Cisco Technology, Inc.

Jonathan Augustine Kunder

Andrew E Ossipov

Jianxin Wang

Pradeep Patel

Ashish K Dey

Kent Kinchu Leung

Xun Wang

Zhijun Liu

A first packet of a packet flow is received at a classifying network device. The first packet is forwarded from the classifying network device to a firewall network device. An indication that the packet flow is to be offloaded is received at the classifying network device. Data is stored at the classifying network device indicating that the packet flow is to be offloaded. A non-control packet of the packet flow is received at the classifying network device. A determination is made that the non-control packet belongs to the packet flow by comparing data contained in the non-control packet to the stored data. The non-control packet of the packet flow is directed to a processing entity in response to the determining. A control packet of the packet flow is received at the classifying network device. The control packet of the packet flow is directed to the firewall network device.

Selective offloading of packet flows with flow state management

An example method for facilitating hierarchical clustering in a geographically dispersed network environment is provided and includes receiving a packet at one of a plurality of adaptive security appliance (ASA) units in one of a plurality of ASA clusters in a cluster domain of a network environment, identifying the packet as matching an inter-data center live traffic profile, identifying a target ASA cluster in the plurality of ASA clusters in the cluster domain, querying a domain director in the target ASA cluster for a flow owner, and if the flow owner is identified by the domain director, forwarding the packet to the flow owner in the target cluster, and if the flow owner is not identified by the domain director, and the domain director includes a flow state for a flow to which the packet belongs, designating the ASA unit as the flow owner.

Hierarchical clustering in a geographically dispersed network environment

In one example, a service function forwarder of a service function chain enabled domain receives, from a classifier of the service function chain enabled domain, network traffic assigned to a service function path that includes at least one service node configured to apply a service function to the network traffic. The service function forwarder forwards the network traffic along the service function path. The service function forwarder receives, from the at least one service node, instructions for dynamically assigning a particular service function path to predicted network traffic that the at least one service node predicts will be triggered by the network traffic. The service function forwarder forwards the instructions to the classifier.

Service function chain dynamic classification

Growing community of inventors

San Jose, CA, United States of America

Jonathan Augustine Kunder