Cisco Technology, Inc.

Rex Emmanuel Fernando

Sanjay Kumar Hooda

Sami Boutros

Paul M Quinn

Dhananjaya Rao

Syam Sundar Appala

David Delano Ward

Clarence Filsfils

Anand K Oswal

James Neil Guichard

Hendrikus G P Bosch

Avneesh Sachdev

Victor Manuel Moreno

Muthurajah Sivabalan

Alessandro Duminuco

Anthony Joseph Li

Oliver James Bull

Hasmit S Grover

Darren Russell Dukes

Luyuan Fang

Kausik Majumdar

Henk H W Smit

Ali Sajassi

Keyur Patel

Anubhav Gupta

Samir D Thoria

Jim Guichard

Lakshmi Sharma

Santiago Vazquez Freitas

Dheerendra Talur

Bruce McDougall

Robert Keith Fielding

Dave Barach

Carlos M Pignataro

Shyam N Kapadia

Stewart Frederick Bryant

Yakov Rekhter

Balaji Sundararajan

Liqin Dong

Himanshu H Shah

Peter Psenak

Pradosh Mohapatra

Robert Raszuk

Enke Chen

Jisu Bhattacharya

Derek Man-Kit Yeung

Daniel C Frost

Govind Prasad Sharma

Syam Sundar V Appala

Palani Chinnakannan

Vikram Vikas Pendharkar

Murali Venkateshaiah

Simon James Trevor Spraggs

Jesus Arango

Paul Arthur Jensen

Sailesh Krishnamurthy

Ravishankar Chandrasekaran

Chris Metz

In one embodiment, a method by an edge router configured to operate at a first site of a software-defined wide-area network includes receiving a data packet from a first host located in the first site, where the data packet is destined to a second host located in a second site, determining that an identifier of a second group to which the second host belongs is not available at the edge router, sending a request for an identifier of the second group to a network apparatus, where the request may comprise an address of the second host, receiving a response comprising the identifier of the second group from the network apparatus, determining that the second group is a destination group, applying one or more policies associated with the destination group to the data packet, and causing the data packet to be routed to the second host.

Group-based policies for inter-domain traffic

An enterprise controller of an enterprise network sends to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network. Responsive to the sending, the enterprise controller receives from the service gateway the network slice information including identifiers of and properties associated with the network slices. Responsive to receiving a request for the network slice information from a network device at a border of a forwarding plane of the enterprise network, the enterprise controller sends the network slice information to the network device to cause the network device to perform configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers to the data plane of the service provider network.

Enabling enterprise segmentation with 5G slices in a service provider network

In one embodiment, a method includes receiving a data packet from a first host located in the first site, where the data packet may be destined to a second host located in a second site that may be different from the first site, determining that an identifier of a second group to which the second host belongs is not available at the first network apparatus, sending a request for an identifier of the second group to a second network apparatus, where the request may comprise an address of the second host, receiving a response comprising the identifier of the second group from the second network apparatus, determining that the second group is a destination group, applying one or more policies associated with the destination group to the data packet, and causing the data packet to be routed to the second host.

Network controls for application access secured by transport layer security (TLS) using single sign on (SSO) flow may be provided. An application access request for authenticating a user may be received in response to the user requesting an access to an application. User credentials associated with the user may be validated. In response to validating the user credentials, user attributes associated with the user may be determined. Network controls for a user session associated with the application access request may be determined based on the user attributes. The application access request may be redirected to a plain text user session. The plain text user session may comprise the network controls for the user session.

Network controls for application access secured by transport layer security (TLS) using single sign on (SSO) flow

A plurality of policies to be enforced in a network environment via a plurality of devices are determined. A topology of the plurality of devices within the network environment is also determined. For each policy of the plurality of policies, a device of the plurality of devices is selected as the location at which to enforce the policy of the plurality of policies. Selecting the device for each policy of the plurality of policies includes correlating the policy of the plurality of policies with another of the plurality of policies and correlating the policy of the plurality of policies with the topology.

Resolution of policy enforcement point by cross correlating other policies

This technology enables normalized lookup and forwarding for diverse virtual private networks in multi-site network fabric deployments. A source device on a first Layer 2 site transmits a frame to a destination device on the same subnet, but on a second Layer 2 site. The frame is encapsulated and routed to a fabric border node. The fabric border node matches the source subnet to the destination subnet and transmits an address request protocol ('ARP'). In response to not receiving a reply to the ARP, the fabric border node transmits a map request to a Layer 3 transit fabric control plane node. The control plane node extracts a destination identifier from the map request and determines that the destination identifier is a Layer 2 identifier. The control plane node transmits a map reply to the fabric border node, where the frame is re-encapsulated and forwarded to the destination device.

Normalized lookup and forwarding for diverse virtual private networks

Systems, methods, and computer-readable media for providing cross-domain policy enforcement. In some examples, transit VRFs for a destination network domain and a source network domain are created. Route advertisements for nodes coupled to source VRFs in the source network domain are created that include identifications of the source VRFs. The route advertisements can be transmitted from a source transit VRF in the source network domain to a destination transit VRF in the destination network domain. The route advertisements can then be filtered at the destination transit VRF based on a cross-domain policy using the identifications of the source VRFs to export routes to destination VRFs in the destination network domain according to the cross-domain policy.

Policy plane integration across multiple domains

One embodiment of a method includes receiving at a first network node traffic from a second network node; and sending by the first network node to a third network node information identifying the second network node via a Local Area Network ('LAN') connection between the first and third network nodes. Subsequent to receipt of the information identifying the second network node, the third network node updates a locator table maintained by the third network node to include an entry including the information identifying the second network node received by the third network node from the first network node. Upon receipt by the third network node of a notification that the first network node has failed, the third network node sends an update only to network nodes that have an entry in the locator table indicating that the first network node has failed.

Techniques for optimizing egress tunnel router failure scenarios in intelligent wide area networks

A method is described that includes receiving at a network element a transmission control protocol ('TCP') packet with TCP options set on a link between a controller and a destination node. If the network element comprises a transit node, the method includes comparing a bandwidth value indicated in a TCP options field of the received TCP packet with an outgoing link bandwidth of the network element. If the bandwidth value indicated in the TCP options field is greater than the outgoing link bandwidth of the network element, the method includes updating the bandwidth value in the TCP options field to be equal to the outgoing link bandwidth of the network element, and forwarding the packet to a next network element. If the bandwidth value indicated in the TCP options field is not greater than the outgoing link bandwidth, the bandwidth value in the TCP options field is not changed.

Techniques for adaptively and selectively protecting control plane of communications network

A system and a method are disclosed for enabling interoperability between data plane learning endpoints and control plane learning endpoints in an overlay network environment. An exemplary method for managing network traffic in the overlay network environment includes receiving network packets in an overlay network from data plane learning endpoints and control plane learning endpoints, wherein the overlay network extends Layer 2 network traffic over a Layer 3 network; operating in a data plane learning mode when a network packet is received from a data plane learning endpoint; and operating in a control plane learning mode when the network packet is received from a control plane learning endpoint. Where the overlay network includes more than one overlay segment, the method further includes operating as an anchor node for routing inter-overlay segment traffic to and from hosts that operate behind the data plane learning endpoints.

Interoperability between data plane learning endpoints and control plane learning endpoints in overlay networks

In one embodiment, a network controller identifies a first sign of life for an edge device in a communication network (e.g., when the network controller receives an encapsulated workflow request for the edge device over a control plane of the communication network). The network controller further imports the encapsulated workflow request from the edge device over the control plane, determines configuration parameters for a tenant and a tenant network from the encapsulated workflow request, and transmits the configuration parameters to the edge device to provision the edge device for the tenant according to the configuration parameters.

Auto-provisioning edge devices in a communication network using control plane communications

Presented herein are techniques for use in a network environment that includes one or more service zones, each service zone including at least one instance of an in-line application service to be applied to network traffic and one or more routers to direct network traffic to the at least one service, and a route target being assigned to a unique service zone to serve as a community value for route import and export between routers of other service zones, destination networks or source networks via a control protocol. An edge router in each service zone or destination network advertises routes by its destination network prefix tagged with its route target. A service chain is created by importing and exporting of destination network prefixes by way of route targets at edge routers of the service zones or source networks.

Chaining service zones by way of route re-origination

A method is provided in one example embodiment and includes receiving a request to create a path through a network, wherein the path originates on a first network device and terminates on the second network device; identifying a first controller associated with the first network device, wherein the first controller proxies control plane functions for the first network device; identifying a second controller associated with the second network device, wherein the second controller proxies control plane functions for the second network device; and computing the path using the first controller as a source and the second controller as a destination. The first controller installs the computed path on the first network device and the second controller installs the computed path on the second network device.

Segment routing label switch paths in network functions virtualization communications networks

Growing community of inventors

Dublin, CA, United States of America

Rex Emmanuel Fernando