Cisco Technology, Inc.

Robert Tristan Shanks

Justin Joel Delegard

Patrick Douglas Verkaik

Dylan Jason Koenig

Jignesh Devji Patel

Selahattin Daghan Altas

Joseph Morgan Aronow

Dan Aguayo

John Charles Bicket

Clifford Arthur Frey

James Michael Roewe

Daghan Altas

Mark Hendrick, Jr

Nathaniel Brahms

Adam Weis

Vishalsai Haresh Daswani

Joel Feinstein

Jacob Corr Valentic

Arthur Po-Hsiang Huang

Ryan Reading

Jr Mark Gerard Hendrick

Various implementations disclosed herein include systems, methods and apparatuses of a first device, that obtain contact point information of a second device associated with the first device, as a peer device in a private network, where the contact point information of the second device includes one or more peer uplink identifiers and each respective peer uplink identifier corresponds to a respective peer device uplink of the second device. The systems, methods and apparatuses establish a first private network data tunnel from a first uplink of the first device to the second device, using the contact point information of the second device, and a first uplink identifier associated with the first uplink, and establish a second private network data tunnel from a second uplink of the first device to the second device, using the contact point information of the second device, and a second uplink identifier associated with the second uplink.

Establishing a private network using multi-uplink capable network devices

Previously available network monitoring and management systems fail to provide an indication about how uplink traffic is handled at or beyond the network access point. By contrast, various implementations disclosed herein provide uplink performance monitoring and management from a client device, which is located on one side of an access point, to a destination that is located on the other side of the access point. For example, in some implementations, a method of uplink performance management is provided that includes transmitting a plurality of uplink test packets from a client device, determining a response to the transmission of the plurality of uplink test packets through the network access point, and generating one or more uplink performance values according to the determined response, the one or more uplink performance values characterizing how uplink traffic is handled between the client device and the destination both to and beyond the network access point.

Uplink performance management

In one embodiment, a method includes receiving, at a network endpoint device, a traffic analysis query from a network controller, the traffic analysis query including one or more query parameters, where the one or more query parameters are provided to select portions of traffic analysis data. The method also includes identifying a portion of traffic analysis data stored in a buffer that satisfies the one or more query parameters, where the traffic analysis data characterizes traffic data that has traversed the endpoint device, and where the endpoint device provides network access to one or more client devices. The method further includes providing the identified portion of the traffic analysis data to the network controller in response to the traffic analysis query.

Network traffic analysis

Previously available network monitoring and management systems fail to provide adequate transmit power control in WiFi networks having multiple neighboring wireless access points. By contrast, various implementations disclosed herein include systems, methods and apparatuses that generate an interference map based at least on co-channel interference reported in a number of neighbor lists, wherein each of the neighbor lists is associated with a respective one of a plurality of compliant wireless access points included in one of a local area network (LAN) and a portion of a virtual LAN (VLAN); and determine a respective transmit power adjustment for each of the plurality of compliant wireless access points included in the interference map based on at least one interference criterion characterizing the interference on each of the plurality of compliant wireless access points included in the interference map and respective neighboring wireless access points.

Jointly managed access point transmit power control

A management server includes a configuration and management module processing server configuration information, including a VPN peer list and VLAN/subnet settings. The management server automatically calculates the VPN configuration information, including the VPN peer subnet route information identifying which of the subnets participating in the VPN are behind which of the routers and keys to establish VPN tunnels between those routers participating in the VPN. Each of the routers participating in the VPN includes a VPN tunnel with the other routers participating in the VPN, a set of data structures storing data identifying contact information for each of the subnets participating in the VPN, a combination of an IP address and port to reach one of routers that that subnet is behind, and a forwarding module to forward traffic between the subnets.

System and method for managing site-to-site VPNs of a cloud managed network

Various implementations disclosed herein provide private network driven hosted network device management that enables more robust management of private networks that include such equipment. For example, in some implementations, a method of private network driven hosted network device management includes receiving a fetch request from a compliant device, wherein the fetch request indicates demand for at least one of new and updated configuration data and instructions. In turn, the method further includes assessing whether or not the new and updated configuration data and instructions, for the requesting compliant device, will conflict with local customizations and indicate potential disruption to connectivity and services in an associated private network, in order to produce an assessment result. The method also includes selectively generating a new configuration file including a suitable set of new and updated configuration data and instructions based on the assessment result.

Private network driven hosted network device management

Disclosed are systems, methods, and computer-readable storage media for automatic firewall configuration based on aggregated cloud managed information. A cloud management device can determine, based on security event data received from a first set of client computing environments, that a security attack detected on at least one client computing environment from the first set of client computing environments is likely to occur on other client computing environments. In response to determining that the security attack detected on at least one client computing environment from the first set of client computing environments is likely to occur on other client computing environments, the cloud management device can identify a second set of client computing environments to protect from the security attack. For each client computing environment from the second set of client computing environments, the cloud management device can configure firewall settings to protect from the security attack.

Automatic firewall configuration based on aggregated cloud managed information

Disclosed are systems, methods, and computer-readable storage media for recommending configurations for a client networking environment based on aggregated cloud managed information. A cloud network management device can receive a first set of infrastructure specifications describing a first client networking environment. The cloud network management device can determine a set of recommended configurations for the first client networking environment based on the first set of infrastructure specifications and configurations for one or more client networking environments determined to be similar to the first client networking environment. The cloud network management device can provide the set of recommended configurations to a client device associated with the first client networking environment.

Recommending configurations for client networking environment based on aggregated cloud managed information

Various implementations disclosed herein include systems, methods and apparatuses that involve a first device selecting a data tunnel for sending packets of a determined network traffic type to another device. For example, in some implementations, a method includes a first device receiving a first group of packets for forwarding to a second device. The method includes the first device retrieving packet-forwarding rules for forwarding the first group of packets, and selecting a first private network data tunnel from a plurality of private network data tunnels between the first device and the second device, for forwarding a first packet of the first group of packets, based on satisfaction of the retrieved packet-forwarding rules. A respective private network data tunnel is associated with a respective uplink of a plurality of uplinks of the first network device. The first private network data tunnel is associated with a first uplink of the first device.

Service-specific, performance-based routing

Previous solutions to the problem of maintaining up-to-date network device addressing, fail to provide systems or processes that efficiently share and obtain addressing information of networking devices in a given network. By contrast, and to that end, various implementations disclosed herein include systems, methods and apparatuses that generate a registry request message, where the registry request message includes a first portion characterized by a first write privilege and a second portion characterized by a second write privilege different from the first write privilege. The systems, methods and apparatuses convey the registry request message to a shared contact point network entity, and obtain a response message addressed from the shared contact point network entity, where the response message includes peer addressing information corresponding to one or more peer network devices associated with the aforementioned systems, methods and apparatuses.

Global contact-point registry for peer network devices

Disclosed are systems, methods, and computer-readable storage media for automatic security list offload with exponential timeout. A second layer of a firewall can determine that a first data, that previously passed through a first layer of the firewall, should be blocked. The second layer of the firewall can utilize more resources than the first layer of the firewall to determine whether to block a data packet. In response, a first rule can be applied at the first layer of the firewall to block data packets received from a source of the first data packet. Accordingly, a second data packet received from the source of the first data packet will be blocked at the first layer of the firewall based on the first rule.

Growing community of inventors

San Mateo, CA, United States of America

Robert Tristan Shanks