Cisco Technology, Inc.

Ketan Jivan Talaulikar

Clarence Filsfils

Peter Psenak

Robert Hanzl

Paul Wells

Francois Clad

Stephane Litkowski

Lester C Ginsberg

Stefano Benedetto Previdi

Mankamana Prasad Mishra

Swadesh Agrawal

Balaji Muthuvarathan

Sameer Ranjit Gulrajani

In one embodiment, a method by an apparatus of a Border Gateway Protocol-Link State (BGP-LS) environment includes receiving an attestation token from a first component and encoding the attestation token in a BGP-LS signaling message. The method further includes sending the BGP-LS signaling message with the encoded attestation token to a second component of the BGP-LS environment.

Applying attestation to BGP-LS

The present technology is directed to signaling unreachability of a network device, more specifically, a prefix of the network device in network that utilizes route summarization. A pulse trigger agent can detect an unreachability of at least one Provider Edge (PE) device in a network domain of a network and determine that a route summarization is being used within the network where the unreachability of the at least one PE device is hidden by the route summarization. A pulse distribution agent can transmit a failure message informing other PE devices of the unreachability of the at least one PE device.

Signaling a prefix unreachability in a network utilizing a route summarization

In one embodiment, an apparatus includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the apparatus to perform operations including receiving a first type-length-value (TLV) associated with a winning flexible algorithm definition (FAD) from a first element of a network. The operations also include determining a security level for the winning FAD based on the TLV. The operations further include determining a data transmission route through a plurality of elements of the network based on the security level for the winning FAD.

Systems and methods for determining secure network elements using flexible algorithm technology

Various systems and methods for using strict path forwarding. For example, one method involves receiving an advertisement at a node. The advertisement includes a segment identifier (SID). In response to receiving the advertisement, the node determines whether the SID is a strict SID or not. If the SID is a strict SID, the node generates information, such as forwarding information that indicates how to forward packets along a strict shortest path corresponding to the strict SID.

Enforcing strict shortest path forwarding using strict segment identifiers

In one embodiment, method includes receiving, by a first network apparatus, a first multicast message from a second network apparatus. The first multicast message includes attestation-capability information associated with the second network apparatus and an attestation token. The attestation token is for proving that the second network apparatus is in a known safe state. The method also includes determining, by the first network apparatus, that the attestation-capability information satisfies a pre-determined attestation capability requirement and determining, by the first network apparatus, that the attestation token is valid for the second network apparatus at a current time. The method further includes establishing, by the first network apparatus, an adjacency to the second network apparatus.

Applying attestation tokens to multicast routing protocols

In one embodiment, a method includes receiving an OSPF hello message including an attestation token from a second network apparatus, determining that the attestation token is valid for the second network apparatus at a current time, establishing an adjacency to the second network apparatus in response to the determination, computing, based at least on the attestation token, a trust level for a first link from the first network apparatus to the second network apparatus and a trust level for first prefixes associated with the first link, and sending an LSA comprising the trust level for the first link and the trust level for the first prefixes to neighboring network apparatuses, where the trust level for the first link and the trust level for the prefixes are used by the network apparatuses in the network to compute a routing table of the network.

Applying attestation tokens to the open shortest path first (OSPF) routing protocol

In one embodiment, a method includes receiving an ISIS hello message including an attestation token from a second network apparatus, determining that the attestation token is valid for the second network apparatus at a current time, establishing an adjacency to the second network apparatus in response to the determination, computing, based at least on the attestation token, a trust level for a first link from the first network apparatus to the second network apparatus and a trust level for first prefixes associated with the first link, and sending an LSP comprising the trust level for the first link and the trust level for the first prefixes to neighboring network apparatuses, where the trust level for the first link and the trust level for the prefixes are used by the network apparatuses in the network to compute a routing table of the network.

Applying attestation tokens to the intermediate system to intermediate system (ISIS) routing protocol

A method is performed at a source node in a network of nodes configured with a link state protocol, and in which at least some of the nodes are enabled for multiprotocol label switching (MPLS). The node discovers and stores a link state topology representing the nodes of the network, links between the nodes, path-costs for the links, and whether each link is enabled or not enabled for MPLS. The node determines one or more shortest paths from the source node to a destination node among the nodes based on traversing the link state topology and, while the node traverses the link state topology, detects whether each shortest path supports or does not support MPLS end-to-end dataplane continuity. The node programs an IP dataplane with each shortest path, and programs an MPLS dataplane with ones of the one or more shortest paths that support the end-to-end MPLS continuity.

Segment-routing multiprotocol label switching end-to-end dataplane continuity

Various systems and methods for using strict path forwarding. For example, one method involves receiving an advertisement at a node. The advertisement includes a segment identifier (SID). In response to receiving the advertisement, the node determines whether the SID is a strict SID or not. If the SID is a strict SID, the node generates information, such as forwarding information, that indicates how to forward packets along a strict shortest path corresponding to the strict SID.

In one embodiment, a method includes assigning an identifier to a route computation at a network device, grouping route updates for the route computation, marking at least one route update for each group of route updates with the identifier, tracking flow of marked route updates at a plurality of routing components within the network device, and storing tracking data at the network device for use in convergence monitoring. An apparatus and logic are also disclosed herein.

Growing community of inventors

Pune, India

Ketan Jivan Talaulikar