Cisco Technology, Inc.

Nvidia Corporation

Praveen Jain

Munish Mehta

Yibin Yang

Vijay K Chander

Kalyan Ghosh

Saurabh Jain

Shashank Gupta

Tushar Desai

Ronak K Desai

Umesh Mahajan

Ramana Mellacheruvu

Dennis K Ma

Vijayan Ramakrishnan

Michael R Smith

Brad W Simeral

David G Reed

Ramsundar Janakiraman

Sameer Merchant

Sachin Jain

Kenneth Harvey Potter, Jr

Ranganathan Rajagopalan

Wei-Je Robert Huang

Sarang M Dharmapurikar

Oren Rubinstein

Joji Thomas Mekkattuparamban

Franck R Diard

Manas Mandal

Mangesh Shingane

Prabesh Babu Nanjundaiah

Rajesh Bhandari

Kara J Adams

David A Carroll

Karan Gupta

Narender Enduri

Lei Tian

Radha Kanekal

Michael D Blair

Badhri Madabusi Vijayaraghavan

Atul Kalambur

Devang Sachdev

Daphne Das

Cheyne Monroe Womble

Glenn C Ferris

Van Lieu

Shankar Subramanian

Sameer Dilip Merchant

Kalyan K Ghosh

Shankar Subramaniam

According to one or more embodiments of this disclosure, a network controller in a data center network establishes a translation table for in-band traffic in a data center network, the translation table resolves ambiguous network addresses based on one or more of a virtual network identifier (VNID), a routable tenant address, or a unique loopback address. The network controller device receives packets originating from applications and/or an endpoints operating in a network segment associated with a VNID. The network controller device translates, using the translation table, unique loopback addresses and/or routable tenant addresses associated with the packets into routable tenant addresses and/or unique loopback addresses, respectively.

Techniques for managing software defined networking controller in-band communications in a data center network

Aspects of the embodiments are directed to forming a virtual machine management (VMM) domain in a heterogeneous datacenter. Aspects can include mapping an endpoint group to multiple VMM domains, each VMM domain associated with one or more virtual machine management systems of a single type that each share one or more management system characteristics; instantiating a virtual switch instance, the virtual switch instance associated with a the VMM domain; and instantiating the endpoint group mapped to the VMM domain as a network component associated with the virtual switch instance.

Extending application tiers across a large-scale heterogeneous data center

Presented herein are traffic pruning techniques that define the pruning at the group level. A software defined network (SDN) controller determines first and second endpoint groups (EPGs) of an SDN associated with the SDN controller. The SDN runs on a plurality of networking devices that interconnect a plurality of endpoints that are each attached to one or more host devices. The SDN controller determines a host-EPG mapping for the SDN, as well as a networking device-host mapping for the SDN. The SDN controller then uses the host-EPG mapping, the networking device-host mapping, and one or more group-based policies associated with traffic sent from the first EPG to the second EPG to compute hardware pruning policies defining how to prune multi-destination traffic sent from the first EPG to the second EPG. The hardware pruning policies are then installed in one or more of the networking devices or the host devices.

Group-based pruning in a software defined networking environment

Techniques for providing a reflexive access control list (ACL) on a virtual switch are provided. Embodiments receive a first packet corresponding to a first network flow and a second packet corresponding to a second network flow. Upon determining that a SYN flag is set within the first packet, a first entry is created in the reflexive ACL for the first network flow. Upon determining that the first packet was received over a client port of the first physical switch, the first packet is forwarded to a second physical switch within virtual switch. Upon determining that the second packet has a SYN flag enabled, a second entry is created in the reflexive ACL. Finally, upon determining that the second packet was received from the second physical switch, the second packet is forwarded over an uplink port to a destination defined by the second packet.

Handling reflexive ACLs with virtual port-channel

The techniques presented herein use dynamic endpoint group (EPG) binding changes to facilitate cross-tenant resource sharing. A first node of a multi-tenant software defined network determines that an application on a first endpoint has initiated operation and needs temporary access to resources located at a second endpoint. The first and second endpoints are associated with first and second tenants, respectively, that are logically segregated from one another by the software defined network. The first node dynamically changes an initial EPG binding associated with the first endpoint to a second EPG binding that enables the first endpoint to temporarily directly access the resources at the second endpoint. The first node subsequently determines that the application on the first endpoint no longer needs access to the resources located at a second endpoint and, as such, changes the second EPG binding associated with the first endpoint back to the initial EPG binding.

Dynamic endpoint group binding for cross-tenant resource sharing in software defined networks

Microsegmentation in a heterogeneous software-defined network can be performed by classifying endpoints associated with a first virtualized environment into respective endpoint groups based on respective attributes, and classifying endpoints associated with a second virtualized environment into respective security groups based on respective attributes. Each respective endpoint group can correspond to a respective security group having the same attribute. Each respective endpoint group and corresponding security group can be associated with a respective policy model defining rules for processing associated traffic. Each of the respective security groups can be used to generate a respective network attribute endpoint group, which can include the network addresses of those endpoints in the respective security group. Each respective network attribute endpoint group can inherit the policy model of the respective endpoint group corresponding to the respective security group. Traffic between the endpoints can then be processed based on the various classifications and associated rules.

Microsegmentation in heterogeneous software defined networking environments

Systems, methods, and computer-readable storage media are provided for dynamically setting an end point group for an end point. An endpoint can be assigned a default end point group when added to a network. For example, the default end point group can be a baseline port/security group which is considered an untrusted group. The end point can then be dynamically assigned an end point group based on a set of group selection rules. For example, the group selection rules can identify an end point group based on the MAC address or other attributes. When the end point is added to the network, the MAC address and/or other attributes of the end point can be determined and used to assign an end point group. As another example, an end point group can be assigned based on the amount of traffic or guest operation system.

Dynamic attribute based application policy

Techniques are disclosed for peer-to-peer data transfers where a source device receives a request to read data words from a target device. The source device creates a first and second read command for reading a first portion and a second portion of a plurality of data words from the target device, respectively. The source device transmits the first read command to the target device, and, before a first read operation associated with the first read command is complete, transmits the second read command to the target device. The first and second portions of the plurality of data words are stored in a first and second portion a buffer memory, respectively. Advantageously, an arbitrary number of multiple read operations may be in progress at a given time without using multiple peer-to-peer memory buffers. Performance for large data block transfers is improved without consuming peer-to-peer memory buffers needed by other peer GPUs.

Efficient CPU mailbox read access to GPU memory

N_Ports and F_Ports are provided with logic allowing designation of multiple virtual interfaces on a single host bus adaptor or other Fiber Channel interface, one virtual interface for each VSAN operating on the node interface. Node ports with this additional functionality are referred to as trunking N_Ports or TN_Ports. These ports have a functional design allowing creation of the multiple virtual interfaces as appropriate for the application at hand. This port design also includes logic for communicating with a peer fabric port to initialize and modify the configuration of the virtual interfaces on the TN_Port. A corresponding functional design and communication logic is provided for fabric ports, referred to herein as trunking F_Ports or TF_Ports.

Trunking for fabric ports in Fibre channel switches and attached devices

Methods and devices are provided for detecting whether peer ports interconnecting two network devices can perform a novel protocol called Exchange Peer Parameters ('EPP'). If the peer ports are so configured to perform EPP, EPP services are exchanged between the peer ports. In a first phase, information is exchanged about peer port configurations of interest. In a second phase, the results of the exchange of information are applied to hardware and/or software of the respective ports, as needed.

Methods and devices for exchanging peer parameters between network devices

A system and method for communicating over a single virtual channel. The method includes reserving a first group of credits of a credit pool for a first traffic class and a second group of credits of the credit pool for a second traffic class. In addition, a first and second respective groups of tags are reserved from a tag pool for the first and second traffic class. A packet may then be selected from a first buffer for transmission over the virtual channel. The packet may include a traffic indicator of the first traffic class operable to allow the packet to pass a packet of the second traffic class from a second buffer. The method further includes sending the packet over the virtual channel and adjusting the first group of credits and the first group of tags based on having sent a packet of the first traffic class.

System and method for virtual channel communication

In one embodiment a method is provided for requesting and receiving network statistics in-band of a data replication exchange. The method includes receiving, at a switch, a request packet, initiated from a data replication system, for in-band delivery of network statistics, modifying the request packet to include a command that can be processed by a data storage device that is periodically accessed in connection with the data replication system, sending the request packet including the command to the data storage device, receiving from the peripheral device, in response to the request packet including the command, a response packet that includes data responsive to the command, deleting from a data field of the response packet the data responsive to the command and adding to the data field network statistics data available to the switch, and sending the response packet including the network statistics data to one of another switch or a host device from which the request packet was sent.

In-band communication of network statistics over a FICON network

Growing community of inventors

Cupertino, CA, United States of America

Praveen Jain