Cisco Technology, Inc.

Kerry Lynn

Dana Lynn Blair

Vamsidhar Valluri

Martin Djernaes

Jeffrey Albin Kraemer

Pritam Shah

Rahul G Patel

Philip J S Gladstone

David James McCowan

In one embodiment, a best exit from an autonomous system (AS) for a controlled prefix is determined. A network device of the AS influences a route for the controlled prefix to be over the best exit. Traffic statistics for the controlled prefix are selected. The network device verifies, based on the traffic statistics, whether the influence has caused at least a configured amount of traffic for the controlled prefix to be over the best exit. When at least the configured amount of the traffic is not directed over the best exit, the network device further influences the route for the controlled prefix to be over the best exit.

Method and apparatus for route optimization enforcement and verification

In one embodiment, a value for a option for a particular policy of a plurality of policies that are ranked in a priority order is ascertained. A variance to the value associated with the option for the particular policy is applied to define a range of acceptable values for the particular policy. A determination is made whether one or more other options exist that have values within the range of acceptable values for the particular policy. If no other options exist that have values within the range of acceptable values for the particular policy, the option is selected If other options exist that have values within the range of acceptable values for the particular policy, the ascertaining, applying and determining is repeated for a next lower priority policy of the plurality of policies to consider the other options, the repeating to occur successively until an option is selected.

Technique for policy conflict resolution using priority with variance

A technique dynamically enforces a best exit selection for a controlled prefix based on policies and real-time performance statistics in a computer network. A Master Controller (e.g., an Optimized Edge Routing, OER, Master Controller) of an autonomous system (AS) in the network selects a best exit from the AS for the controlled prefix, and conveys the selection to a border router having the selected exit. In response, the border router performs a parent lookup to determine whether the controlled prefix is reachable via the best exit. If so, the border router influences routing in the AS for the controlled prefix through the best exit by, e.g., injecting routes or modifying metrics of existing routes. The Master Controller (or border router) then verifies that the routes for the controlled prefix traverse the selected best exit. Notably, if a route does not traverse the selected best exit, the border router may try to influence the route again or remove the influence.

In one embodiment, a first set of one or more control policies at a control server of a network domain may be transmitted to a routing master controller of the network domain, which uses a second set of one or more traffic policies to determine optimal paths for directing traffic through the domain. The routing master controller may then generate a third set of one or more integrated policies based on the first and second sets of policies, e.g., based on the knowledge and policies of both the control server and the routing master controller.

Integrating security server policies with optimized routing control

A security agent extends the trust barrier, or trust point, from network gateway nodes to end user devices. A security agent operable to scrutinize network traffic executes on the user device and compares QoS marking attempts with the established QoS marking policy in effect. The security agent examines network traffic attributes deterministic of connection attempts by user processes. Attempts to apply inappropriate or disallowed QoS markings, as dictated by the QoS marking policy, are detected and disallowed. Therefore, only user connections consistent with the QoS marking policy are permitted into the network. Network admission control (NAC) mechanisms ensure that the security agent is the only access point from the user device to the secure network, and the security agent communicates the establishment of the trusted access point to the network gateway, thus ensuring that the network gateway may trust service level designations emanating from the user device executing the security agent.

Methods and apparatus for trusted application centric QoS provisioning

A technique efficiently renders a policy-based decision from a plurality of options based on policy priority in a computer network. According to the novel technique, each of a plurality of policies is assigned an exclusive priority value, as well as a 'variance' specifying an acceptable value range (e.g., a percentage). Beginning at the highest priority policy, values corresponding to the plurality of options are analyzed based upon the current priority policy, and a 'best' option is determined according to the current policy. Thereafter, the variance for the current policy is applied to the value of the best option, defining a range of acceptable values for the current policy, and remaining options having an acceptable value for the current policy are established. If only one remaining option exists, that option is selected as the best option. Otherwise, the remaining options are analyzed based upon the next priority policy, a best option is determined, the variance is applied, and remaining options are established in the same manner, until a single best option exists.

Growing community of inventors

Sudbury, MA, United States of America

Kerry Lynn