Juniper Networks, Inc.

Juniper Netwoks, Inc.

Nischal Sheth

Ping Pan

Raghavendra Mallya

Ina Minei

Manoj Leelanivas

Pradeep S Sindhu

Kireeti Kompella

James Michael Murphy

Rahul Aggarwal

Jayabharat Boddu

Abhijit Kumar Choudhury

Pranay Pogde

Phalguni Nanda

Nitin Bahadur

Der-Hwa Gan

Yakov Rekhter

Hannes Gredler

Keith Eric Holleman

Steven Lin

Wing Eng

Bhupesh Kothari

Paul S Traina

Arun Vaidyanathan

Andrew H Heffernan

Nitin Kumar

Quaizar Vohra

Zhaohui Zhang

Harish Sitaraman

Arthi R Ayyangar

Chaitanya Kodeboyina

Lili Wang

Krishna Narayanaswamy

Dennis C Ferguson

John E Drake

John Galen Scudder

David M Katz

Robert W Kebler

Pedro R Marques

Dongyi Jiang

Yimin Shen

Ravi Kumar Gadde

Colby Barth

Maciek Konstantynowicz

Sachin Bansal

Ken Kuwabara

Bhasker R Allam

Tsai-Zong Lin

Avneesh Sachdev

Jiaxiang Su

Disha M Chopra

Shivani Aggarwal

Xuefei Zhang

Panning Huang

Sunil Patro

Satish Ramachandran

Ambrose Kwong

Prakash M Bailkeri

Paradeep Sindhu

James Murphy

Prakash Bailkeri

In some embodiments, an apparatus includes a network node configured to be included in a set of network nodes operatively coupled to a core network node. The network node is configured to receive a first packet and a second packet from a host device operatively coupled to the network node. The network node is configured to send the first packet to the core network node via a first path of a tunnel between the network node and the core network node. The first path of the tunnel has a first cost. The network node is configured to send the second packet to the core network node via a second path of the tunnel. The second path has a second cost different than the first cost.

Methods and apparatus for a scalable network with efficient link utilization

In some embodiments, an apparatus includes a network node operatively coupled within a network. The network node is configured to send a first authentication message upon boot up, and receive, in response to the first authentication message, a second authentication message configured to be used to authenticate the network node. The network node is configured to send a first discovery message, and receive, based on the first discovery message, a second discovery message configured to be used by the network node to identify an address of the network node and an address of a core network node within the network. The network node is configured to set up a control-plane tunnel to the core network node based on the address of the network node and the address for the core network node and receive configuration information from the core network node through the control-plane tunnel.

Methods and apparatus for a self-organized layer-2 enterprise network architecture

Techniques are described for implementing one or more logical routers within a single physical routing device. These logical routers, as referred to herein, are logically isolated in the sense that they achieve operational and organizational isolation within the routing device without requiring the use of additional or redundant hardware, e.g., additional hardware-based routing controllers. The routing device may, for example, include a computing platform, and a plurality of software process executing within the computing platform, wherein the software processes operate as logical routers. The routing device may include a forwarding component shared by the logical routers to forward network packets received from a network in accordance with the forwarding tables.

Routing device having multiple logical routers

A network device identifies an Open Shortest Path First (OSPF) link between the network device and a layer 2 network as one of a point-to-multipoint over broadcast interface or a point-to-multipoint over non-broadcast multi access (NBMA) interface, and performs database synchronization and neighbor discovery and maintenance using one of a broadcast model or a NBMA model. The network device also generates a link-state advertisement for the network device, where the link-state advertisement includes a separate link description for each point-to-point link within the layer 2 network; and sends the link-state advertisement to each fully adjacent neighbor in the layer 2 network.

OSPF point-to-multipoint over broadcast or NBMA mode

In some examples, a controller comprises one or more processors; a control unit configured to obtain, from a router in a first network, a route that specifies a next hop to an address prefix reachable by the first network; and a service chain unit configured to generate a modified route that specifies a service node as the next hop for the address prefix, wherein the service node is external to the first network, and wherein the control unit is further configured to send the modified route to a second network, the modified route marked with an import route target configured for a provider edge router of the second network so that traffic from the first network and destined for the second network is forwarded to the service node.

Service chaining across multiple networks

A label switched path (LSP) is established within a network using an MPLS fast reroute bypass tunnel when a resource along a primary path of the LSP has failed but is protected by the MPLS fast reroute bypass tunnel. While establishing the LSP, a network device identifies a failed resource along a primary path of the LSP. In response to identifying the failed resource, the network device determines whether a bypass tunnel exists from the network device to a node along the primary path, wherein the bypass tunnel avoids the failed resource. Upon determining that the bypass tunnel exists, the network device tunnels a message for establishing the LSP to the node over the bypass tunnel.

Label switched path setup using fast reroute bypass tunnel

In some embodiments, an apparatus comprises a core network node configured to be operatively coupled to a set of network nodes. The core network node is configured to receive a broadcast signal from a network node from the set of network nodes, which is originated from a host device operatively coupled to the network node. The broadcast signal is sent via a tunnel from the network node to the core network node, such that other network nodes that are not included in the tunnel do not receive the broadcast signal. The core network node is configured to retrieve control information associated with the broadcast signal without sending another broadcast signal, and then send the control information to the network node.

Techniques are described for providing encryption and authentication for different types of routing protocol communications based on a variety of factors. A method comprises configuring, on a network router, a set of logical interfaces for communicating routing protocol messages with one or more peer routing devices, maintaining a set of security associations that define corresponding authentication information and encryption information for the routing protocol messages, and maintaining one or more descriptor sets that each specify a set of criteria, wherein, for at least one of the descriptor sets, the set of criteria specifies one of the logical interfaces of the network router. The method further comprises selecting one of the descriptor sets having criteria that match an individual flow, selecting one of the security associations based on the selected descriptor set, and applying the selected security association to secure the outbound flow of the routing protocol messages.

Authentication and encryption of routing protocol traffic

In general, techniques are for providing a direct forwarding path between virtual routers within a single virtualized routing system. In one example, a method includes combining forwarding information from a plurality of virtual routers into collapsed forwarding information that comprises one or more direct forwarding paths between the respective virtual routers. The method also includes determining a direct forwarding path to an egress interface of the second virtual router, in response to receiving a network packet at an ingress interface of a first virtual router. The method also includes forwarding the network packet from the ingress interface of the first virtual router to the egress interface of the second virtual router using the direct forwarding path, wherein the network packet traverses a switch fabric directly from the ingress interface of the first virtual router to the egress interface of the second virtual router.

Traffic cut-through within network device having multiple virtual network devices

A packet-forwarding integrated circuit includes a control logic module and a selector block configured to produce a value indicating an incoming interface associated with a multicast data stream that meets stream health requirements, wherein the multicast data stream is one of a plurality of redundant multicast data streams each received on different incoming interfaces, wherein based on the value produced by the selector block the control logic module outputs data packets of the multicast data stream that meets stream health requirements received on the incoming interface, and discards data packets of other multicast data streams received on other incoming interfaces not indicated by the selector block. In response to detecting that a quality of one of the redundant multicast data streams has fallen below a configured threshold, the control logic automatically rewrites the selector block to forward a different one of the redundant multicast data streams.

Fast reroute between redundant multicast streams

Growing community of inventors

Los Altos, CA, United States of America

Nischal Sheth