Cisco Technology, Inc.

Muninder Singh Sambi

Sanjay Kumar Hooda

Anand K Oswal

Victor Manuel Moreno

Prakash C Jain

Satish Kumar Kondalam

Tarunesh Ahuja

Sumeet Singh

Kedar Karmarkar

Gangadharan Byju Pularikkal

Sanjay Thyamagundalu

Rajeev Kumar

Shyamsundar Nandkishor Maniyar

Ashok Ganesan

Nikhil Sharma

Himanshu Mehra

Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Software defined access fabric without subnet restriction to a virtual network

Cloud delivered access may be provided. A network device may provide a client device with a pre-authentication virtual network and a pre-authentication address. Next, a policy may be received in response to the client device authenticating. The client device may then be moved to a post-authentication virtual network based on the policy. A post-authentication address may then be obtained for the client device in response to moving the client device to a post-authentication virtual network. Traffic for the client device may then be translated to the post-authentication address.

Cloud delivered access

Secure network segmentation using logical subnet segments is described. A single network segment or subnet provided by a third party is mapped into multiple layer-3 virtual or logical segments without requiring separate subnets. This mapping is accomplished by using virtual routing functions (VRFs) per logical subnet segment while retaining a single subnet across the segments. The logical subnet segments interact with the single network segment provided by the third party (ISP). The layer-3 VRF instances are created without the need for separate IP subnet pools per layer-3 segment. Each VRF instance for the various logical subnet segments is mapped to an identifier and tag.

Micro and macro segmentation in enterprise networks without a per segment layer-3 domain

Techniques for automated configuration are provided. A first device detects a new device connected by one or more new links in a network, and the first device transmits, to a dynamic host configuration protocol (DHCP) server, a request for a first new subnet. The first device then assigns a first address of the first new subnet to a first new interface of the first device. The first device additionally transmits a second address of the first new subnet to the new device, where the new device uses the second address to establish connectivity to the network.

Secure onboarding of network devices

Secure network segmentation using logical subnet segments is described. A single network segment or subnet provided by a third party is mapped into multiple layer-3 virtual or logical segments without requiring separate subnets. This mapping is accomplished by using virtual routing functions (VRFs) per logical subnet segment while retaining a single subnet across the segments. The logical subnet segments interact with the single network segment provided by the third party (ISP). The layer-3 VRF instances are created without the need for separate IP subnet pools per layer-3 segment. Each VRF instance for the various logical subnet segments is mapped to a Virtual Network Identifier (VNI) and Scalable Group Tag (SGT).

A network device may receive a flow having source information corresponding to a first client device and destination information corresponding to a second client device. A tag may then be created by the network device for the flow based upon the source information and the destination information. Next, the network device may encapsulate a packet corresponding to the flow. The packet may be encapsulated with encapsulation information including the created tag. The encapsulated packet may then be routed through a plurality of intermediate network devices in the network. The created tag encapsulated with the packet may identify the packet as being a part of the flow as the packet is routed through the plurality of intermediate network devices.

Underlay overlay correlation for visibility and debugging

An application switch instantiates two application-side network service instances for the same application. Each network service instance is characterized by a common Internet Protocol (IP) address, a common Open Systems Interconnection (OSI) reference model layer 2 (L2) media access control (MAC) address, and a unique (for the application) supplemental L2 identifier. The application switch maintains a mapping between a {client IP address, client port} tuple and a particular instantiated network service instance based at least in part on the supplemental L2 identifier of a particular one of the instantiated first and second network service instances. When the application switch receives a client communication via an application switch client-side network, the application switch determines the particular instantiated network service instance corresponding to the {&#x3c;client IP address&#x3e;, &#x3c;client port&#x3e;} tuple based on the mapping, and switches the received client communication to the determined application-side network service instance.

Computer network control for application instantiation

At a data switching device in a data center, it is detected whether a host has connected to a cloud computing network of which the data switching device and the data center are components. The detection is performed without directly communicating with the host. The data switching device determines properties of the host and generates a message comprising data representative of the properties of the host. The message is sent from the data switching device to a node in the cloud computing network that is configured to manage components of the cloud computing network associated with the host.

Host visibility as a network service

In one embodiment, at a packet-forwarding engine for receiving packet flows and conditionally routing packets in the packet flows to one or more applications, a method includes receiving from a particular one of the applications a request that requests the packet-forwarding engine not to route the particular one of the packet flows to the particular one of the applications and identifies one or more conditions for routing particular ones of the packets in the particular one of the packet flows to the particular one of the applications. The method further includes, receiving a particular packet in the particular one of the packet flows, determining whether one or more of the conditions for routing the particular packet to the particular one of the applications are met, and routing or not routing the particular packet to the particular one of the applications based on the determination.

Growing community of inventors

Fremont, CA, United States of America

Muninder Singh Sambi