Cisco Technology, Inc.

Jeffrey David Haag

Gary Lee Harris

Richard Foltak

Samuel G Henderson

William Mark Townsley

John William Evans

Earl Hardin Booth, Iii

Richard Manfred Pruss

Matthew Lawrence King

James Ronald Holland, Jr

Francois Gagne

Murty Subba Rama Chandra Kotha

John D Bray

Ramesh Krishnamurthy

Craig J Fox

In one implementation, an original physical profile file and a configuration baseline are stored for a virtual machine. The physical profile file includes physical characteristics of a physical device running the virtual machine. The configuration baseline includes configuration settings or attributes of the instance of the virtual machine. A network device detects current value for at least one physical characteristic and compares the current value to the original physical profile file. When the current values deviate enough from the original physical profile file to exceed a threshold amount of deviation that is permissible, the network device determines that the virtual machine has been moved to another physical device. In response, the network device monitors current configuration settings or attributes with respect to the configuration baseline in order to detect an unauthorized usage of the virtual machine.

Detection of unauthorized use of virtual resources

A mechanism for synchronizing states of components in a first routing engine to corresponding components in a second routing engine is provided. In order to reduce the amount of data required to synchronize the state of the components and the time and resources required to perform the synchronization, the state-related information transmitted from the first routing engine to the second routing engine is limited to information used to build states of a subset of the components associated with the first routing engine. That subset of components is limited to those components that receive stimuli (e.g., data streams or data packets) from sources external to the routing engine. Other components on the second routing engine synchronize state by receiving information from those components on the second routing engine that received the external stimuli information.

Session redundancy using a replay model

A service gateway maintains forwarding components operative to forward data packets within corresponding VPNs, and also maintains subscriber sessions for subscribers via respective subscriber interfaces. The association between the subscribers and the forwarding components is independent of the subscriber interfaces, such that the subscribers reachable via a given interface are associable with any forwarding component. Upon detecting an appropriate event, such as a service selection action, the service gateway modifies the forwarding components of first and second VPNs to reflect that the subscriber session is active in the second VPN and is not active in the first VPN. The service gateway also effects a change of a network address that identifies the corresponding subscriber from a first network address defined in the first VPN to a second network address defined in the second VPN. Mechanisms for effecting such a change of network address include DHCP, IPCP, RADIUS, and NAT. The service gateway employs control policies to govern the transfer of subscribers among VPNs.

Dynamic, policy based, per-subscriber selection and transfer among virtual private networks

A method, apparatus, and network communication node for suppressing transmission of a request packet, in the context of a request-response network protocol, if a packet in response to a currently pending request packet is present in an input process queue in a network communication node are presented. One embodiment of the present invention provides this capability by pre-processing an incoming packet to determine whether the packet is designated as being in response to a pending request.

Retransmit timeout suppression in large scale networks

Link fragmentation and interleaving at an access device located between a point to point link and a tunneled connection is provided. A method of access device-based link fragmentation and interleaving is also provided. The method includes receiving frames through a tunnel from a network server, fragmenting at least some of the frames from the network server, and sending fragmented and unfragmented frames over a data link to an endpoint device. The frames may be multilink point to point protocol (MLPPP) frames and the frames may be received through a layer two tunneling protocol (L2TP) tunnel. The method can include scanning a frame for PPP options and removing options related to MLPPP negotiation and then forwarding the frame to a network server.

Access device-based fragmentation and interleaving support for tunneled communication sessions

A method and system for stateful switch-over in a high-availability point to point system is disclosed. The disclosed method includes in one embodiment detecting a change in state of a point to point link between a first peer data processing system and a second peer data processing system; storing state data for the point to point link with an active processor within the first peer data processing system in response to detecting the change in state; and transferring a copy of the state data to a standby processor within the first peer data processing system. The disclosed method includes in another embodiment, transferring data between the first peer data processing system and the second peer data processing system utilizing the active processor; detecting a switch-over condition; and transferring data between the first peer data processing system and the second peer data processing system utilizing the standby processor in response to detecting the switch-over condition.

Growing community of inventors

Raleigh, NC, United States of America

Jeffrey David Haag