Juniper Networks, Inc.

Jeffrey M Haas

Shraddha Hegde

Ross W Callon

John Galen Scudder

Alia Karin Atlas

Jaihari V Loganathan

Sanjay Khanna

Srihari Ramachandra Sangli

Kevin F Wang

Qi-Zhong Cao

Stu Grossman

John E Drake

Zhaohui Zhang

Santosh S Kolenchery

Wai Tong Louis Chan

Krzysztof Grzegorz Szarkowicz

Rafal Jan Szarecki

Weimin Ji

Techniques are described by which a routing protocol, such as border gateway protocol (BGP), is extended to control propagation and importation of information using route targets (RTs) specified as bitmasks that encode link administrative group information. For example, a network control device (e.g., controller) is configured to allocate one or more subset of resources (e.g., nodes or links) of an underlay network to each of one or more virtual networks established over the underlay network. The controller generates a bitmask encoded with link administrative group information of the one or more links. The controller then outputs, to a plurality of provider edge (PE) routers that are participating in a respective virtual network, a routing protocol message to advertise the one or more subset of resources, wherein the routing protocol message includes a route target specified as the bitmask.

Bitmask route target in targeted distribution of information using a routing protocol

In general, various aspects of the techniques are described in this disclosure for distributed label assignment for labeled routes. In one example, a method includes obtaining, by a first thread of a plurality of execution threads for at least one routing protocol process executing on processing circuitry of a network device, an allocation of first labels drawn from a label space for a network service; adding, by the first thread, the first labels to a first local label pool for the first thread; generating, by the first thread, after obtaining the allocation of the first labels, a labeled route comprising a route for the network service and a label assigned by the first thread from the first local label pool; and outputting, by the network device, the labeled route.

Distributed label assignment for labeled routing protocol routes

Example security systems for use between at least one upstream router and at least one downstream router, are described. A group or pool of security devices can be used to provide stateful security to bidirectional packet flows between upstream and downstream routers. The packets of the bidirectional flows are forwarded to particular security devices based on a consistent hash ring process. For a given flow, bidirectional state information is synchronized among some, but not all, of the security devices. The security devices among which such bidirectional flow state information is shared are determined using the same consistent hash ring process.

Intelligent flow state synchronization to improve resiliency, availability, and/or performance of redundant network security devices

The use and processing of update messages (e.g., BGP UPDATEs) that bind (e.g., MPLS) labels to address prefixes is improved such that labels are used more efficiently, and/or such that such update messages can be processed more efficiently. A distance vector control signaling protocol (e.g., BGP) peer device receives a control plane message (e.g., BGP Update) from a downstream peer device, the control plane message including (1) a network address of the downstream device as a next hop value, (2) a prefix value, and (3) at least one label associated with the prefix value. Responsive to receiving the control plane message, the peer device generates a new control plane message including (1) a network address of the peer device as a next hop value, (2) the prefix value from the control plane message, and (3) a label stack including (i) the at least one label from the control plane message, and (ii) a local label associated with the peer device. The peer device then sends the new control plane message to an upstream peer device.

Building a label sequence in Border Gateway Protocol (BGP) labeled network layer reachability information (NLRI) on next hop (NH) attribute change

The challenge of isolating a protocol peer(s) from routing information churn caused by to a peering protocol (e.g., due to updating the peering protocol, due to a bug in the peering protocol, due to a crash in the peering protocol, etc.) is solved by using a separate data store to isolate the protocol peer(s) from the peering protocol. The separate data store may: (a) receive, from at least one of the outside peering devices, incoming routing information; (b) store the incoming routing information received in a first storage system; (c) provide a copy of at least some of the stored incoming routing information received to a second storage system used by a process for selecting routes using the routing information, the process generating state information to be distributed (e.g., one or more routes with BGP properties (which may include one or more selected routes) and a set of outside peers to distribute them to) and storing the state information in the second storage system; (d) receive a copy of the state information generated and stored by the process; (e) store the received copy of the state information in the first storage system; and (f) provide at least some information from the copy of the state information to at least one outside peer device in accordance with a route advertisement process, regardless of a state or status of the process for selecting routes.

Using disaggregated route information bases ('RIBS') to increase the resiliency of protocols such as the border gateway protocol ('BGP')

In general, techniques are described for dynamically controlling host-bound traffic by dynamically adding and updating, within the forwarding plane of a network device, network packet policers that each constrains, for one or more packet flows, an amount of host-bound traffic of the packet flows permitted to reach the control plane in accordance with available resources. In one example, a control plane of the network device detects internal congestion in the communication path from the forwarding plane to control plane (the 'host-bound path'), identifies packet flows utilizing an excessive amount of host-bound path resources, computes limits for the identified packet flows, and adds 'penalty-box policers' configured with the computed limits for the identified packet flows to the forwarding plane. The forwarding plane subsequently applies the policers to the identified packet flows to constrain the amount of traffic of the packet flows allowed to reach the control plane to the computed limits.

Penalty-box policers for network device control plane protection

The disclosed computer-implemented method for improving forwarding capabilities during route convergence may include (1) identifying, at an upstream network device, a set of updated routes that define network paths that have each experienced at least one topology change since the upstream network device last converged with a downstream network device, (2) determining, at the upstream network device, levels of priority for the set of updated routes based at least in part on amounts of traffic that traverse the network paths defined by the set of updated routes, (3) arranging, at the upstream network device, the set of updated routes in a prioritized order in accordance with the levels of priority, and then (4) converging the upstream network device with the downstream network device by sending the set of updated routes in the prioritized order to the downstream network device. Various other methods, systems, and apparatuses are also disclosed.

Growing community of inventors

Ypsilanti, MI, United States of America

Jeffrey M Haas