Cisco Technology, Inc.

Cisco Tecnology, Inc.

Kent Kinchu Leung

Alpesh S Patel

Jayaraman R Iyer

Gopal K Dommety

Flemming Andreasen

Timothy Peter Stammers

Srinath Gundavelli

Michel Khouderchah

Andrew E Ossipov

Milind Kulkarni

Jianxin Wang

Zhijun Liu

Stefan Bernard Raab

Madhavi Wunnava Chandra

Sudhir Kumar Jain

Xun Wang

Waseem A Siddiqi

Naveen Paulkandasamy

Pascal Thubert

Navindra Yadav

Anand K Oswal

Rajesh S Pazhyannur

Abhijit Kumar Choudhury

Patrice R Calhoun

Rohit Kumar Suri

Biswaranjan Panda

Viren K Malaviya

Bhanu Gopalasetty

Fusun Ertemalp

Gaetan Feige

Hy Quoc Pham

Rabih A Dabboussi

Carlos M Pignataro

Eric Michel Levy-Abegnoli

Mark Grayson

Robert Charles Meier

Frank Brockners

Paul M Quinn

Timothy S Olson

Huizhao Wang

Robert A Mackie

Vojislav Vucetic

Parviz Yegani

Michael David Geller

Reinaldo Penno

Hung The Chau

Bruce Albert Thompson

David Charlton Forster

Vivek Kansal

Chui-Tin Yen

Jonathan Augustine Kunder

Christine Andiazabal

Roy Laurens

Gary B Mahaffey

Milind M Kulkarni

Madhavi W Chandra

Daniel George Wing

Hendrikus G P Bosch

Chris O'Rourke

Abhijit Patra

Louis F Menditto

Robert Michael Batz

Surendra M Kumar

Joseph Salowey

Francois Le Faucheur

Michael Lindsay Shannon

Subharthi Paul

Daniel A Alvarez

Donovan O'Hara

Saman Taghavi Zargar

David Lindert

Bruce A McMurdo

Yu-Cheng Shao

John M Glotzer

Kevin A Buchanan

Weiwei Kang

Paulina Dung Tran

An extended service-function chain (SFC) proxy is hosted on a network node and connected to a service path formed by one or more network nodes hosting a chain of service-functions applied to packets traversing the service path. The packets each include a service header having a service path identifier and a service index. A packet of a traffic flow destined for a service-function is received from the service path and sent to the service-function. An indication to offload the traffic flow is received from the service-function. The indication is stored in a flow table having entries each identifying a respective traffic flow. A subsequent packet of the traffic flow is received from the service path. The flow table is searched for the indication to offload the traffic flow. Upon finding the indication, the service-function is bypassed, and the subsequent packet is forwarded along the service path.

Service-function chaining using extended service-function chain proxy for service-function offload

In a mobile network, an identity of a security group associated with user equipments (UEs) may be obtained. A segment route (SR) path for session communications in the mobile network for the UEs may be selected based on the identity of the security group. The SR path may be one of a plurality of SR paths in a transport network used by the mobile network and defined at least in part by one or more segment IDs (SIDs). An identity of a virtual network associated with the security group may also be obtained. The selected SR path and the identity of the virtual network may be provisioned in one or more routers of the transport network, such that IP messages communicated for the UEs in the mobile network are forwarded via the selected SR path and (at least ultimately) via the tunnel associated with the security group.

Methods and apparatus for use in providing transport and data center segmentation in a mobile network

Presented herein are methodologies for implementing application security. A method includes generating an extraction vector based on a plurality of application security rules to be enforced, transmitting the extraction vector to a first agent operating on a first network device and to a second agent operating on a second network device; receiving, separately, from the first agent and from the second agent, first metadata generated by the first agent and second metadata generated by the second agent by the agents applying the extraction vector to network traffic passing, respectively, through the first network device and the second network device. The first metadata includes a transaction ID assigned by the first agent, and the second metadata includes the same transaction ID. The method further includes correlating the first metadata with the second metadata based on the transaction ID to construct a transactional service graph for the network traffic.

Lightweight distributed application security through programmable extraction of dynamic metadata

A method is performed by a master network device among network devices of a cluster. The master network device receives cluster configuration information including a set of Internet Protocol (IP) addresses and a pool of port blocks associated with the IP addresses. Each port block includes multiple ports, and the pool of the port blocks is to be shared across the network devices for port address translation. The master network device divides the port blocks in the pool into multiple buckets. The master network device allocates to each network device in the cluster a corresponding one of the buckets, and reserves each bucket that is not allocated for allocation to a potential new network device. When a new network device joins the cluster, the master network device allocates to the new network device the port blocks from a corresponding one of the reserved buckets.

Port address translation scalability in stateful network device clustering

A method is provided including obtaining at a newly added flow mapper node of a plurality of flow mapper nodes, from a first flow locator node of a plurality of flow locator nodes, a flow owner lookup request for flow state information that includes identification of a particular flow locator that is to handle processing of a packet flow. The newly added flow mapper node determines whether it has stored flow state information. When the newly added flow mapper node does not have stored flow state information, the newly added flow mapper node identifies a particular flow mapper node of the plurality of flow mapper nodes which has stored flow state information for the particular packet flow and services the flow owner lookup request using flow state information stored by the particular flow mapper node.

High performance for efficient auto-scaling of stateful service

An example method for facilitating hierarchical clustering in a geographically dispersed network environment is provided and includes receiving a packet at one of a plurality of adaptive security appliance (ASA) units in one of a plurality of ASA clusters in a cluster domain of a network environment, identifying the packet as matching an inter-data center live traffic profile, identifying a target ASA cluster in the plurality of ASA clusters in the cluster domain, querying a domain director in the target ASA cluster for a flow owner, and if the flow owner is identified by the domain director, forwarding the packet to the flow owner in the target cluster, and if the flow owner is not identified by the domain director, and the domain director includes a flow state for a flow to which the packet belongs, designating the ASA unit as the flow owner.

Hierarchical clustering in a geographically dispersed network environment

A method is performed by a master network device among network devices of a cluster. The master network device receives cluster configuration information including a set of Internet Protocol (IP) addresses and a pool of port blocks associated with the IP addresses. Each port block includes multiple ports, and the pool of the port blocks is to be shared across and used by the network devices for port address translation on network connections with the network devices. The master network device divides the port blocks in the pool into multiple buckets. The master network device first allocates to each network device in the cluster a corresponding one of the buckets, and reserves each bucket that is not allocated for allocation to a potential new network device. When a new network device joins the cluster, the master network device second allocates to the new network device the port blocks from a corresponding one of the reserved buckets.

Embodiments are directed to receiving an original packet at a service function; determining, for a reverse packet, a reverse service path identifier for a previous hop on a service function chain; determining, for the reverse packet, a service index for the reverse service path identifier; and transmitting the reverse packet to the previous hop on the service function chain.

Method, medium, and apparatus for inserting a placeholder service function

A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; de-capsulating the data packet; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; and offloading the data packet from the backhaul link. In more specific embodiment, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other examples, the method can include identifying that the data packet is a downstream data packet; identifying a service to be performed for the data packet that cannot be performed at the first network element; and communicating the data packet to a second network element.

System and method for offloading data in a communication system

Embodiments are directed to a virtual mobility anchor network element to receive, from a packet gateway (PGW) node, a request for an internet protocol (IP) address for a mobile device, establish an IP address for the mobile device; and provide the IP address to the PGW node in response to the request for the IP address for the mobile device. The virtual mobility anchor network element is configured to receive IP traffic from a network location; determine a target destination for the IP traffic based on a destination IP address, the destination IP address comprising the second IP address; and forward the IP traffic to the PGW node associated with the destination IP address. The virtual mobility anchor network element is also configured to receive IP traffic from the PGW node; determine a target destination for the IP traffic; and route the IP traffic to the target destination.

Virtual mobility anchor for network sharing

Generating packets in a reverse direction of a service function chain

Growing community of inventors

Palo Alto, CA, United States of America

Kent Kinchu Leung