Juniper Networks, Inc.

Prasad Miriyala

Anish Mehta

Michael Henkel

Jeffrey S Marshall

Iqlas M Ottamalika

Aniket G Daptari

SelvaKumar Sivaraj

Fnu Nadeem

Sajeesh Mathew

Gurminder Singh

Suresh Palguna Krishnan

Yuvaraja Mariappan

Atul S Moghe

Kannan Varadhan

Kiran K N

Richard Roberts

Pranavadatta D N

Sangarshan Pillareddy

Akhilesh Pathodia

James Nicholas Davey

Margarida Correia

Sundaresan Rajangam

Pranav Cherukupalli

Haji Mohamed Ashraf Ali

Rosh Perumpully Ramadass

Édouard Thuleau

Miraj Subhashbhai Kheni

Suresh B Akula

Wen Lin

Fei Chen

Anantharamu Suryanarayana

Prakash T Seshadri

Mahesh Sivakumar

Vivekananda Shenoy

Ankur Tandon

William Stuart Mackie

Sanju C Abraham

Ignatious Johnson Christober

Joseph Williams

Manish Singh

Srinivas Akkipeddi

Kumuthini Ratnasingham

Kiran N Kasim

Nagendra Prasath Maynattamai Prem Chandran

Biswajit Mandal

Tashi Garg

Senthilnathan Murugappan

Dale Davis

Charles Arthur Piercey

Erwin Daria

Nagendra E S

Nagendra Maynattamai

Zaki Bahmeit

Carlo Contavalli

Venkatesh Velpula

Prasannaa Vengatesan T S

Sangyeong Kim

Sayali Mane

Khushi Vaidya

Selvakumar Sivaraj

Anikey G Daptari

Graphical user interfaces are generated that, when displayed, provide a visual and interactive representation of one or more aspects associated with the execution of one or more applications on a computer network. The graphical user interfaces may in include graphical depictions representation policy objects, each policy object assigned one or more tags, each tag assigned to a category or a sub-category. The tags, when taken in combination, may identify an application, and one or more other characteristics associated with each of the policy objects. The graphical elements representing the policy objects may be displayed in the graphical user interfaces so that the policy objects assigned to tags in a category are positioned in an outer ring, and policy objects assigned to sub-category tags are positioned in a inner ring surrounded by the outer ring, with interconnection elements representing communications between policy objects extending within an interior area.

Inter-application workload network traffic monitoring and visualization

In general, techniques are described for a creating a virtual network router via a user interface (UI) presented by a software defined network (SDN) architecture. A network controller comprising a memory and processing circuitry may perform the techniques. The memory may store the UI, while the processing circuitry may present the UI and execute a control node. The UI may graphically represent a topology of a network including first and second virtual networks. The UI may dynamically generate a graphical element representative of a virtual network router by which to interconnect the first and second virtual networks. The virtual network router may represent a logical abstraction of one or more policies that cause one or more of import and export of routing information between the first and second virtual networks. The control node configures the first virtual network and the second virtual network according to the one or more policies.

User interface for cloud native software-defined network architectures

In an example, a method includes processing, by an application programming interface (API) server implemented by a configuration node of a network controller for a software-defined networking (SDN) architecture system, requests for operations on native resources of a container orchestration system; processing, by a custom API server implemented by the configuration node, requests for operations on custom resources for SDN architecture configuration, wherein each of the custom resources for SDN architecture configuration corresponds to a type of configuration object in the SDN architecture system; detecting, by a control node of the network controller, an event on an instance of a first custom resource of the custom resources; and by the control node, in response to detecting the event on the instance of the first custom resource, obtaining configuration data for the instance of the first custom resource and configuring a corresponding instance of a configuration object in the SDN architecture.

Cloud native software-defined network architecture

An example application programming interface (API) server device that distributes configuration data to managed network devices includes one or more processing units implemented in circuitry and configured to receive configuration data to be deployed to at least one of the managed network devices; store the configuration data to a configuration database; and send the configuration data to the at least one of the managed network devices. In this manner, the configuration data can be archived for later retrieval and analysis, e.g., to perform root cause analysis in the event of an error.

Storing configuration data changes to perform root cause analysis for errors in a network of managed network devices

In an example, a method comprises obtaining, by a policy controller from a first SDN architecture system, flow metadata for packet flows exchanged among workloads of a distributed application deployed to the first SDN architecture system; identifying, using flow metadata for a packet flow of the packet flows, a source endpoint workload and a destination endpoint workload of the packet flow; generating a network policy rule to allow packet flows from the source endpoint workload to the destination endpoint workload of the packet flow; and adding the network policy rule to a configuration repository as configuration data for a second SDN architecture system to cause a deployment system to configure the second SDN architecture system with the network policy rule to allow packet flows from the source endpoint workload to the destination endpoint workload when the distributed application is deployed to the second SDN architecture system.

Network policy generation for continuous deployment

Techniques are described for learning an unknown virtual network information, such as an virtual Internet Protocol (IP) address, of a pod in a virtual network. In some examples, a virtual router executing at a computing device may receive an Address Resolution Protocol (ARP) packet from a virtual execution element in the virtual network, the virtual execution element executing at the computing device. The virtual router may determine, based at least in part on the ARP packet, whether virtual network information for the virtual execution element in a virtual network is known to the virtual router. The virtual router may, in response to determining that the virtual network information of the virtual execution element in the virtual network is not known to the virtual router, perform learning of the virtual network information for the virtual execution element.

Dynamically learning media access control and internet protocol addresses

In some examples, an access control policy controller in a computer network may receive a request to create an access control policy that permits a role to perform one or more functions in the computer network. The access control policy controller may determine one or more operations performed on one or more objects in the computer network to perform the one or more functions based at least in part on tracking performance of the one or more functions in the computer network. The access control policy controller may create the access control policy for the role that permits the role to perform the one or more operations on the one or more objects in the computer network.

Role-based access control policy auto generation

A method includes subscribing, by an agent, to telemetry flow data from each network device of a plurality of network devices and receiving, by the agent, a plurality of streams of telemetry flow data from the plurality of the network devices. Each of the plurality of streams corresponds to a different one of the plurality of network devices. The method further includes aggregating, by the agent, data from at least one stream of the plurality of streams of the telemetry flow data received over a period of time and, at the end of the period of time and/or when the data from the at least one stream exceeds a data threshold, sending, by the agent, the aggregated telemetry flow data to a network analyzer device.

Agent for aggregation of telemetry flow data

In an example, a validation system comprises processing circuitry having access to a storage device and is configured to obtain flow records indicative of packet flows among workloads deployed to a cluster of one or more computing devices configured with a network policy, wherein each flow record of the flow records indicates a corresponding packet flow was allowed or denied by the cluster; receive an updated network policy; determine whether a corresponding packet flow for a flow record of the flow records has a discrepancy with the updated network policy; and in response to determining the corresponding packet flow for the flow record of the flow records has a discrepancy with the updated network policy, output an indication of an error.

Network policy validation

In general, techniques are described for performing network segmentation for container orchestration platforms. A network controller comprising a memory and processing circuitry may be configured to perform the techniques. The memory may be configured to store a request, conforming to a container orchestration platform, to configure a new pod of a plurality of pods with a primary interface to communicate on a virtual network to segment a network formed by the plurality of pods. The processing circuitry may be configured to configure, responsive to the request, the new pod with the primary interface to enable communications via the virtual network.

Network segmentation for container orchestration platforms

A network controller for a software-defined networking (SDN) architecture system may receive a request to generate an access control policy for a role in a container orchestration system, where the request specifies a plurality of functions. The network controller may execute the plurality of functions and may log execution of the plurality of functions in an audit log. The network controller may parse the audit log to determine a plurality of resources of the container orchestration system accessed from executing the plurality of functions and, for each resource of the plurality of resources, a respective one or more types of operations performed on the respective resource. The network controller may create, based at least in part on the parsed audit log, the access control policy for the role that permits a role to perform, on each of the plurality of resources, the respective one or more types of operations.

Role-based access control autogeneration in a cloud native software-defined network architecture

In general, techniques are described that provide an analysis system for analyzing a software-defined networking (SDN) architecture system. The analysis system comprising the processing circuitry configured to obtain operational data representative of one or more of configuration, operation, and maintenance of the SDN architecture system. The processing circuitry may identify dependencies between the operational data that identify dependencies between objects representative of the configuration, operation, and maintenance of the SDN architecture system. The processing circuitry may perform, while traversing the dependences between the operational data, analysis with respect to the operational data in order to identify potential issues in the SDN architecture system, and output the potential issues in the SDN architecture system.

Analysis system for software-defined network architectures

In general, techniques are described for a creating a virtual network router within a software defined network (SDN) architecture. A network controller for the SDN architecture system may include processing circuitry that is configured to execute a configuration node and a control node. The configuration node may process a request by which to create a virtual network router (VNR), where the virtual network router may cause the network controller to interconnect a first virtual network (VN) and a second VN. The VNR may represent a logical abstraction of one or more policies that cause import and/or export of routing information between the first VN and the second VN. The control node configures the first VN and the second VN according to the one or more policies to enable the import and/or the export of routing information between the first VN and the second VN via the VNR.

Virtual network routers for cloud native software-defined network architectures

A plurality of switches may be arranged according to a spine and leaf topology in which each spine switch is connected to all leaf switches. A leaf switch includes a memory configured to store a plurality of policies, each of the plurality of policies being associated with a respective source identifier value and a respective destination address; a network interface communicatively coupled to one of the spine switches; and a processor implemented in circuitry and configured to: receive a packet from the spine switch via the network interface, the packet being encapsulated with a Virtual Extensible Local Area Network (VXLAN) header; extract a source identifier value from the VXLAN header; determine a destination address for the packet; determine a policy of the plurality of policies to apply to the packet according to the source identifier value and the destination address; and apply the policy to the packet.

Policy enforcement for bare metal servers by top of rack switches

Techniques are disclosed for a network device to preserve packet flow information across bump-in-the-wire (BITW) firewalls. For example, a method comprises receiving, by a network device, a packet. The method also comprises determining, by the network device, that the packet matches a packet flow that is associated with an action to redirect the packet to a firewall configured as a bump-in-the-wire. The method further comprises, in response to the determination: modifying, by the network device, a Media Access Control (MAC) address field of a layer 2 (L2) packet header with a flow identifier of the packet flow; sending, by the network device, the packet to the firewall; receiving, by the network device, the packet from the firewall; and recovering, by the network device, the packet flow by modifying the packet according to the flow identifier in the packet to restore the L2 packet header of the packet.

Preserving packet flow information across bump-in-the-wire firewalls

Growing community of inventors

San Jose, CA, United States of America

Prasad Miriyala