At&t Intellectual Property I, L.p.

Michael J Satterlee

John F Gibbons

Neal Shackleton

Sridhar Narahari

Sandeep Gupta

Dustin Grant

Jamil Cheikhali

John Babu Medamana

Mark Anthony Elias

Alexandre Gerber

Jacobus Erasmus Van Der Merwe

Carsten Lund

John Gibbons

Jai Narayn Gosine

Lalitha Parameswaran

Stephen Matthew Hutnik

Zhen Qi Dong

Architectures and techniques are presented that provide an improved mechanism for a subscriber entity to report to a network provider a network issue that affects the performance of an application that uses a service provided by the network provider. The improved mechanism can enable fine granularity with respect to the network issue by identifying the issue on a per-session basis. In response to feedback data that is reported by the subscriber entity, the network provider can perform self-healing or other upgrade techniques to rapidly remedy the network issue.

Subscriber feedback mechanism for real-time network service upgrade

Distributed firewalls in a network are disclosed. Example firewall controllers disclosed herein are to instruct a first network node of a software-defined network to implement a first firewall instance of a distributed firewall, the first network node to implement the first firewall instance with a first virtual machine. Disclosed example firewall controllers are also to configure a second network node of the software-defined network to route network traffic through the first firewall instance and, after at least some of the network traffic is dropped by the first firewall instance, instruct the second network node to implement a second firewall instance of the distributed firewall, the second network node to implement the second firewall instance with a second virtual machine.

Methods and apparatus to provide a distributed firewall in a network

Devices, computer-readable media, and methods for routing traffic of a network service via a virtual private network that is configured in accordance with a virtual private network configuration preference of an identified user are described. A method may determine a network service that an endpoint device is attempting to access and may detect an identity of a user of the endpoint device. The processing system may obtain a plurality of virtual private network configuration preferences of the user, each of the plurality of virtual private network configuration preferences matching a virtual private network configuration preference with one or more of a plurality of network services, and route traffic of the endpoint device for the network service via a virtual private network that is configured in accordance with a virtual private network configuration preference of the plurality of virtual private network configuration preferences.

Identity-based virtual private network tunneling

Methods and apparatus to provide a distributed firewall in a network are disclosed. Example firewall controllers disclosed herein are to instruct a first network node of a software-defined network to implement a first firewall instance of a distributed firewall, the first network node to implement the first firewall instance with a first virtual machine. Disclosed example firewall controllers are also to configure a second network node of the software-defined network to route network traffic through the first firewall instance and, after at least some of the network traffic is dropped by the first firewall instance, instruct the second network node to implement a second firewall instance of the distributed firewall, the second network node to implement the second firewall instance with a second virtual machine.

Methods and apparatus to provide a distributed firewall in a network are disclosed. An example method includes identifying, at a control plane, a network traffic rule to implement in a network, and determining a first firewall of a distributed firewall in the network to enforce the network traffic rule. Example methods also configure a first software-defined network node to route network traffic to the first firewall. The first firewall is instantiated by a first firewall instance at a second software-defined network node and by a second firewall instance at a third software-defined network node. In response to determining at least some of the network traffic forwarded by the first software-defined network node to the second and third software-defined network nodes is being dropped at the first and second firewall instances, example methods also cause the first software-defined network node to implement a third firewall instance.

Concepts and technologies disclosed herein are directed to virtual private network ('VPN') resiliency over multiple transports. According to one aspect, a customer premises equipment can select, from a transport preference database, a transport from a plurality of transports available to support a VPN tunnel. The transport selected is associated with a highest priority value of the plurality of transports in the transport preference database. The customer premises equipment can initiate setup of the VPN tunnel through the transport and can determine whether setup of the VPN tunnel was successful. If setup was not successful, the customer premises equipment can select a further transport from the plurality of transports available to support the VPN tunnel. Additional details are disclosed herein.

Virtual private network resiliency over multiple transports

Methods and apparatus to provide a distributed firewall in a network are disclosed. An example method includes identifying, at a control plane, a network traffic rule to implement in a network; determining, at the control plane, a distributed firewall for a first firewall in the network to enforce the network traffic rule; instructing, using the control plane, a first software-defined networking node to instantiate the first firewall of the distributed firewall; configuring a second software-defined networking node to route network traffic through the first firewall; and instructing the first software-defined networking node to enforce the network traffic rule.

Information associated with session flows between communication devices and servers is collected and shared. A request is generated for data having predefined attributes within session flows occurring between multiple communication devices and a server over a communication network. The request is sent to a controller having access to information indicating network elements within the communication network traversed by the session flows. The controller selects a network element from among the network elements traversed by the session flows and retrieves the data from the selected network element.

Devices, methods, and computer readable storage devices for collecting information and sharing information associated with session flows between communication devices and servers

Methods and apparatus to dynamically control connectivity within VPNs are disclosed. A disclosed example method includes a route server for storing an indication in an entry for a first pair of provider edge routers in a virtual private network (intra-VPN) connectivity database, the intra-VPN connectivity database including entries for a plurality of pairs of provider edge routers. The indication to define an additional connectivity for the first pair of provider edge routers beyond connectivity defined in a virtual private network routing and forwarding table associated with a first provider edge router of the first pair of provider edge routers. The first pair of provider edge routers including a second provider edge router to which the first provider edge router is to be communicatively coupled.

Methods and apparatus to dynamically control connectivity within virtual private networks

A method of routing data in a network includes sending an instruction to a router to statically route outbound traffic to a firewall farm having an anycast address, identifying prefixes of endpoints that communicate with router, instructing a firewall router to send a route advertisement to the network announcing that the firewall router is the subsequent best hop for data bound for the endpoints, detecting a change in network condition, and sending another instruction to the router to route outbound traffic to another firewall farm having the anycast address after detecting the change.

System and method to route data in an anycast environment

Methods and apparatus to dynamically control connectivity within VPNs are disclosed. A disclosed example method includes broadcasting, by a route server, a border gateway protocol advertisement as received at the route server; determining a first provider edge router is to be configured for additional connectivity beyond a connectivity defined in a table associated with the first provider edge router, the additional connectivity including an identification of a second provider edge router to which the first provider edge router is to be communicatively coupled; generating a copy of the received border gateway protocol advertisement; modifying the copy of the received border gateway protocol advertisement to facilitate the additional connectivity; and broadcasting the modified copy of the received border gateway protocol advertisement.

A method includes receiving a control message that identifies a first video conference terminal as an active talker. The method includes sending, in response to the control message, outgoing video conference data from the first video conference terminal via a first multicast group to two or more video conference terminals joined to the first multicast group. The method also includes sending a command to join a second multicast group in response to the control message.

Growing community of inventors

Clifton Park, NY, United States of America

Michael J Satterlee