Cisco Technology, Inc.

Michael H Behringer

Steinthor Bjarnason

Yves Hertoghs

Yves Francis Eugene Hertoghs

James Neil Guichard

Patrice Bellagamba

Max Pritikin

Balaji B L

Pascal Thubert

Alvaro E Retana

Toerless Eckert

Santiago Vazquez Freitas

Ather Sayeed Kanak

Shashi Kumar Bansal

Bruno Klauser

Gaurav Chhabra

Aswini Kumar Sattaluri

Neighbor discovery is used to create a generic trust database for other applications. As part of the neighbor discovery, each device performs classification and validation of the credentials of the neighboring devices. The credentials and validation results are stored locally without having to perform a separate authentication step. The trust database is created and maintained as a neighbor table with the results of the validation. The generic trust database may then be consulted by other protocols. The neighbor discovery may use any of various underlying protocols, but the resulting table unifies the results such that other applications or protocols may take advantage of the secured identity without having to implement their own discovery process. Both discovery and validation may be implemented locally without relying on centralized servers. Manual configuration may be avoided.

Using neighbor discovery to create trust information for other applications

In one embodiment, a device in a network receives update recovery data from a neighbor of the device in the network. The device monitors the neighbor during installation of a software update by the neighbor. The device detects an installation failure of the software update by the neighbor. The device causes recovery of the neighbor using the update recovery data, in response to detecting the installation failure of the software update by the neighbor.

Peer-assisted image update with self-healing capabilities

In one embodiment, a method includes receiving at a virtual controller operating at a network device, global parameters for a plurality of virtual machines located in a first network site and in communication with a second network site through a switch, converting at the virtual controller, the global parameters into global overlay network parameters, and transmitting the global overlay network parameters to the switch for use in automatically creating a global network overlay. The global overlay network parameters define an end-to-end network extending from the virtual machines in the first network site to a plurality of virtual machines in the second network site. An apparatus and logic are also disclosed herein.

Method and apparatus for creation of global network overlay with global parameters defining an end-to-end network

In one implementation, sub-interfaces are defined in Layer three (L3) tunnels, such as generic routing encapsulization (GRE) or Internet protocol security (IPsec) tunnels. Sub-interfaces inside a L3 tunnel may be preferred to using several L3 tunnels. The flow label of the tunnel header is used to define sub-interfaces of a tunnel interface. The flow label is populated with a routing instance identifier to index the sub-interfaces.

Tunnel sub-interface using IP header field

A method in an example embodiment includes creating an initial information package for a device attempting to join a network domain of a network environment; communicating the initial information package to a signing authority; sending an authorization token generated by the signing authority to the device, wherein the device validates the authorization token based on a credential in the device; and receiving an audit history report of the device, wherein the audit history report comprises information regarding previous attempts by the device to join the network environment. The method may also include applying a policy to the device based on the audit history report; generating a completed information package, wherein the completed information package includes an authorization token; applying a second signature to the completed information package; and sending the authorization token and the completed information package to the device, the device validating the second signature on the completed information package.

System and method for enabling unconfigured devices to join an autonomic network in a secure manner

A method is provided in one example embodiment and includes configuring a local network element as an autonomic registrar for a designated network domain; establishing an autonomic control plane ('ACP') between the local network element and one or more remote network elements identified by local network element as a remote neighbor; designating a locally-defined subnet at the local network element to be extended to each of the one or more remote network elements; and executing an ACP command at the local network element, wherein the executing triggers a message to each of the one or more remote network elements, the message including information regarding the designated local subnet. The information included in the message is used by each of the remote network elements to auto-resolve its Locator/Identifier Separation Protocol ('LISP') configuration, enabling the designated local subnet to be extended to each of the one or more remote network elements.

Autonomic locator/identifier separation protocol for secure hybrid cloud extension

To avoid user error and breaking operations, administration and management (OAM), the control plane for implementing OAM is automatically generated by network devices without user input. This control plane is hidden from the user, preventing any configuration that may bring down the connectivity for OAM.

Automated control plane for limited user destruction

A method in an example embodiment includes creating an initial information package for a device in a domain of a network environment when the device is unconfigured. The method further includes communicating the initial information package to a signing authority, receiving an authorization token from the signing authority, and sending the authorization token to the unconfigured device, where the unconfigured device validates the authorization token based on a credential in the unconfigured device. In more specific embodiments, the initial information package includes a unique device identifier of the unconfigured device and a domain identifier of the domain. In further embodiments, the signing authority creates the authorization token by applying an authorization signature to the unique device identifier and the domain identifier. In other embodiments, the method includes receiving an audit history report of the unconfigured device and applying a policy to the device based on the audit history report.

In one implementation, security configuration is automated based on information gathered using autonomic neighbor discovery. The neighbor discovery establishes a realm of trust between neighbors, such as determining that some neighbors may be trusted and others may not be trusted. A dynamic security barrier is created using the trust where devices on the network border protect the entire network. Differences in trust result in differential security configuration.

Autonomic network protection based on neighbor discovery

A computer system includes functionality enabling a provider edge router to determine whether network data such as VRF information is properly associated with a corresponding virtual private network. A first node through which the network data is transmitted generates a signature value uniquely associated with the virtual private network. The first node forwards the signature value along with the network data to a second node of the physical network. The second node, in turn, verifies that the network data (such as VRF information) is properly associated with the second node (and virtual network) based on its own generation of a signature value, which is compared with the signature value received from the first node.

Methods and apparatus to configure network nodes supporting virtual connections

In one embodiment, accessing a device name, which includes a hostname and a domain name, of a network device; applying a hash function to the domain name to obtain 40 bits as a Global ID of an Internet Protocol version 6 (IPv6) unique local address (ULA); and encoding the hostname to obtain 80 bits as a Subnet ID and an Interface ID of the IPv6 ULA.

Growing community of inventors

La Colle sur Loup, France

Michael H Behringer