Juniper Networks, Inc.

Aerohive Networks, Inc.

Mu Lin

David Delano Ward

Xu Zou

John William Hanay

Zi Zhou

Joel Abraham Obstfeld

Sriram Raghunathan

Hui Qu

Colby Barth

Shine-Chu Wang

Yanfang Zhang

Heng-Hui Debbie Chu

Leyi Zhang

Anjali Kulkarni

Techniques are described for distributing network device tasks across virtual machines executing in a computing cloud. A network device includes a network interface to send and receive messages, a routing unit comprising one or more processors configured to execute a version of a network operating system, and a virtual machine agent. The virtual machine agent is configured to identify a virtual machine executing at a computing cloud communicatively coupled to the network device, wherein the identified virtual machine executes an instance of the version of the network operating system, to send, using the at least one network interface and to the virtual machine, a request to perform a task, and to receive, using the at least one network interface and from the virtual machine, a task response that includes a result of performing the task. The routing unit is configured to update the network device based on the result.

Distributed processing of network device tasks

A request related to an access to a network by a first user device may be received. The user device may be included in a plurality of user devices associated with a first first-level security profile assigned to the user. An application extension to an application executing on the first user device may be accessed in response to the request related to the access. A network connectivity file may be provided to the application extension. The network connectivity file may include network configuration information for the first user device. The network configuration information may be associated with a first second-level security profile assigned to the first user device. Instructions to configure the first user device to access the network based at least in part on the network configuration information in the network connectivity file may be provided.

User-based network onboarding

Techniques are described for separating control plane functions in a network device using virtual machines. The techniques include initializing multiple virtual machine instances in a control unit of a standalone router, and running different control processes for the router in each of the virtual machines. For example, in a root system domain (RSD)-protected system domain (PSD) system, a control unit of the standalone router may support a RSD virtual machine (VM) and one or more PSD VMs configured to form logical devices and execute logically separate control processes without requiring physically separate, hardware-independent routing engines to form the PSDs. Each of the RSD VM and PSD VMs includes a separate kernel, an operating system, and control processes for the logical device. When a software failure occurs in the PSD VM, the PSD VM may perform a software failover without affecting the operation of the RSD VM.

Separation of control plane functions using virtual machines in network device

A network security system including a first-level security profile engine and a second-level security profile engine is disclosed. The first-level security profile engine may assign a first-level security profile for a first user device, the first user device requesting access to a network; the second-level security profile engine assigns a first second-level security profile to the first user device, the first second-level security profile providing first network configuration information for the first user device; a device selection engine receives a selection of a second user device associated with the first-level security profile; and the second-level security profile engine assigns a second second-level security profile to the second user device, the second second-level security profile providing second network configuration information for the second user device. A device network configuration engine can then configure the first user device to access the network based on the first network configuration information.

A network security system including a first-level security profile engine and a second-level security profile engine is disclosed. In an example of operation, the first-level security profile engine assigns a first-level security profile for a first user device, the first user device requesting access to a network; the second-level security profile engine assigns a first second-level security profile to the first user device, the first second-level security profile providing first network configuration information for the first user device; a device selection engine receives a selection of a second user device associated with the first-level security profile; and the second-level security profile engine assigns a second second-level security profile to the second user device, the second second-level security profile providing second network configuration information for the second user device. A device network configuration engine can then configure the first user device to access the network based on the first network configuration information.

Systems and methods for user-based network onboarding

Techniques are described for providing high availability for a network device, e.g., a router, using full memory replication between a primary virtual machine (VM) and a standby VM running on the network device. In one example, the techniques provide hot-standby high availability for a router by initializing a primary VM and a standby VM on the router at the same time. In another example, the techniques provide high availability for the router by initializing a standby VM on the router upon detecting a failure of the primary VM. In both examples, the primary VM controls the routing functionality and periodically stores a full memory state. Upon a failure of the primary VM, a hypervisor may perform a full memory replication between the primary VM and the standby VM. The standby VM may then take control of the routing functionality at the last stored state of the memory.

High availability using full memory replication between virtual machine instances on a network device

The control plane of a network device comprises a plurality of software processes that manage routing control operations of the device. Through a hypervisor in the control plane, a managing virtual machine controls access to a first virtual machine running a first software system to control a routing communication session between the network device and other network devices. In response to an in-service software upgrade request, the managing virtual machine initializes a second virtual machine. On the second virtual machine, the second software system is loaded. State data maintained by the managing virtual machine can be transferred to the second virtual machine, and the second virtual machine takes control of the routing communication session. During the transfer of control from the first virtual machine to the second virtual machine, techniques of 'non-stop forwarding' and 'graceful restart' can be implemented to minimize the effect the switchover has on the network.

Configuration update on virtual control plane

Techniques described in this disclosure relate to configuration updates, such as performing an in-service software upgrade on a device, using virtual machines. In a routing device, a routing engine utilizes a virtual machine executing on a hypervisor to provide control plane functions. In one example, an in-service software upgrade may be performed between a first virtual machine and a second virtual machine without a managing virtual machine. More specifically, a first virtual machine in the control plane of the router may control the upgrade process, including requesting initialization of the second virtual machine, installing a new software system on the second virtual machine, and replicating state data from the first virtual machine to the second virtual machine. In this example, the first virtual machine may operate as a master virtual machine and the second virtual machine may operate as a slave virtual machine that synchronizes with the master virtual machine.

Growing community of inventors

Sunnyvale, CA, United States of America

Mu Lin