Cisco Technology, Inc.

Other

Sanjay Kumar Hooda

Prakash C Jain

Victor Manuel Moreno

Satish Kumar Kondalam

Anand K Oswal

Muninder Singh Sambi

Rex Emmanuel Fernando

Atri Indiresan

Rajeev Kumar

Shyamsundar Nandkishor Maniyar

Shree N Murthy

Vinay Saini

Johnson Leong

Anoop Vetteth

Marc Portoles Comeras

Vikram Vikas Pendharkar

Sudhir Kumar Jain

Syam Sundar V Appala

Shivangi Sharma

Tarunesh Ahuja

Syam Sundar Appala

Kaushik Kumar Dam

Raja Janardanan

Kedar Karmarkar

Balaji Sundararajan

Rajagopalan Janakiraman

Sridhar Subramanian

Nalinaksh Pai

Darrin Joseph Miller

Vrushali Ashtaputre

Roberto Mitsuo Kobo

Ramesh Yeevani-Srinivas

Akshay Sunil Dorwat

Fabio Rodolfo Maino

Oliver James Bull

Vina Ermagan

Chandramouli Balasubramanian

Darren Russell Dukes

Nehal Bhau

Kiran Kumar Yedavalli

Balaji Pitta Venkatachalapathy

Kausik Majumdar

Shashank Vinchurkar

Venkatesh Ramachandra Gota

Anand Pulicat Gopalakrishnan

Jesus Arango

Vimarsh Puneet

Sonal Prem Kumar Chhabria

Himanshu Mehra

Aaditya Vadnere

Anubhav Gupta

Samir D Thoria

Gangadharan Byju Pularikkal

Reshad Rahman

Ashwin Kumar

Pags Krishnamoorthy

Sanjay Thyamagundalu

Rajagopal Venkatraman

Solomon Thiruvarutselvan Lucas

Chiragkumar P Desai

Rajesh Arora

Sandesh Kumar Narappa Bheemanakone

Vishal Satyendra Desai

Shyam N Kapadia

Rajesh S Pazhyannur

Sumeet Singh

Ronak K Desai

Peter Geoffrey Jones

Manoj Gupta

Alberto Rodriguez Natal

Munish Mehta

Saravanan Radhakrishnan

Brian Russell Kean

Azeem Suleman

Ashok Ganesan

Kabiraj Sethi

Vinay Parameswarannair

Ganesh Srinivasa Bhat

Nikhil Sharma

Patel Amitkumar Valjibhai

Vijay Sampath

Rishabh Parekh

Shreeram Bhide

Venkatabalakrishnan Krishnamurthy

Mohammed Javed Asghar

Gaurav Dawra

Massimiliano Ardica

Anupama Ashok Lolage

Poon K Leung

Ripon Bhattacharjee

Anand Akella

Errol Fenton Roberts

Da-Yuan Tung

Ravishankar Chandrasekaran

Muhammad Ahmad Imam

Amey Magar

Liu Huang

Aniket Ghule

Anton Smirnov

Sandesh Kumar B Narappa

A method of cross-domain policy orchestration may include executing, with a cross-domain automation (CDA) controller, a macro-segmentation of a plurality of domains based at least in part on metadata defining a mapping to a corresponding plurality of domain controllers, and executing, with the CDA controller, a micro-segmentation of policies within a group based at least in part on a merged policy matrix obtained from policies of the domain controllers.

Cross-domain policy orchestration

Systems, methods, and computer-readable media for discovering silent hosts in a software-defined network and directing traffic to the silent hosts in a scalable and targeted manner include determining interfaces of a fabric device that are connected to respective one or more endpoints, where the fabric device is configured to connect the endpoints to a network fabric of the software-defined network. At least a first interface is identified, where an address of a first endpoint connected to the first interface is not available at the fabric device. A first notification is transmitted to a control plane of the software-defined network based on identifying the first interface, where the control plane may create a flood list which includes the fabric device. Traffic intended for the first endpoint from the network fabric is received by the fabric device can be based on the flood list.

Detecting and communicating with silent hosts in software-defined networks

Described herein are systems and methods for optimizing energy efficiency in a network utilizing a control plane or other network administration device or software suite. The control plane continuously monitors end-to-end network paths and collects real-time data about network topology, traffic patterns, and connected devices. By analyzing the collected network data, the control plane identifies power needs for network nodes and generates energy saving recommendations or instructions tailored to each node's specific capabilities. Network nodes can subscribe to the energy efficiency service provided by the control plane, receive network usage data, and execute energy saving operations based on the recommendations. The control plane dynamically updates the energy saving recommendations in response to changes in network conditions, enabling network nodes to optimize their energy efficiency without compromising network performance and availability. These updates can be based on current network conditions but can be generated from historical data and/or machine learning processes.

Subscription-based sustainable network administration

A wireless telemetry process (WTP) may obtain telemetry data which includes signal strength information associated with a plurality of fabric wireless access points (APs) of a network fabric. The WTP may identify that a signal strength between a current AP and a wireless endpoint is below a threshold. In response, the WTP may select addresses of a set of handoff candidate APs for the wireless endpoint based on the signal strength information. The WTP may communicate, to a map server, a message to register, as entries in a replication list, a plurality of routing locators associated with the addresses of the set of handoff candidate APs for association with an address of the wireless endpoint. The map server may notify a router of the replication list, for replicating packets intended for the wireless endpoint to a plurality of routers that are connected to the set of handoff candidate APs.

Seamless handoff between wireless access points (APs) with use of pre-convergence packet replication

Systems, methods, and computer-readable media are provided for performing secure frame encryption as a service. For instance, a network edge device can determine at least a first path and a second path for routing a data packet. The network edge device can obtain a first plurality of values for at least one network metric, wherein the first plurality of values corresponds to the first path and at least a first backup path associated with the first path. The network edge device can obtain a second plurality of values for the at least one network metric, wherein the second plurality of values corresponds to the second path and at least a second backup path associated with the second path. The network edge device can select a path for routing the data packet based on a comparison of the first plurality of values and the second plurality of values.

Exit interface selection based on intermediate paths

Methods and devices configure edge nodes of a virtual network overlay to continuously forward data plane traffic flows between client devices of a common subnet over the course of at least some of the edge nodes being EF-configured. TF-configured edge nodes and EF-configured edge nodes both play roles in unilaterally inducing address discovery by sending to client devices address discovery responses that were not prompted by address discovery requests. TF-configured edge nodes then handle ensuing address discovery requests by proxy, and subsequently handle certain traffic flows according to an EF-compatible forwarding mode, while EF-configured edge nodes continue to forward traffic flows by IP routing normally. This averts throughput of data plane traffic over the network overlay being reduced as a side effect of the heterogeneously configured edge nodes, and averts the possibility of client devices broadcasting address discovery protocol requests as a result of remote client devices being unreachable.

Inter-compatible forwarding modes in network fabric overlays

This technology enables directed broadcasts in network fabrics. A control plane node is configured to resolve directed broadcast addresses by mapping the directed broadcast address to a subnet address. A fabric border node receives a directed broadcast, extracts a destination address, and transmits a request to the control plane node to resolve the destination address. The control plane node retrieves the stored mapping and generates a map reply with a multicast destination. The fabric border node encapsulates and forwards the directed broadcast to fabric edge nodes, which decapsulate the directed broadcast and deliver a data set from the directed broadcast to appropriate end point devices. Each fabric edge node may be enabled to determine if the fabric edge node may be connected to a silent host and, based on that determination, request the fabric border node to be added to the multicast destination to receive the directed broadcast.

Directed broadcast in network fabric

Techniques for network routing border convergence are described. Backup paths for external connections for a network are established and provide for a temporary path for network traffic during network routing convergence, preventing traffic loss at network border nodes.

Border node traffic convergence

Techniques for group-based classification and policy enforcement at a network fabric edge for traffic that is being sent to external network destinations are disclosed herein. The techniques may include receiving, at a control plane of a network and from an edge node of the network, a request to provide mapping data associated with sending a packet to a destination. Based at least in part on an address prefix value associated with the destination, the control plane may determine that the destination is located in an external network. Additionally, a group identifier that is associated with the destination may be determined. In this way, an indication of the group identifier may be sent to the edge node such that the edge node may determine, based at least in part on the group identifier, a policy decision for routing the packet to the external network.

Group based classification and policy enforcement for external network traffic

This disclosure describes techniques to operate a control plane in a network fabric. The techniques include determining a stateless rule corresponding to communication between a first segment of the network fabric and a second segment of the network fabric. The techniques further include configuring the control plane to enforce the stateless rule.

Enforcement of inter-segment traffic policies by network fabric control plane

Techniques for a Software-Defined Networking (SDN) controller associated with a multisite network to implement jurisdictional data sovereignty polices in a multisite network, route network traffic flows between user sites and destination services over one or more provider sites, and/or perform a routing operation on the network traffic flow(s) based on the jurisdictional data sovereignty policies. The jurisdictional data sovereignty polices may be implemented using destination group tags (DGTs) and/or source group tags (SGTs). A secure access service edge (SASE) associated with the network controller may generate, store, and distribute the DGTs to provider sites and/or the SGTs to user sites. Based on the SGT and/or DGT associated with a network traffic flow, one or more services may be applied to the network traffic flow, and the network traffic flow may be routed through a particular region of a software-defined access (SDA) transit.

Data sovereignty and service insertion in multisite network fabric

Automated techniques for converting network devices from a Layer 2 (L2) network into a Layer 3 (L3) network in a hierarchical manner are described herein. The network devices may be configured to boot such that their ports are in an initialization mode in which the ports are unable to transmit locally generated DHCP packets. When a network device detects that a neighbor (or 'peer') device has acquired an IP address or has been configured by a network controller, then the port on which the neighbor device is detected can then be transitioned from the initialization mode into a forwarding mode. In the forwarding mode, the port can be used to transmit packets to obtain an IP address. Thus, the network devices are converted from an L2 device to an L3 device in a hierarchical order such that upstream devices are discovered and converted into L3 devices before downstream devices.

Hierarchical provisioning of network devices

Techniques and architecture are described for providing a service, e.g., a security service such as a firewall, across different virtual networks/VRFs/VPN IDs. The techniques and architecture provide modifications in enterprise computing fabrics by modifying pull-based overlay protocols such as, for example, locator/identifier separation protocol (LISP), border gateway protocol ethernet virtual private network (BGP EVPN), etc. A map request carries additional information to instruct a map-server that even though mapping (destination prefix and firewall service RLOC for the destination) is known within the map-server's own virtual network/VRF for firewall service insertion, the map-server still should do a lookup across virtual networks/VRFs and discover the final destination's DGT (destination group tag) and include that in the map reply.

Security group resolution at ingress across virtual networks

Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Software defined access fabric without subnet restriction to a virtual network

In one embodiment, a method by an edge router configured to operate at a first site of a software-defined wide-area network includes receiving a data packet from a first host located in the first site, where the data packet is destined to a second host located in a second site, determining that an identifier of a second group to which the second host belongs is not available at the edge router, sending a request for an identifier of the second group to a network apparatus, where the request may comprise an address of the second host, receiving a response comprising the identifier of the second group from the network apparatus, determining that the second group is a destination group, applying one or more policies associated with the destination group to the data packet, and causing the data packet to be routed to the second host.

Group-based policies for inter-domain traffic

Growing community of inventors

Pleasanton, CA, United States of America

Sanjay Kumar Hooda