Cisco Technology, Inc.

Paul M Quinn

James Neil Guichard

Carlos M Pignataro

Surendra M Kumar

David Delano Ward

Nagaraj Bagepalli

Hendrikus G P Bosch

Nagendra Kumar Nainar

Reinaldo Penno

Kenneth Durazzo

Abhijit Patra

Michael R Smith

Alessandro Duminuco

Rex Emmanuel Fernando

Jim Guichard

Navindra Yadav

Kyle Andrew Donald Mestery

Mohamed Khalid

Humberto Jose La Roche

Scott Roy Fluhrer

Govind Prasad Sharma

Luyuan Fang

Kent Kinchu Leung

Brian Eliot Weis

Fabio Rodolfo Maino

Prashanth Patil

Jeffrey Michael Napper

Ian McDowell Campbell

Ravi Shekhar

Warren Scott Wainner

Jianxin Wang

Vina Ermagan

Robert E Gleichauf

Richard Mandfred Pruss

Javed Asghar

Tirumaleswar Reddy

Darrel Jay Lewis

Nobushige Akiya

Hung The Chau

Yixing Ruan

Vivek Kansal

Chui-Tin Yen

Barry Raveendran Greene

Dave Barach

Jayaraman R Iyer

Rajiv Asati

Jim Chen Chou

Jiang Zhu

Victor Manuel Moreno

Dileep Kumar Devireddy

Kevin Shatzkamer

Dhananjaya Rao

Elango Ganesan

Michael Freed

Peter Bosch

Aamer Saeed Akhter

Andrew George Harvey

Ethan M Spiegel

John William Evans

Frederick Juergens Baker

Ashutosh Arwind Malegaonkar

Sachin S Kajarekar

Darrin Joseph Miller

Michael E Lipman

Satish K Gannu

Saravanakumar Rajendran

Dean Cheng

Richard Manfred Pruss

Leonid Sandler

Moshe Kravchik

Roy Michael Brooks

Hendrikus Gp Bosch

John E Cavanaugh

Marius Horia Miclea

Florin T Coras

Mike Milano

Alena Lifar

Yavindra Yadav

Hendrikus GP Bosch

Nagaraj A Bagepalli

Techniques for policy-based connection provisioning using Domain Name System (DNS) requests are described herein. The techniques may include receiving policy data associated with one or more headend nodes that manage connections to computing resources. Additionally, the techniques may include receiving a DNS request from a client device to establish a connection between the client device and a first headend node of the one or more headend nodes. The DNS request may include an attribute associated with the client device. A provisioning service may determine that the connection should be established between the client device and the first headend node based at least in part on evaluating the attribute with respect to the policy data. Additionally, the techniques may include sending an internet protocol (IP) address, which is associated with the first headend node, to the client device to facilitate establishment of the connection.

Policy-based connection provisioning using domain name system (DNS) requests

In one embodiment, a system and method are disclosed for sending a request and receiving a reply. The request contains a network service header including a flow label field and a target index field. The flow label field contains a set of available flow labels. The target index field includes a value indicating a target node. The reply contains information indicating which of the flow labels can be used to route a packet to each of the next hop nodes downstream from the device that sent the reply. This process can be repeated for other nodes on a path, and other paths in a service topology layer. The information determined by this process can be used to perform other necessary functionalities at the service topology layer.

Multi-path aware tracing and probing functionality at service topology layer

An apparatus having logic elements to receive an incoming packet associated with a first service function chain; identify a next hop service function for the incoming packet as a non-reactive service function; create a duplicate packet; forward the duplicate packet to the non-reactive service function; and forward the incoming packet to a next reactive service function. An apparatus having logic to receive an incoming packet associated with a first service function chain (SFC), having a first service path identifier (SPI); determine that the incoming packet has a first service index (SI), and that a next-hop SI identifies a non-reactive service function (NRSF); receive a duplicate packet of the incoming packet; rewrite a service header of the duplicate packet to identify a second SFC having a second SPI; and alter the first SI of the incoming packet to identify a next reactive service function in the first SFC.

System and method for improved service chaining

A method for augmenting metadata of a network service header is disclosed. The method includes receiving, at a first service node, a packet or frame of a traffic flow, wherein the packet has a payload and the network service header including a first metadata and a first service path information for the traffic flow, classifying, by the first service node, at least one of the payload and the first metadata to generate a second metadata different from the first metadata, and augmenting, by the first service node, the first metadata using the second metadata before forwarding the packet or frame to a second service node.

Metadata augmentation in a service function chain

Embodiments are directed to receiving an original packet at a service function; determining, for a reverse packet, a reverse service path identifier for a previous hop on a service function chain; determining, for the reverse packet, a service index for the reverse service path identifier; and transmitting the reverse packet to the previous hop on the service function chain.

Method, medium, and apparatus for inserting a placeholder service function

Aspects of the embodiments are directed to systems, methods, and computer program products to program, via a northbound interface, a mapping between an endpoint identifier (EID) and a routing locator (RLOC) directly into a mapping database at a mapping system; receive, from a first tunneling router associated with a first virtual network, a mapping request to a second virtual network, the first router compliant with a Locator/ID Separation Protocol, the mapping request comprising an EID tuple that includes a source identifier and a destination identifier; identify an RLOC based, at least in part, on the destination identifier of the EID tuple from the mapping database; and transmit the RLOC to the first tunneling router implementing an high level policy that has been dynamically resolved into a state of the mapping database.

Systems, methods, and devices for smart mapping and VPN policy enforcement

Various systems and methods for determining whether to allow or continue to allow access to a protected data asset are disclosed herein. For example, one method involves receiving a request to access a protected data asset, wherein the request is received from a first user device; determining whether to grant access to the protected data asset, wherein the determining comprises evaluating one or more criteria associated with the first user device, and the criteria comprises first information associated with a first policy constraint; and in response to a determination that access to the protected data asset is to be granted, granting access to the protected data asset.

Digital data asset protection policy using dynamic network attributes

In one embodiment, a method includes receiving a trace request packet at a service node on a service chain, the trace request packet comprising a service index limit that remains constant for use in identifying at least one service node in the service chain to generate a trace report packet, and processing the trace request packet and determining whether to forward the trace request packet on the service chain or to generate the trace report packet based on a comparison of a service index to the service index limit in the trace request packet, wherein the trace report packet includes service function information of a plurality of service functions in the service chain, and the trace request packet is forwarded on the service chain according to a service path identifier and the service index.

Method and apparatus for tracing paths in service function chains

In one embodiment, a method includes receiving a trace request packet at a service node in a service chain, the trace request packet comprising a service path identifier, a service index, and a service index limit, processing the trace request packet at the service node, comparing the service index to the service index limit, determining that the service index is greater than the service index limit, generating a trace response packet at the service node indicating that the service index is greater than the service index limit, and transmitting the trace response packet. The trace response packet comprises service function information for each of a plurality of service nodes in the service chain. An apparatus is also disclosed herein.

Presented herein are techniques for use in a network environment that includes one or more service zones, each service zone including at least one instance of an in-line application service to be applied to network traffic and one or more routers to direct network traffic to the at least one service, and a route target being assigned to a unique service zone to serve as a community value for route import and export between routers of other service zones, destination networks or source networks via a control protocol. An edge router in each service zone or destination network advertises routes by its destination network prefix tagged with its route target. A service chain is created by importing and exporting of destination network prefixes by way of route targets at edge routers of the service zones or source networks.

Chaining service zones by way of route re-origination

There is disclosed an apparatus having logic elements to: receive an incoming packet associated with a first service function chain; identify a next hop service function for the incoming packet as a non-reactive service function; create a duplicate packet; forward the duplicate packet to the non-reactive service function; and forward the incoming packet to a next reactive service function. There is also disclosed an apparatus having logic to: receive an incoming packet associated with a first service function chain (SFC), having a first service path identifier (SPI); determine that the incoming packet has a first service index (SI), and that a next-hop SI identifies a non-reactive service function (NRSF); receive a duplicate packet of the incoming packet; rewrite a service header of the duplicate packet to identify a second SFC having a second SPI, wherein the second SPI is different from the first SPI; and alter the first SI of the incoming packet to identify a next reactive service function in the first SFC.

Generating packets in a reverse direction of a service function chain

Growing community of inventors

Brookline, MA, United States of America

Paul M Quinn