one edge, an update schedule for performing an update of software for the network devices that ensures availability for the first network device or second network device or availability for the service; and update the software of each of the network devices according to the update schedule.

Growing community of inventors

Coimbatore, India

Jayanthi R