Palo Alto Networks, Inc.

Juniper Networks, Inc.

Vectra Networks, Inc.

Monty Sher Gill

Wilson Xu

Yueh-Zen Chen

Nir Zuk

Martin Walter

Yonghui Cheng

Nicholas Campagna

Roger Allen Chickering

Charles A Bering, Jr

Yi Sun

Nicolas Beauchesne

Oliver Kourosh Tavakoli

A host identification engine receives network traffic from a network and uses one or more artifact extractors to extract artifact data items that can identify a host. The artifact data items can be stored in a host signature database. Network addresses to which the hosts correspond can be stored in a network address database. A mapping table can be implemented to match the data in the signature database and network database to generate durable host identification data that can accurately track hosts as they use different identification data and/or move between hosts.

Method and system for generating durable host identifiers using network artifacts

Methods, systems, and apparatus, including computer program products, featuring receiving at a network device a plurality of packets associated with a flow, one or more of the plurality of packets having associated header data and content. Based on the content of one or more first packets in the plurality of packets, the network device identifies an application associated with the flow, where none of the first packets is addressed to the network device. For one or more second packets associated with the flow, the network device determines a forwarding destination for the second packets based on the application associated with the flow and forwards the packet according to the determined forwarding destination.

Application based packet forwarding

Techniques for credentials management in large scale virtual private network (VPN) deployment are disclosed. In some embodiments, credentials management in large scale VPN deployment includes generating a public/private key pair and a certificate signing request at a satellite device; automatically communicating the certificate signing request to a portal over a public, untrusted network to authenticate the satellite device using a serial number associated with the satellite device, in which the certificate signing request and the serial number are verified by the portal; and receiving a certificate from the portal for using to establish VPN connections and configuration information for the satellite device, in which the certificate includes a credential signed by a trusted certificate authority, and the configuration information includes gateway configuration information identifying a plurality of gateways to which the satellite device is configured to connect using VPN connections.

Credentials management in large scale virtual private network deployment

Techniques for configuring and managing remote security devices are disclosed. In some embodiments, configuring and managing remote security devices includes receiving a registration request for a remote security device at a device for configuring and managing a plurality of remote security devices; verifying the registration request to determine that the remote security device is an authorized remote security device for an external network; and sending a response identifying one or more security gateways to the remote security device, in which the remote security device is automatically configured to connect to each of the one or more security gateways using a distinct Layer 3 protocol tunnel (e.g., a virtual private network (VPN)).

Configuring and managing remote security devices

A device may include first logic configured to receive a data unit and to receive a network policy. The device may include second logic configured to identify how the data unit will be handled by the network policy and to generate a result that includes information about how the data unit will be handled by the network policy.

Testing policies in a network

In general, the present disclosure describes techniques for both removing memory buffers from and adding memory buffers to a list (e.g., a linked list) of available buffers, for use by a network device, without locking the list during access. One example method includes allocating a list of memory buffers that are each available for use by multiple modules executed within the network device, wherein the list includes a first end and a second, opposite end, and removing a first memory buffer from the first end of the list by a first module of the multiple modules without locking the list. The method further includes adding the first memory buffer to the second end of the list by a second module of the multiple modules without locking the list.

Growing community of inventors

San Jose, CA, United States of America

Monty Sher Gill