Cisco Technology, Inc.

Roberto Mitsuo Kobo

Sanjay Kumar Hooda

Atri Indiresan

Rajagopal Venkatraman

Shree N Murthy

Rajeev Kumar

Parthiv Shah

Vikash Agarwal

Ali Sajassi

Victor Manuel Moreno

Prakash C Jain

Michael Wu

Giovanni Meo

Dezhong Cai

Einar Nilsen-Nygaard

Balaji Pitta Venkatachalapathy

Ramesh Yeevani-Srinivas

Akshay Sunil Dorwat

Zheng Li

Anton Smirnov

Muhammad Ahmad Imam

Tawei Liao

Frank Peraza

Omer Ali

Gopala Krishna Andagunda

Shakeel Ahmed

Methods and devices configure edge nodes of a virtual network overlay to continuously forward data plane traffic flows between client devices of a common subnet over the course of at least some of the edge nodes being EF-configured. TF-configured edge nodes and EF-configured edge nodes both play roles in unilaterally inducing address discovery by sending to client devices address discovery responses that were not prompted by address discovery requests. TF-configured edge nodes then handle ensuing address discovery requests by proxy, and subsequently handle certain traffic flows according to an EF-compatible forwarding mode, while EF-configured edge nodes continue to forward traffic flows by IP routing normally. This averts throughput of data plane traffic over the network overlay being reduced as a side effect of the heterogeneously configured edge nodes, and averts the possibility of client devices broadcasting address discovery protocol requests as a result of remote client devices being unreachable.

Inter-compatible forwarding modes in network fabric overlays

In one embodiment, network node-to-node connectivity verification is performed in a network including data path processing of packets within a packet switching device. In one embodiment, an echo request connectivity test packet, emulating an echo request connectivity test packet received from a first connected network node, is inserted by the packet switching device prior in its data processing path prior to ingress processing performed for packets received from the first connected network node. A correspondingly received echo reply connectivity test packet is intercepted by the packet switching device during data path egress processing performed for packets to be forwarded to the first connected network node.

Network node-to-node connectivity verification including data path processing of packets within a packet switching device

Techniques for authenticating and enforcing differentiated policies for a virtual machine (VM) executing in bridge mode on a wireless host device in a media access control (MAC)-based authentication network are described. In an example method a wireless host device is authorized to join a fabric enabled wireless network. A VM executes in bridge mode on the wireless host device. At the fabric edge, a source MAC address of the VM is determined. A session is created between the VM and an authentication server. The VM is authenticated. A policy for the VM is determined. A source internet protocol (IP) address is assigned to the VM to create a MAC-IP binding. A data-plane device in the fabric enabled wireless network is programmed to apply the policy to traffic communicated with the VM. Finally, the data-plane device applies the policy for the VM based at least in part on the MAC-IP binding.

Authentication and enforcement of differentiated policies for a bridge mode virtual machine behind a wireless host in a MAC-based authentication network

Techniques for analyzing traffic originating from a host device in a wireless network to identify one or more virtual machines (VMs) running on the host device and connected to the network via the host device in bridge mode. When a VM is created in bridge mode behind a host device, the traffic originated by the VM will have the source Media Access Layer (MAC) address of the host device. According to techniques described herein, devices and/or components associated with the network may profile the traffic to identify an address of the VM, such as by analyzing dynamic host configuration protocol (DHCP) packets to determine the Internet Protocol (IP) address of the VM. Once the IP address and the MAC address of the VM is known, the components and/or devices may apply security policies to the VM that may be different than security policies applied to the host device.

Security policy enforcement for resources in bridge mode

A system and method for onboarding a virtual machine in a bridge host extension mode are provided. The method includes: creating a virtual machine on a host computing device, wherein the host computing device is associated with a first MAC address and a first IP address; assigning the virtual machine a second MAC address by the host computing device; receiving a first DHCP packet from the virtual machine by the host computing device, wherein the first DHCP packet comprises a first field that includes the second MAC address; replacing the second MAC address in the first field with the first MAC address by the host computing device; adding the second MAC address to a second field of the first DHCP packet by the host computing device; and providing the first DHCP packet to a DHCP server through a network by the host computing device.

Systems and methods for the handling of bridged virtual machines

Network link redundancy may be provided. A node comprising a virtualization of a network topology comprising a plurality of devices may be provided. Next, the node may be provided with at least two ports. Each of the at least two ports may respectively comprise an inside facing portion that uses a first protocol and an outside facing portion that uses a second protocol. The node may operate using the first protocol. A behavioral mode of the at least two ports may be controlled and the behavioral mode of the at least two ports may be communicated to at least one other node outside the node.

Fast, reliable, and extensible active-standby multi-vendor link redundancy

In one embodiment, a method comprises receiving traffic to send from a router to a host in the fabric edge network, wherein the fabric edge network comprises a plurality of switches and an inter-switch link (ISL); and sending the traffic from the router to the host via at least one of the switches based on the downlink connectivity of the host. Sending the traffic from the router to the host is performed without sending the traffic through the ISL. Sending the traffic from the router to the host comprises sending the traffic through the ISL when there is a link failure on a path between the router and the host.

Unequal cost load balancing for redundant virtualized fabric edge devices

Multi-VRF universal device Internet Protocol (IP) address for fabric edge devices may be provided. This address may be used to send and receive packets in a connectivity message for all VRFs on a fabric edge device. First, a request packet may be created by a first network device in response to receiving a connectivity message. The request packet may have a source address corresponding to an address of the first network device and a destination address corresponding to an address of a first client device. Next, the first network device may encapsulate the request packet. The first network device may then forward the encapsulated request packet to a second network device associated with the first client device.

Multi-VRF universal device internet protocol address for fabric edge devices

In one embodiment, a method includes receiving configuration data at a particular node of a first set of multiple nodes. The configuration data includes data that indicates a particular zero or more instances for which the particular node is primary among multiple virtual local area network (VLAN) instances to be forwarded. It is determined whether a VLAN indicated in a data packet received at the particular node is included in the particular instances for which the particular node is primary. If so, then the data packet is forwarded. In another embodiment, multiple nodes are configured to perform as a single virtual node, and the single virtual node is configured to forward data packets for the multiple VLAN.

Redundancy at a virtual provider edge node that faces a tunneling protocol core network for virtual private local area network (LAN) service (VPLS)

A technique transfers data between geographically dispersed entities belonging to a virtual-local-area network (VLAN). According to the technique, geographically dispersed entities communicate via software-defined virtual ports that 'appear' as physical ports to the entities. Each virtual port, in turn, is associated with one or more connections wherein each connection may be associated with one or more VLANs. Data generated on a particular VLAN that is destined for a remote entity is forwarded to a virtual port which, in turn, transfers the data to the remote entity over the connection associated with the VLAN. Moreover, state is maintained at each virtual port for each connection, thereby enabling the virtual ports to support various protocols that operate with physical ports.

Growing community of inventors

Pleasanton, CA, United States of America

Roberto Mitsuo Kobo