Juniper Networks, Inc.

Kaushik Dutta Majumdar

Fnu Nadeem

Nagaraja Manikkar Shenoy

Prasad V

Shanmukh Uppuluri

Ravi Shekhar

Sankar Ramamoorthi

Rajeev Gupta

Venkata Rajasekharu Athreyapurapu

Mohan Kumar A P

Pranav Koushik

In an example, systems and methods enable automatic implementation of intent-based security policies in a network system, such as a software-defined wide area network system, in which network segment prefixes for network segments at one or more sites are dynamically learned. A service orchestrator controller translates an intent-based security policy input by a user to a security policy for a first site. The security policy for the first site specifies a segment-specific queryable resource associated with a second site. To implement the security policy, a device associated with the first site queries the segment-specific queryable resource associated with the second site, and updates one or more forwarding tables of the device with the network segment prefixes associated with one or more network segments at the second site received in response to the query. The first site forwards network traffic to the second site based on the updated forwarding tables.

Intent-based enterprise security using dynamic learning of network segment prefixes

Techniques are described for policy driven on-demand tunnel creation and deletion between end points in a software-defined wide area network (SD-WAN) having a hub-and-spoke topology. A software-defined networking (SDN) controller that facilitates cloud-based services of a service provider network that sets up the SD-WAN is configured to determine whether a tunnel between end-points is to be created or deleted based on information indicative of the traffic, such as amount, time, application generating the traffic, and the like, between end-points.

Policy-driven on-demand tunnel creation/deletion based on traffic information in a wide area network (WAN)

Techniques are described for selecting paths in accordance with service level agreements. For example, spoke and hub routers may advertise routes associated with virtual routing and forwarding (VRF) instances mapped to service level agreements (SLAs). A virtual route reflector of an intermediate router may receive route advertisements and may add respective path communities associated with particular links selected based on link state measurements in accordance with the SLAs. The hub or spoke routers may receive the route advertisements including a respective path community and install the selected path as a next-hop for a given SLA. In this way, spoke and hub routers may forward traffic on links that satisfy particular SLAs such that Quality of Experience (QoE) for an application may be restored or improved.

Service level agreement based next-hop selection

Growing community of inventors

Bengaluru, India

Kaushik Dutta Majumdar