Cisco Technology, Inc.

Telefonaktiebolaget Lm Ericsson (Publ)

Ericsson Ab

Other

Pritam Baruah

Laxmikantha Reddy Ponnuru

Balaji Sundararajan

Satish Mahadevan

Ramakumara Kariyappa

Avinash Shah

Samir D Thoria

Ramanathan Lakshmikanthan

Rishi Mehta

Xiaorong Wang

Jianda Liu

Ganesh Devendrachar

Ruchir Jain

Frederic René Philippe Detienne

Olivier Patrick Jean Pelerin

Shen Yong Qing

Anubhav Gupta

Nithin Bangalore Raju

Peter Arberg

Srilatha Tangirala

Arul Murugan Manickam

Steven W Wood

Timothy John Lynch

Venkatesh Nataraj

Sourav Sen

Gaurav Shrivastava

Arun Sharma

Sireesha Yeruva

Jai Prakash Agrawal

Latika Ahuja

Afroze Mohammad

Deepa Rajendra Sangolli

Ramanathan Lakshmikathan

A system facilitates communication between branches of an SD-WAN and a service chain element. A hub node receives a data packet of a flow from a source branch over a VPN segment to be transmitted to a destination branch, extracts flow information from the data packet including VPN segment information to be stored in a flow table before transmitting the data packet to the service chain element over a service chain VPN. Upon return of the data packet from the service chain element, the hub node uses packet tuple information to retrieve the flow information with VPN segment information from the flow table. The hub node can then forward the data packet to the destination branch over the VPN segment. The hub node can generate and store an Auto Service Chaining Key that connects bidirectional flows so that the hub node can apply service-chaining to bidirectional traffic.

Sharing service chains across user VPNs by segment preservation

Generally, Software-Defined Wide Area Networks (SD-WAN) generally do not support network segmentation. The concepts disclosed herein connects IPSec SD-WAN fabric to a Virtual Routing and Forwarding (VRF) router and make use of a Software Defined Cloud Interconnect (SDCI) Router to route traffic from IPSec SD-WAN to various cloud services from the SDCI Router in the fabric. The concepts disclosed herein also provides for tunnel multi-plexing that takes incoming and outgoing traffic and maps VPNs to any service VRF associated with the cloud based services.

Mapping of IPSec tunnels to SD-WAN segmentation

The subject matter of this disclosure relates in general to the field of computer networking, and more particularly, to systems and methods for discovery of a tunnel for wide area network. Certain aspects provide a method for network path analysis. The method includes sending a first probe packet configured to identify a network tunnel, wherein the first probe packet includes an identifier of the first probe packet and a first time to live (TTL) value that corresponds to a first network hop; receiving a first response message from the first network hop in the network tunnel, wherein the first response message corresponds to the first probe packet and includes the identifier of the first probe packet; and analyzing the network tunnel based on the first response message including the identifier of the first probe packet.

Underlay path discovery for a wide area network

Present disclosure includes determining, at two or more gateway nodes that each communicate with a plurality of branch nodes and a plurality of resources, dynamically a path between each of the plurality of branch nodes and each of the plurality of resources, wherein the path includes one or more virtual routers; generating, at the two or more gateways, dynamically a path length based upon a number of virtual routers each path traverses; automatically translating the path length to an overlay management protocol route preference for each of the plurality of resources.

Systems and methods for optimizing access to cloud resources using preferential localization

Techniques for utilizing a network gateway provisioned in a software-defined network to verify service readiness of one or more security service(s) of a service chain prior to redirecting network traffic along a given data-path to the security service(s). The gateway may be configured to open a specific port on a network device hosting a security service to transmit network policies and/or test network traffic to the security service. The network gateway may host a virtual source and/or a virtual destination and cause the virtual source to send test network traffic through the security service via the port and to the virtual destination. The gateway may then utilize the received test network traffic to determine whether a given security service satisfies a threshold health and/or functionality measurement. Once it is determined that the security service satisfies the thresholds, the gateway may cause network traffic to be redirected to the security service.

Tracking data-path readiness of security services inserted in middle mile and cloud gateways

Techniques for enabling service insertion using dynamic service path selection are described herein. In some aspects, the techniques described herein relate to avoiding a service route that passes through a service router when the second-leg path from the service router to a destination router is unreachable. In some cases, the techniques described herein relate to avoiding a route that includes a service router that does not have a path to a viable target in a core service region.

Service insertion in a computer network using dynamic service path selection

Techniques are described for providing service level agreement performance in a link aggregation group computer networking environment. A performance measurement data packet such as a bi-directional forwarding detection (BFD) packet is received. The performance measuring data packet can be considered a parent performance measurement data packet is split into multiple child performance measurement data packets which are each different constituent links of a link aggregation database. The performance of each constituent is tested to determine which constituents satisfy service level agreement parameters. Data packets can then be sent to constituents that meet the data packet's service level agreement performance parameters while still allowing link aggregation grouping.

Service Level Agreement based data forwarding with link aggregation grouping

Techniques are described for suppressing data plane traffic using a service monitoring policy for data plane control. If a service provided to a router becomes nonfunctional, preventing the router from being able to forward traffic to a next-hop device, data plane traffic from client devices on the data plane that requires the use of the nonfunctioning service is suppressed. Additionally, new communication pathways to the router that will use the nonfunctioning service are prevented from being established. Traffic is redirected to another router with a functioning service. Thus, traffic that may normally be directed to the router with the nonfunctioning service and not able to be forwarded (e.g., blackholing of data) can be forwarded to the other router.

Service access awareness in a distributed architecture

In one embodiment, a method includes receiving, by a network orchestrator, trace parameters from a user device. The method also includes determining, by the network orchestrator, to initiate a network path trace for the application, generating, by the network orchestrator, a filter policy for the network path trace using the trace parameters, and allocating, by the network orchestrator, a trace identification to the network path trace. The method also includes initiating, by the network orchestrator, the network path trace within a network by communicating the filter policy and the trace identification to a first node of the network and receiving, by the network orchestrator, network path trace data from a plurality of nodes of the network. The method further includes generating, by the network orchestrator, a trace report for the application using the network path trace data.

Systems and methods for determining a network path trace

The present technology discloses methods, systems, and non-transitory computer-readable media for defining, for a network primitive in a network domain, whether the network primitive can receive data carrying an assigned context associated from one or more source nodes through a software-defined wide area network (SDWAN) fabric overlay; advertising a capability of the network primitive, the capability stating whether the network primitive can receive the data carrying the assigned context; and controlling selective transmission of the data carrying the assigned context from the one or more source nodes to the network primitive through the SDWAN fabric overlay based on the capability of the network primitive to receive the data carrying the assigned context.

Network service access and data routing based on assigned context

A method for load balancing IPTV channels is described. In one embodiment of the invention, a first Provider Edge (PE) network element of a label switched network, coupled with a second PE network element over multiple member links of an aggregate link, receives IPTV packets. For each IPTV packet received, the first PE network determines layer 3 information of the IPTV packet, and generates one or more channel load balancing keys based on the layer 3 information. The PE network element generates a hash value from the channel load balancing keys and determines which one of multiple member links to transmit the IPTV packet on based on the hash value, and transmits the IPTV packet to the second PE network element on the determined member link. Other methods and apparatuses are also described.

Load balancing pseudowire encapsulated IPTV channels over aggregated links

A method and apparatus of updating a forwarding plane of a network element in response to receiving a mobility event is described. The network element receives a mobility message indicating a mobile node has coupled to a new access port associated with the network element. The message further indicates that the mobile node moved from an old access port to a new access port. The network element adds an entry in a forwarding table of the old egress engine to redirect a set of packets destined to the mobile node to a new egress engine, where the new egress engine is associated with the new access port. Furthermore, the network element redirects the set of packet from the old egress engine to the new egress engine.

Forwarding data path optimization in a distributed environment for achieving micro-mobility

Growing community of inventors

San Jose, CA, United States of America

Pritam Baruah