Juniper Networks, Inc.

Marconi Communications Gmbh

Other

Fore Systems, Inc.

John E Drake

Wen Lin

SelvaKumar Sivaraj

Adrian John Farrel

Vamshi Krishna Voruganti

David Delano Ward

Yimin Shen

Satya Ranjan Mohanty

Ravi Shekhar

Eric C Rosen

Hannes Gredler

Ravi I Singh

Pankaj Shukla

Colby Barth

William Stuart Mackie

Aldrin Isaac

Sean A Mentzer

Raveendra Torvi

Vikram Nagarajan

Zhaohui Zhang

Theodore Ernest Tedijanto

Kapil Arora

Tapraj Singh

Manoj Sharma

Xichun Hong

Anix Anbiah

Yi Zheng

Mukesh Kumar

Kireeti Kompella

Manish P Gupta

Yakov Rekhter

Rahul Aggarwal

Nischal Sheth

Ross W Callon

Tarek Saad

Chandrasekar Ramachandran

Jonathan C Barth

Vishnu Pavan Beeram

Sunesh Rustagi

Nitin Bahadur

Harish Sitaraman

Joel Abraham Obstfeld

Alia Karin Atlas

Nitin Singh

Daniel S Nydick

Princy T Elizabeth

Jeffrey M Haas

Shrinivasa Kini

Vasudevan Venkatraman

Vishnu Pavan Kumar Beeram

Joseph C Kantz

Minjie Dai

Sunil Kumar Malali

Jay P Adams

Levinh Hoang

Deepak Ojha

Wen T Lin

Krzysztof Grzegorz Szarkowicz

Wai Tong Louis Chan

Nadeem Mohammad

Weimin Ji

Antoni B Przygienda

Dimitris Varotsis

James A Meacham, Ii

Robert Coltun

Selvakumar Sivaraj

Jonathan Colby Barth

Jeffery M Haas

In some examples, a computing device comprises a first service function instance to apply a service function and a service function forwarder to: receive a first layer 3 routing protocol route advertisement that includes service function instance data for a second service function instance, the service function instance data indicating a service function type and a service identifier for the service function instance; receive a second layer 3 routing protocol route advertisement that includes service function chain data for a service function chain, the service function chain data indicating a service path identifier and one or more service function items; and send, to the second service function instance and based at least on determining a service function item of the one or more service function items indicates the second service function instance, a packet classified to the service function chain.

Distributing service function chain data and service function instance data in a network

Techniques are described for providing fast reroute for BUM traffic in EVPN. For example, a first provider edge (PE) device, elected as a designated forwarder (DF) of an Ethernet segment, configures a backup path using a label received from a second PE device of the Ethernet segment (e.g., backup DF) that identifies the second PE device as a 'protector' of the Ethernet segment. For example, a routing component of the DF configures within a forwarding component a backup path to the second PE device, e.g., installing the label and operation(s) within the forwarding component to cause the forwarding component to add the label to BUM packets received from a core network. Therefore, when an access link to the local CE device has failed, the DF reroutes BUM packets from the core network via the backup path to the second PE device, which sends the BUM packets to the CE device.

Fast reroute for BUM traffic in ethernet virtual private networks

A first provider edge device may receive device information from a second provider edge device included in an Ethernet virtual private network (EVPN). The device information may identify a media access control (MAC) address and may indicate that the device is connected to the second provider edge device. The first provider edge device may receive data transmitted by the device and may determine, based on information included in the data, that the device has moved from the second provider edge device to the first provider edge device. The first provider edge device may generate a data packet including mobility information indicating that the device has moved to the first provider edge device. The first provider edge device may transmit, via a data plane of the EVPN, the data packet to the second provider edge device to permit the second provider edge device to update routing information for the device.

Fast convergence for MAC mobility

Techniques are described for providing fast reroute for traffic in EVPN-VXLAN. For example, a backup PE device of an Ethernet segment is configured with an additional tunnel endpoint address ('reroute tunnel endpoint address') for a backup path associated with a second split-horizon group that is different than a tunnel endpoint address and first split-horizon group for another path used for normal traffic forwarding. The backup PE device sends the reroute tunnel endpoint address to a primary PE device of the Ethernet segment, which uses the reroute tunnel endpoint address to configure a backup path to the backup PE device over the core network. For example, the primary PE device may install the reroute tunnel endpoint address within its forwarding plane and one or more operations to cause the primary PE device to encapsulate a VXLAN header including the reroute tunnel endpoint address when rerouting the packet along the backup path.

Fast reroute for ethernet virtual private networks—virtual extensible local area network

Techniques are described for supporting multiple virtual networks over an underlay network. The techniques may provide support for network slicing and enhanced virtual private networks (VPNs) over an underlay network. In general, the techniques include allocating a subset of resources (e.g., nodes and/or links) of the underlay network to a particular virtual network, and advertising the subset of resources to provider edge (PE) routers that are participating in the virtual network. A network controller device may advertise the subset of resources for the virtual network to the respective PE routers using BGP-LS (Border Gateway Protocol-Link State). Based on the advertisements, each of the PE routers generates a restricted view of the full underlay network topology for the virtual network and, thus, only uses the subset of resources in the restricted view to generate routing and forwarding tables for the virtual network.

Support for multiple virtual networks over an underlay network topology

Example security systems for use between at least one upstream router and at least one downstream router, are described. A group or pool of security devices can be used to provide stateful security to bidirectional packet flows between upstream and downstream routers. The packets of the bidirectional flows are forwarded to particular security devices based on a consistent hash ring process. For a given flow, bidirectional state information is synchronized among some, but not all, of the security devices. The security devices among which such bidirectional flow state information is shared are determined using the same consistent hash ring process.

Intelligent flow state synchronization to improve resiliency, availability, and/or performance of redundant network security devices

In general, techniques are described for reducing traversal when performing consistent hashing for packet flow load balancing. A computing device comprising a memory and a processor may be configured to perform the techniques. The memory may store a hash ring that includes a plurality of buckets, where a non-zero subset of the plurality of buckets each includes a different output value of a plurality of output values, and a remaining subset of the plurality of buckets each includes an empty value. The processor may prepopulate the remaining subset of the plurality of buckets with the respective different output value of the plurality of output values. The processor may receive a key value, and apply a hash function to the key value to identify a bucket of the plurality of buckets. The processor may next output the output value associated with the identified bucket.

Reduced traversal for consistent hashing for packet flow load balancing

Fast reroute for ethernet virtual private networks&#x2014;virtual extensible local area network

Support is provided for flexible algorithms, used by the border gateway protocol (BGP) route selection process, in the context of segment routing (SR) Prefix segment identifiers (SIDS) advertised using BGP.

Flexible algorithm aware border gateway protocol (BGP) prefix segment routing identifiers (SIDs)

Techniques are described for inter-domain segment routing using transport endpoint segments. A transport endpoint segment provisioned on a router within a domain represents any intra-domain tunnel originated at the router and having reachability to an indicated endpoint within the same domain. The provisioning router advertises a transport endpoint segment identifier (TESID) for the transport endpoint segment to other routers or a controller for use in segment routing. The TESID for the transport endpoint segment remains constant regardless of which intra-domain tunnel is bound to the transport endpoint segment. The provisioning router dynamically binds the transport endpoint segment to at least one intra-domain tunnel, and any changes to the bound intra-domain tunnel are updated locally at the provisioning router. In this way, an inter-domain segment routing tunnel may be constructed as a list TESIDs that are not affected by intra-domain tunnel changes.

Transport endpoint segments for inter-domain segment routing

A disclosed method may include (1) identifying, by a PE router, a conditional advertisement policy that requires installation of at least one address of an active service appliance within a routing table to trigger advertising a route for the active service appliance to one or more additional PE routers, (2) inspecting the routing table for the installation of the address of the active service appliance, (3) determining, based at least in part on the inspection, that the address of the active service appliance is installed in the routing table, (4) determining that the PE router has satisfied the conditional advertisement policy due at least in part to the address of the active service appliance being installed in the routing table, and then in response, (5) directing the PE router to advertise the route to the additional PE routers. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for achieving shortest path forwarding in connection with clusters of active-standby service appliances

Growing community of inventors

Pittsburgh, PA, United States of America

John E Drake