Juniper Networks, Inc.

Sachin Bansal

Manjunath Jagannatharao

Lisa Guo

Nagendra K S

Suresh Kumar Vinapamula Venkata

Nischal Sheth

Ashish Ranjan

Rajagopalan Sivaramakrishnan

Hampapur Nagaraj Ajay

Hari Prasad Killi

Prakash M Bailkeri

Ramesh Borapura

Murari Bhattacharyya

Praveen K V

Prakash Bailkeri

Techniques are disclosed for performing an In-Service Software Upgrade ('ISSU') of a first packet forwarding component (PFC) of a virtual router configured to forward traffic flows for a plurality of session instances within a cloud-based data center. The techniques described herein may retain flow state information throughout the ISSU process without interrupting network traffic flow. In one example, a processor of a plurality of compute nodes within the data center receives a request to perform an ISSU of the first PFC. The processor spawns a second virtual routing agent and a second PFC. The second virtual routing agent synchronizes flow state information with a first virtual routing agent for the virtual router. After synchronizing the flow state information, the virtual router switches from forwarding traffic flows by the first PFC to forwarding traffic flows by the second PFC. The ISSU process deactivates the first virtual router and the first PFC.

In-service software upgrade of virtual router with reduced packet loss

A method may include detecting a presence of a first server device; communicating, with the first server device, to obtain information associated with the first server device; sending, to a second server device, a request for authentication services, where the request includes the information associated with the first server device; receiving, from the second server device, a notification that the first server device has been authenticated, where the notification includes a session threshold; and establishing, based on the notification, a session with the first server device by associating the first server device with a virtual local area network (VLAN), where the associating permits network traffic to be received from or sent to the first server device via the VLAN, and where the network node uses the session threshold received from the second server device, instead of a threshold associated with the VLAN, to determine a duration permitted for the session.

Preserving an authentication state by maintaining a virtual local area network (VLAN) association

Techniques are disclosed describing an In-Service Software Upgrade for a Software Defined Networking (SDN) controller of a cloud data center. A cloud data center includes a first SDN controller configured to perform session management of a plurality of session instances, an orchestration engine communicatively coupled to the first SDN controller via a northbound application program interface (API); and a plurality of compute nodes configured to perform compute functions for the plurality of session instances. In response to receiving a request to perform an in-service software upgrade (ISSU) of the first SDN controller, the orchestration engine spawns a second, upgraded SDN controller on the cloud data center. An ISSU process initializes the second SDN controller and transfers session management for the plurality of session instances from the first SDN controller to the second SDN controller. Finally, the ISSU process removes the first SDN controller from the cloud data center.

In-service software upgrade of software-defined networking controller

In some examples, a controller comprises one or more processors; a control unit configured to obtain, from a router in a first network, a route that specifies a next hop to an address prefix reachable by the first network; and a service chain unit configured to generate a modified route that specifies a service node as the next hop for the address prefix, wherein the service node is external to the first network, and wherein the control unit is further configured to send the modified route to a second network, the modified route marked with an import route target configured for a provider edge router of the second network so that traffic from the first network and destined for the second network is forwarded to the service node.

Service chaining across multiple networks

A method includes detecting a presence of a device on a network associated with a node, where the node is not connected to an authentication server and is configured to communicate with the device using a data link layer authentication protocol; communicating, with another node, using a data link layer tunneling protocol, to authenticate the device as a result of detecting the presence of the device, where the other node communicates with the authentication server, using a network layer authentication protocol, that enables the other node to receive an authentication notification associated with the device; receiving, from the other node, the authentication notification that indicates that the device has been authenticated, where the authentication notification is received using the data link layer tunneling protocol; and sending, to the device, an indication that the device is authorized to communicate with the network, where the sending includes establishing an authentication session that enables the device to communicate with the network.

Authentication using a proxy network node

Growing community of inventors

Fremont, CA, United States of America

Sachin Bansal