Cisco Technology, Inc.

Mauricio Arregoces

Maurizio Portolani

Nagaraj Bagepalli

Subramanian Chandrasekaran

Stefano Testa

David W Chang

Pritesh N Patel

Christopher Spain

Timothy W Stevenson

Christopher M O'Brien

Albert H Mitchell, Jr

April Chou

In one embodiment, a request may be received from a first cloud network of a hybrid cloud environment to transmit data to a second cloud network of the hybrid cloud environment, wherein the request can include a security profile related to the data. The security profile may be automatically analyzed to determine access permissions related to the data. Based at least in part on the access permissions, data can be allowed to access to the second cloud network.

Hybrid cloud security groups

A method and system for fast link failover is disclosed. According to one embodiment, a method is provided in which a failure of a first link between a network element and an upstream portion of a communications network is detected, and a second link or group of links between the network element and a downstream portion of the communications network is responsively disabled to maintain a communications channel between the downstream and upstream portions of the communications network.

Method and system for fast link failover

A data center provides secure handling of HTTPS traffic using backend SSL decryption and encryption in combination with a load balancer such as a content switch. The load balancer detects HTTPS traffic and redirects it to an SSL offloading device for decryption and return to the load balancer. The load balancer then uses the clear text traffic for load balancing purposes before it redirects the traffic back to the SSL offloading device for re-encryption. Thereafter, the re-encrypted traffic is sent to the destination servers in the data center. In one embodiment, the combination with the back-end SSL with an intrusion detection system improves security by performing intrusion detection on the decrypted HTTPS traffic.

System for SSL re-encryption after load balance

A data-center network architecture. The data-center network architecture incorporates a front end having an aggregation layer exhibiting integrated service-module intelligence. A server farm connects the front end with a storage network. In a specific embodiment, the aggregation layer includes plural interconnected multilayer switches incorporating service-module intelligence implemented via one or more service modules. Plural layer-switches communicate with the plural multilayer switches. The server farm includes one or more servers that are dual homed or multihomed with the plural layer-switches. The storage network includes plural interconnected multilayer directors and one or more Fibre Channel hosts using Host Bus Adapters (HBAs) that interface one or more data-storage devices to the server farm.

Data-center network architecture

An intrusion detection system (IDS) is capable of identifying the source of traffic, filtering the traffic to classify it as either safe or suspect and then applying sophisticated detection techniques such as stateful pattern recognition, protocol parsing, heuristic detection or anomaly detection either singularly or in combination based on the traffic type. In a network environment, each traffic source is provided with at least one IDS sensor that is dedicated to monitoring a specific type of traffic such as RPC, HTTP, SMTP, DNS, or others. Traffic from each traffic source is filtered to remove known safe traffic to improve efficiency and increase accuracy by keeping each IDS sensor focused on a specific traffic type.

Intrusion detection in a data center environment

A one-arm data center topology routes traffic between internal sub-nets and between a sub-net and an outside network through a common chain of services. The data center topology employs layerservices on a common chassis or platform to provide routing and firewall services while reducing the number of devices necessary to implement the data center and simplifying configuration. Load balancing is provided by a load balancing device. In the one-arm topology, policy based routing or client network address translations or NAT pushes traffic to the CSM.

One arm data center topology with layer 4 and layer 7 services

An architecture, arrangement, system, and method for providing service access in a data center are disclosed. In one embodiment, an arrangement can include: an aggregation switch configured to transfer data between a network and an access layer; and service modules coupled to the aggregation switch, where each service module is configured to provide a service for the data when selected. The service modules can include: firewall, load balancer, secure sockets layer (SSL) offloader, intrusion detection system (IDS), and cache, for example. Further, the service selection can be substantially transparent to an associated server.

Growing community of inventors

Rancho Palos Verdes, CA, United States of America

Mauricio Arregoces