Cisco Technology, Inc.

Nicira, Inc.

Vmware, Inc.

Ciena Corporation

Kimidrive LLC

Sami Boutros

Muthurajah Sivabalan

Ankur Dubey

Ali Sajassi

Mani Kancherla

Jerome Catrouillet

Jayant Jain

Samer Salam

Clarence Filsfils

Yashika Narang

Subin Cyriac Mathew

Anirban Sengupta

George Swallow

David Delano Ward

Alexander Tessmer

Chidambareswaran Raman

Rex Emmanuel Fernando

Philip Kippen

Ganesan Chandrashekhar

Stephen Tan

Sri Mohana Singamsetty

Abhishek Goliya

Himanshu Shah

Dhananjaya Rao

Rahul Mishra

Kantesh Mundaragi

John H W Bettink

Akhila Naveen

Pradosh Mohapatra

Pere Monclus

Sharath Bhat

Peng He

Dharma Rajan

Jean-Philippe Vasseur

Israel Cidon

Prashanth Venugopal

Reshad Rahman

Luca Martini

Mike Parsa

Santosh Pallagatti Kotrabasappa

Yuri Tsier

Meenakshi Sundaram Selvaraj

Vijayalaxmi Basavaraj

Dharmaraja Rajan

Vinay Kumar Ganeshmal Jain

Carlos M Pignataro

Ronghua Zhang

Stefano Benedetto Previdi

Vivek Agarwal

Stewart Frederick Bryant

W Andrew Lambeth

Ian Michael Charles Shand

Sreeram Kumar Ravinoothala

Syed Kamran Raza

Cengiz Alaettinoglu

Benjamin C Basler

Minjal Agarwal

Ankur Kumar Sharma

Senthilkumar Karunakaran

Lakshmi Sharma

Santiago Alvarez

Tao Wang

Santiago Vazquez Freitas

Pranav Mehta

Liwen Wu

Bruce McDougall

Rodolphe Figaro

Steve H Truong

George Mathew

Siva Sivabalan

Robert Keith Fielding

Jia Yu

Ayan Banerjee

Rakesh Gandhi

Patrice Brissette

Peter Psenak

Rajeev Nair

Diheng Qu

Sivakumar Ganapathy

Robert H Thomas

Abhishek Mishra

David Gilson

Jayant Kumar Bhardwaj

Nobushige Akiya

Palani Chinnakannan

Vijayan Ramakrishnan

Arun Prakash

Ashwath Narasimhan

Sylvain Masse

Parag Kumar Jain

Sundar Siddaramaiah Bettadahalli

Show Chung Chin

Sowmya Chandran

Simon Spraggs

Sumedh Saurav

Nagi Reddy Jonnala

Michael Reda Samuel

Vibov Bhan

Leo Chun-Chuen Chan

Kevin Li

The present disclosure provides an approach for scaling the number of VNFs in a data center without scaling the number of control sessions between VNFs and a data center gateway. The approach includes opening a session between a VNF and a route server, rather than between the VNF and the gateway, when the VNF needs to send its connectivity information to the gateway. The VNF sends its connectivity information to the route server, and the route server forwards the connectivity information to the gateway. The gateway receives connectivity information of a plurality of VNFs in the data center from the route server rather than from each of the VNFs individually. The connectivity information is then used to send packets, by the gateway to a VNF, for processing. The packets are sent using three layers of networking: an underlay physical network, an overlay logical network, and a second overlay logical network.

Building a platform to scale control and data plane for virtual network functions

For a multi-tenant environment, some embodiments of the invention provide a novel method for forwarding tenant traffic through a set of service machines to perform a set of service operations on the tenant traffic. In some embodiments, the method performs a classification operation on a data message flow of a tenant, in order to identify a set of service operations to perform on the data message flow. For some data message flows, the classification operation selects the identified set of service operations from several candidate sets of service operations that are viable service operation sets for similar data message flows of the tenant. In some embodiments, the classification operation is based on a set of attributes associated with the data message flow (e.g., five tuple identifier, i.e., protocol and source and destination ports and IP addresses).

Service operation chaining

Some embodiments provide a method for configuring an edge computing device to implement a logical router belonging to a logical network. The method configures a datapath executing on the edge computing device to use a first routing table associated with the logical router for processing data messages routed to the logical router. The method configures a routing protocol application executing on the edge computing device to (i) use the first routing table for exchanging routes with a network external to the logical network and (ii) use a second routing table for exchanging routes with other edge computing devices that implement the logical router.

Edge device implanting a logical network that spans across multiple routing tables

Some embodiments of the invention provide novel methods for facilitating a distributed SNAT (dSNAT) middlebox service operation for a first network at a host computer in the first network on which the dSNAT middlebox service operation is performed and a gateway device between the first network and a second network. The novel methods enable dSNAT that provides stateful SNAT at multiple host computers, thus avoiding the bottleneck problem associated with providing stateful SNAT at gateways and also significantly reduces the need to redirect packets received at the wrong host by using a capacity of off-the-shelf gateway devices to perform IPV6 encapsulation for IPv4 packets and assigning locally unique IPv6 addresses to each host executing a dSNAT middlebox service instance that are used by the gateway device.

Facilitating distributed SNAT service

A method, implemented for a first component of a network element, includes steps of, responsive to one or more routing state updates for one or more routes, updating a route entry for the one or more routes in an update library that communicates with a cache database; and exchanging the routing state updates with a second component of the network element, wherein the exchanging of the routing state updates is bulked where the second component is configured to read all of the exchanged routing state updates. The exchanging is performed instead of providing a routing state message for each of the one or more routing state updates for the same route state.

Update library for a scalable layer 3 routing system

Systems and methods associated with a node in a Segment Routing network include, responsive to what services are support at a node in a Segment Routing network, creating a bitmap to represent the plurality of services supported at the node; and transmitting an advertisement with the bitmap such that the advertisement is a single advertisement of multiple services. This approach can reduce the advertisement of rout updates by orders of magnitude.

Bitmap signaling of services using segment routing

Systems and methods include, in a node in a Segment Routing network, learning an adjacency Segment Identifier (SID) of a directly connected neighbor; and programming forwarding entries including a primary path and backup path associated with the adjacency SID. The programming is only performed for adjacency SIDs of directly connected neighbors, for use as a Point of Local Repair (PLR). This addresses holes in Topology Independent Loop Free Alternative (TI-LFA) node protection scheme for Segment Routing Traffic Engineering (SR-TE) paths.

Control plane based enhanced TI-LFA node protection scheme for SR-TE paths

Systems and methods for Segment Routing Traffic Engineering (SR-TE) with awareness of local protection include the advertisement of local protection information in effect at each SR capable node via Interior Gateway Protocol (IGP), Border Gateway Protocol Link-State advertisement (BGP-LS), telemetry, etc. This information can include identity (IP address) of protected elements (link/node), type of protection (node, link, SRLG), a SID list for the backup path, whether protection is active, etc. This information can also be advertised via Path Computation Element Protocol (PCEP) as well. The information can also include a Binding SID (BSID) in the advertisement for local backup paths. Further, the present disclosure can enable a new SR OAM message (probe) to instruct a node to activate/deactivate a specific backup path in the forwarding plane for testing purposes.

Segment routing traffic engineering (SR-TE) with awareness of local protection

Some embodiments of the invention provide a novel network architecture for providing edge services of a virtual private cloud (VPC) at host computers hosting machines of the VPC. The host computers in the novel network architecture are reachable from external networks through a gateway router of an availability zone (AZ). The gateway router receives a data message from the external network addressed to one or more data compute nodes (DCNs) in the VPC and forwards the data message to a particular host computer identified as providing a distributed edge service for the VPC. The particular host computer, upon receiving the forwarded data message, performs the distributed edge service and provides the serviced data message to a destination DCN.

Method for providing distributed gateway service at host computer

The disclosure provides an approach for reducing congestion within a network, the network comprising a plurality of subnets, the plurality of subnets comprising a plurality of host machines and a plurality of virtual computing instances (VCIs) running on the plurality of host machines. Embodiments include receiving, by an edge services gateway (ESG) of a first subnet of the plurality of subnets, membership information for a group identifying a subset of the plurality of host machines. Embodiments include receiving a multicast packet directed to the group and selecting from the plurality of host machines, a replicator host machine for the multicast packet. Embodiments include sending, to the replicator host machine, the multicast packet along with metadata indicating that the replicator host machine is to replicate the multicast packet to remaining host machines of the subset of the plurality of host machines identified in the membership information for the group.

Scalable overlay multicast routing

In some embodiments, a method for selecting an egress point for accessing an external network associated with a distributed logical router that is distributed across at least a first computing device and a second computing device is provided. The method receives, by an instance of the logical router at the first computing device, first identification information and a first preference value. The method compares the first preference value to a second preference value. The second preference value is associated with second identification information corresponding to a current computing device that is identified as a current preferred egress point for the logical router. The method determines whether to set the egress point connected to the instance of the logical router in the second computing device as a new preferred egress point for the logical router.

Using an attribute value to set a preferred egress point in multi-site logical routers

A node in a Segment Routing network includes circuitry configured to signal first service Segment Identifiers (SIDs), for one or more first Ethernet services configured at the node, to other nodes in the Segment Routing network, receive second service SIDs for one or more second Ethernet services configured at the other nodes in the Segment Routing network, and configure the second service SIDs for one or more second Ethernet services. The first service SIDs and the second service SIDs can be signaled by one of Interior Gateway Protocol (IGP) and Border Gateway Protocol (BGP).

Ethernet services with segment routing with dataplane MAC learning

Systems and methods for micro-loop avoidance include detecting a remote link failure in a network and identifying an associated Point of Local Repair (PLR); determining destinations in the network that are impacted due to the remote link failure; and installing of a temporary tunnel to the PLR. The steps can further include sending traffic destined for nodes impacted by the remote link failure via the temporary tunnel to the PLR. The temporary tunnel can be implemented by a node Segment Identifier (SID) for the PLR.

Micro-loop avoidance in networks

A Provider Edge (PE) node includes a plurality of ports including an inter-chassis port to a second PE node, a port connected to a root node, and one or more ports connected to leaf nodes, wherein the plurality of ports are in an Ethernet Tree (E-Tree), and wherein the root node is dual-homed to the PE node and the second PE node; switching circuitry configured to switch traffic between the plurality of ports; and circuitry configured to designate the inter-chassis port as one of a leaf node and a root node in the E-Tree instance, and manage a designation of the inter-chassis port based on a status of the port connected to the root node. The designation is changed in a data plane instead of in a control plane.

Fast convergence of E-Tree with a dual homed root node

The technology disclosed herein enables a dynamic chain of service functions for processing network traffic. In a particular embodiment, a method includes, in a logical router for a logical network connecting service functions, receiving a network packet from a service function over the logical network after the network packet has been processed by the service function. The method further includes determining a new classification of the network packet and determining a next service function based on application of a service chain policy to the new classification. The method also includes directing the network packet to the next service function over the logical network.

Dynamic chain of service functions for processing network traffic

Growing community of inventors

Union City, CA, United States of America

Sami Boutros