Oracle International Corporation

Juniper Networks, Inc.

Citrix Systems, Inc.

Hewlett-packard Development Company, L.p.

Rishi Kaundinya Mutnuru

Dilip H Sanghavi

Raghav Somanahalli Narayana

Ravi Kondamuru

Iain Roger Cadd

Sandeep Kamath

Murali Raja

Padmanabha Nallur

Huei-ping Chen

Narasimha Talapady Nayak

Josephine Suganthi

Jeff Barlow

Lakshminarayana Mandaleeka

Tien-You Chen

Erik Brandsberg

Praveen Grover

Longbao Luo

In accordance with an embodiment, described herein is a system and method for use of dynamic templates with a network traffic flow information protocol, such as, for example, an Internet Protocol Flow Information Export (IPFIX) protocol. An exporter, that operates an exporting process, generates a capability message that indicates the network traffic flow fields that can be implemented and exported from the exporter (e.g., in an IPFIX data format), and communicates the capability message to a collector that operates a collecting process. The collector examines the network traffic flow fields identified by the capability message, and generates a dynamic template request message indicating (in the manner of a virtual template) a combination of fields for which network traffic flow information is to be provided. The exporter thereafter communicates, to the collector, data messages comprising the network traffic flow fields as indicated by the dynamic template.

System and method for use of dynamic templates with a network traffic flow information protocol

A network device obtains information, associated with blacklisted domains, that includes blacklisted domain identifiers, and sinkhole server identifiers associated with the blacklisted domain identifiers. The network device obtains a set of rules that specify match criteria, associated with the blacklisted domains, that include source network addresses and/or destination network addresses for comparison to packet source network addresses and/or packet destination network addresses associated with incoming packets. The set of rules specify actions to perform based on a result of comparing the match criteria and the packet source network addresses and/or the packet destination network addresses for the incoming packets. The network device receives packets, examines a packet source network address and/or a packet destination network address associated with the packets, compares the packet source network address and/or the packet destination network address to the match criteria, and performs an action based on a result of the comparison.

Methods and devices for blocking, detecting, and/or preventing malicious traffic

The present is directed to systems, methods, and devices for holistic rendering of cloud network configuration. The method can include receiving data characterizing a plurality of devices in a computing network. The method can include generating with the inventory processor a data file characterizing each of the plurality of devices in the computing network. This data file can be generated based on the received data and on a set of static overrides. The method can include generating a configuration file for each of the plurality of devices in the computing network via iterative selection and application of templates to portions of the data file.

Method and apparatus for holistic rendering of cloud network configuration

The present disclosure relates to a method and/or apparatus for versioning cloud network configuration. The method can include receiving base configuration files for a set of devices forming at least a portion of a computing network, pulling current configuration files from each device of the set of devices, for each device, and determining a discrepancy when a base configuration file of the device and a current configuration file of the device do not match. When the discrepancy is determined for a device, generating a patch file based on the determined discrepancy for that device. The method can include extracting a last configuration commit time from that device, allocating a unique snapshot identifier to the patch file and associated with the last configuration commit time, and populating a snapshot database.

Method and apparatus for versioning cloud network configuration

In accordance with an embodiment, described herein is a system and method for autonomous firewall rule management, for use with cloud computing environments or other types of network environments. A firewall rule management automation framework provides rule management for firewalls deployed across availability domains. The system is adapted to automatically determine firewalls that can receive network traffic from a given source subnet or destination subnet; configure the firewalls with required firewall rules; monitor the firewall rules through collection of metrics snapshots and rule hit counts; and purge underused or potentially obsolete firewall rules, for example those having zero hits over a particular period of time or number of snapshots. The system provide generic support for different types of firewall devices, and autonomous management of firewall rules within large heterogeneous computer networks that may include several types of firewalls.

Method and apparatus for autonomous firewall rule management

In accordance with an embodiment, described herein are systems and methods for use of a suffix tree to control blocking of blacklisted encrypted domains. A suffix tree includes encrypted hash keys corresponding to a plurality of domain nodes. A domain-related request packet is received, and a target domain name extracted from the packet. A pair of hash keys are generated for the request packet and target domain; and a hash table is searched with the generated hash key pair. If a corresponding entry is found in the hash table, then a corresponding hash suffix pointer is determined for the packet, and the suffix tree examined to determine whether the node identified by the query is part of a blacklisted node. If the suffix tree indicates the node to be part of a blacklisted node, then the system can perform a specified action associated with that node.

System and method for use of a suffix tree to control blocking of blacklisted encrypted domains

Round-trip times (RTT) values are estimated between meshed data centers serving an internet domain and a local domain name server (LDNS) associated with the data centers. A method initializes a shared database with proactively estimated RTTs and uses distributed DNS reflection to improve the accuracy of an estimated RTT value and update the shared database. RTTs may be proactively estimated by using pings, queries, or local DNS reflection. In local DNS reflection, a reflector sends a request to a collector in the same data center via the LDNS, and the collector measures the RTT. In distributed DNS reflection, a reflector in a first data center sends a request to a collector in a second data center via the LDNS. The collector calculates the latency, retrieves the (first) RTT between the first data center and the LDNS, and calculates the (second) RTT between the second data center and the LDNS by doubling the difference between the latency and half the first estimated RTT.

Global load balancing achieved by using distributed DNS reflection

In accordance with an embodiment, described herein is a system and method for providing fault tolerance and resiliency within a cloud network. A cloud computing environment provides access, via the cloud network, to software applications executing within the cloud environment. The cloud network can include a plurality of network devices, of which various network devices can be configured as virtual chassis devices, cluster members, or standalone devices. A fault tolerance and resiliency framework can monitor the network devices, to receive status information associated with the devices. In the event the system determines a failure or error associated with a network device, it can attempt to perform recovery operations to restore the cloud network to its original capacity or state. If the system determines that a particular network device cannot recover from the failure or error, it can alert an administrator for further action.

System and method for providing fault tolerance and resiliency in a cloud network

An example method facilitates Global Traffic Management (GTM) and associated selective distribution of computing loads and/or network traffic among different geographically distributed data centers of a particular domain by allocating the servicing of request messages from Local Domain Name Servers (LDNSs) to data centers that are estimated to provide the quickest response times to the LDNSs. Estimates of path latencies or Round Trip Times (RTTs) between the LDNSs and the different distributed data centers are estimated using DNS reflection methodologies and are maintained in a database that may be accessed and collectively managed via the data centers, e.g., via use of a web service that fronts the database. Locations of the LDNSs approximate locations of client devices seeking access to the domain.

Method and apparatus for multi-vendor GTM fabric

The present is directed to systems, methods, and devices for modelling cloud networks for automation, The system can include a computing network including at least one transit router and a plurality of switches. The system can include at least one server that can access model information for the computing network, and set up the computing network based upon the model information. Setting up the computing network can include creating a topology database, and building the computing network based on the topology database. The topolopgy data can be created by creating switches at each layer in the computing network, mapping links connecting the switches, each link connecting a pair of switches, creating Border Gateway Protocol ('BGP') routing for both an underlay network and an overlay network, creating a topology graph of the computing network, and generating Zero Touch Provisioning ('ZTP') links.

System and method for modelling cloud networks for automation

The present is directed to systems, methods, and devices for Zero Touch Provisioning ('ZTP'). The system can include a computing network including at least one transit router and a triggering device, and at least one server coupled with the computing network. The server can: generate a topology map characterizing the computing network, link an identifier with a configuration file for devices in the computing network, receive a trigger signal from a triggering device coupled to the computing network, launch a ZTP algorithm, send an initial configuration file and executable first scripts to the triggering device, which first scripts direct the triggering device to: collect information identifying other devices in the computing network coupled to the triggering device, and to generate a unique identifier based on the collected information, receive a request including the unique identifier for a configuration file, and download the configuration file to the triggering device.

System and method for automating zero touch provisioning of cloud networks

Techniques are described for automatic discovery of two or more virtual service instances configured to apply a given service to a packet in a software-defined networking (SDN)/network functions virtualization (NFV) environment. Virtual service instances may be deployed as virtual entities hosted on one or more physical devices to offer individual services or chains of services from a service provider. The use of virtual service instances enables automatic scaling of the services on-demand. The techniques of this disclosure enable automatic discovery by a gateway network device of virtual service instances for a given service as load balancing entities. According to the techniques, the gateway network device automatically updates a load balancing group for the given service to include the discovered virtual service instances on which to load balance traffic for the service. In this way, the disclosed techniques provide auto-scaling and auto-discovery of services in an SDN/NFV environment.

Auto discovery and auto scaling of services in software-defined network environment

An example method facilitates Global Traffic Management (GTM) using a combination of passive latency measurements and active latency measurements, including Domain Name System (DNS) server reflection methods, that estimate Round Trip Times (RTTs) between individual geographically distributed data centers (servicing a particular domain) and Local Domain Name Servers (LDNSs) communicating with the data centers. Passive and/or active measurements may initialize a shared database (e.g., accessible by the data centers via a web service). After initialization of the database using static and/or active methods to provide initial estimates of RTTs, different DNS reflection methods then accurately estimate the RTTs and populate the database therewith. The different DNS reflection methods include a first DNS reflection method using co-located reflectors and collectors, and a second distributed DNS reflection method that does not require co-located DNS reflectors and collectors, but instead may employ a hierarchy of reflectors and collectors deployed at different data centers servicing the same domain.

Method and apparatus for accurate GLB achieved by using distributed DNS reflection

In general, techniques are disclosed for automatic discovery and load balancing of virtual service instances of a plurality of cloud data centers within a Software Defined Networking (SDN) or a Network Functions Virtualization (NFV) environment. In one example, a global load balancing device (GLB) of a first cloud data center receives, from an SDN controller, address information for a first set of virtual service instances provided by the first cloud data center and a hostname of a domain for which to perform load balancing across the plurality of cloud data centers. The GLB device requests, from a domain name server (DNS) for the domain, address information for other sets of virtual service instances provided by other cloud data centers. Further, the GLB device applies a load balancing algorithm to direct network traffic to one or more of the virtual service instances provided by the plurality of cloud data centers.

Growing community of inventors

San Jose, CA, United States of America

Rishi Kaundinya Mutnuru