Telefonaktiebolaget Lm Ericsson (publ)

Cisco Technology, Inc.

Other

Kiran Kumar Yedavalli

Sanjay Kumar Hooda

Shyamsundar Nandkishor Maniyar

Ramesh Mishra

Jian Chen

Neda Beheshti-Zavareh

Syam Sundar V Appala

Anand Krishnamurthy

Japson Jeyasekaran

Embodiments herein describe techniques for prioritizing applications based on application usage data. The space in the TCAM in many network devices is limited. That is, there may be more applications (and corresponding QoS settings) than there is space in the TCAM. In the embodiments herein, a netflow collector monitors the traffic flows in the network devices. A application usage tracker can identify which applications generate traffic in which network devices. That is, the application usage tracker can identify, based on the information provided by the netflow collector, the application usage of each network device. The central management tool can prune the applications that are not used by the network device and generate QoS settings only for applications that are used by the network device.

QOS policy provisioning on resource constrained network devices

In one example, a network element in a first network receives a network packet including a first security group identifier. The network element identifies the first security group identifier, determines that the first security group identifier is hierarchically correlated with a second security group identifier, and inserts the second security group identifier into the network packet. The network element forwards the network packet including the second security group identifier.

Hierarchical security group identifiers

In one example embodiment, a network appliance is configured to process packets in a network. The network appliance obtains a mapping of a domain name to a security group tag having associated therewith one or more security policies. The network appliance receives a network packet having an Internet Protocol address. The network appliance determines a particular domain name associated with the Internet Protocol address of the packet. Based on the mapping of the domain name to the security group tag and the particular domain name, the network appliance determines whether the network packet is associated with the security group tag. The network appliance applies the one or more security policies to the network packet based on the security group tag when the particular domain name of the network packet matches the domain name.

Applying computer network security policy using domain name to security group tag mapping

Presented herein are techniques for determining the impact a policy change might have on a network. The techniques include receiving configuration information from a plurality of network devices in a network, receiving traffic flow records from the plurality of network devices, receiving an indication of an intent to apply a new policy on the network devices, and based on the configuration information, traffic flow records and the new policy, determining an impact of the new policy on the network devices and traffic flowing through the network.

Assuring policy impact before application of policy on current flowing traffic

A method and system is implemented in a network node that functions as a controller for a domain in a split architecture network. The domain comprises a plurality of flow switches, where the plurality of flow switches implement a data plane for the split architecture network and the controller implements a control plane for the split architecture network that is remote from the data plane. The method and system configure the plurality of flow switches to efficiently handle each type of broadcast packet in the domain of the split architecture network without flooding the domain with the broadcast packets to thereby reduce a number of broadcast packets forwarded within the domain.

Packet broadcast mechanism in a split architecture network

Disclosed are system, methods, and non-transitory computer readable media for accurately calculating a default gateway of an endpoint without probing the endpoint for the configured values to determine the path between network elements. Tracing the path of a flow in a network and displaying that on a user interface is extremely useful for network troubleshooting purposes. In order to find the gateway the flow would take out of the L2 domain, the endpoint's L2 default gateway is required. Usually the L2 gateway for network endpoints is configured on the endpoints themselves and this information cannot be accessed by network controllers (e.g., APIC-EM) directly. In such cases APIC-EM needs to determine the L2 gateway based on the information available to it from the network elements, instead of the endpoints themselves.

Systems and methods for determining a default gateway without an endpoint configuration

A method is implemented in a network element that functions as one of a plurality of controllers for one of a plurality of areas of a split architecture network. The controller provides a control plane for the area of the split architecture network where the controller is remote from a plurality of switches providing a data plane for the area of split architecture network. The controller facilitates optimized routing across the plurality of areas of the split architecture network by providing limited intra-area link cost data to other controllers of other areas of the split architecture network and to traditional routers of a network including the split architecture network. The limited intra-area link cost data provides costs of each possible shortest path traversal of the area of the controller without providing all internal link cost data.

Implementing OSPF in split-architecture networks

Method and apparatus for reducing forwarding table sizes in flow switches in a flow-based, split-architecture network is described. In an embodiment, a set of flow switches along a flow path is identified to form a switch pool. The forwarding table of only one of the flow switches in the switch pool is configured to have a flow entry that is associated with a particular flow. The flow entry includes a set of match fields for identifying packets belonging to that particular flow, and a set of actions to be performed on the packets belonging to that particular flow.

Growing community of inventors

San Jose, CA, United States of America

Kiran Kumar Yedavalli