Cisco Technology, Inc.

Palo Alto Networks, Inc.

Nagaraj Bagepalli

Abhijit Patra

David W Chang

Surendra M Kumar

Prashant Gandhi

Anant Thakar

Kirti Prabhu

Paul M Quinn

Dileep Kumar Devireddy

Murali Anantha

David Wei-Shen Chang

James Neil Guichard

David Delano Ward

Michael R Smith

Mauricio Arregoces

Prashanth Thumbargudi

Rajesh Kumar Sethuraghavan

Navindra Yadav

Ganesh Sadasivan

Subramanian Chandrasekaran

Hendrikus G P Bosch

Murali Bashyam

Rina Panigrahy

Sanjay Jain

Daniel Yu-Kwong Ng

Jackie Liu

Jayaraman R Iyer

Fabio Rodolfo Maino

Victor Manuel Moreno

Arivu Mani Ramasamy

Ethan M Spiegel

Vina Ermagan

Maurizio Portolani

Kyle Mestery

Stefano Testa

Anil Kumar Reddy Sirigiri

Mahesh Jethanandani

Arun Kumar Palani

Jason Zhen Zhang

Venkata Sarat Kumar Vajrapu

Bala Gautama

Yavindra Yadav

Wei-Chun Chao

Harsha Narayan

In one embodiment, a request may be received from a first cloud network of a hybrid cloud environment to transmit data to a second cloud network of the hybrid cloud environment, wherein the request can include a security profile related to the data. The security profile may be automatically analyzed to determine access permissions related to the data. Based at least in part on the access permissions, data can be allowed to access to the second cloud network.

Hybrid cloud security groups

A network controller in an overlay network maintains collective sets of identity-based policies and identity mappings for onboarded users of the network for informed distribution to network elements across the network. As new users are onboarded, the controller identifies a site of the network at which the user was onboarded and determines identity mappings of the user and applicable policies for distribution to a network element at the identified site. The controller assigns index values to each identity and communicates the indices to network elements with the corresponding identity mappings and policies. The network elements encapsulate cross-site traffic with the index values corresponding to senders so recipient network elements can obtain the index value from encapsulation header formats, query the controller for the corresponding identity mappings, and apply policies to the traffic that are determined to be pertinent based on the sender's identity mappings obtained from the controller.

Scalable distribution of identity information in overlay networks with identity-based policies

Many hybrid cloud topologies require virtual machines in a public cloud to use a router in a private cloud, even when the virtual machine is transmitting to another virtual machine in the public cloud. Routing data through an enterprise router on the private cloud via the internet is generally inefficient. This problem can be overcome by placing a router within the public cloud that mirrors much of the routing functionality of the enterprise router. A switch configured to intercept address resolution protocol (ARP) request for the enterprise router's address and fabricate a response using the MAC address of the router in the public cloud.

Default gateway extension

An example method for a programmable infrastructure gateway for enabling hybrid cloud services in a network environment is provided and includes receiving an instruction from a hybrid cloud application executing in a private cloud, interpreting the instruction according to a hybrid cloud application programming interface, and executing the interpreted instruction in a public cloud using a cloud adapter. The method is generally executed in the infrastructure gateway including a programmable integration framework allowing generation of various cloud adapters using a cloud adapter software development kit, the cloud adapter being generated and programmed to be compatible with a specific public cloud platform of the public cloud. In specific embodiments, identical copies of the infrastructure gateway can be provided to different cloud service providers who manage disparate public cloud platforms; each copy of the infrastructure gateway can be programmed differently to generate corresponding cloud adapters compatible with the respective public cloud platforms.

Programmable infrastructure gateway for enabling hybrid cloud services in a network environment

Network policies can be used to optimize the flow of network traffic between virtual machines (VMs) in a hybrid cloud environment. In an example embodiment, one or more policies can drive a virtual switch controller, a hybrid cloud manager, a hypervisor manager, a virtual switch, or other orchestrator to create one or more direct tunnels that can be utilized by a respective pair of VMs to bypass the virtual switch and enable direct communication between the VMs. The virtual switch can send the VMs network and security policies to ensure that these policies are enforced. The VMs can exchange security credentials in order to establish the direct tunnel. The direct tunnel can be used by the VMs to bypass the virtual switch and allow the VMs to communicate with each other directly.

Policy-driven switch overlay bypass in a hybrid cloud network environment

Aspects of the instant disclosure relate to methods for facilitating intercloud resource migration. In some embodiments, a method of the subject technology can include steps for instantiating a first intercloud fabric provider platform (ICFPP) at a first cloud datacenter, instantiating a second ICFPP at a second cloud datacenter, and receiving a migration request at the first ICFPP, the migration request including a request to migrate a virtual machine (VM) workload from the first cloud datacenter to the second cloud datacenter. In some aspects, the method may further include steps for initiating, by the first ICFPP, a migration of the VM workload via the second ICFPP in response to the migration request. Systems and machine readable media are also provided.

Distributed hybrid cloud orchestration model

According to one aspect, a method includes an Intercloud Fabric Switch (ICS) included in a public cloud and an ICS cluster obtaining a packet, and determining if the packet is obtained from a site-to-site link that links the ICS to an enterprise datacenter. If the packet is obtained from the site-to-site link, it is determined whether the packet is an unknown unicast packet. If the packet is an unknown unicast packet, the packet is dropped, and if not, the packet is provided to an access link that links the ICS to a virtual machine. If the packet is not obtained from the site-to-site link, it is determined whether the packet is obtained from an inter-ICS link that allows the ICS to communicate with the ICS cluster. If the packet is obtained from the inter-ICS link, the packet is dropped if it is an unknown unicast packet.

System and method for scaling multiclouds in a hybrid cloud architecture

An example method for distributed service chaining is provided and includes receiving a packet belonging to a service chain in a distributed virtual switch (DVS) network environment, the packet includes a network service header (NSH) indicating a service path identifier identifying the service chain. The packet is provided to a virtual Ethernet module (VEM) connected to an agentless service node (SN) providing an edge service such as a server load balancer (SLB). The VEM associates a service path identifier corresponding to the service chain with a local identifier such as a virtual local area network (VLAN). The agentless SN returns the packet to the VEM for forwarding on the VLAN. Because the VLAN corresponds exactly to the service path and service chain, the packet is forwarded directly to the next node in the service chain. This can enable agentless SNs to efficiently provide a service chain for network traffic.

High-efficiency service chaining with agentless service nodes

Techniques are provided to decouple service chain structure from the underlying network forwarding state and allow for data plane learning of service chain forwarding requirements and any association between services function state requirements and the forward and reverse forwarding paths for a service chain. In a network comprising a plurality of network nodes each configured to apply a service function to traffic that passes through the respective network node, a packet is received at a network node. When the network node determines that the service function it applies is stateful, it updates context information in a network service header of the packet to indicate that the service function applied at the network node is stateful and that traffic for a reverse path matching the classification criteria is to be returned to the network node.

Data plane learning of bi-directional service chains

Growing community of inventors

Fremont, CA, United States of America

Nagaraj Bagepalli