Cisco Technology, Inc.

Sivakumar Ganapathy

Rajagopalan Janakiraman

Patel Amitkumar Valjibhai

Kalyan Ghosh

Azeem Suleman

Giovanni Meo

Gianluca Mardente

Prashanth Matety

Sapan Shah

Ronak K Desai

Mohammed Javed Asghar

Navya Patimalla

Ram Regar

Sohayb Aiyub

Sami Boutros

Reshad Rahman

Javed Asghar

Vijayan Ramakrishnan

Sundar Siddaramaiah Bettadahalli

Suresh Pasupula

Sachin Gupta

Shashank Chaturvedi

Xianlong Qin

Fei Xu

Leo Chun-Chuen Chan

Systems, methods, and computer-readable media for elastic policy scaling in multi-cloud fabrics. A method can involve deploying a cluster of policy agents on a hub virtual private cloud (VPC) that interconnects spoke VPCs in a cloud associated with a multi-cloud fabric, and mapping endpoints in the spoke VPCs to the policy agents. The method can involve distributing groups of policies for the endpoints across the policy agents based on the mapping of endpoints to policy agents, and advertising, by each policy agent to a respective first set of virtual gateways in the spoke VPCs, routes associated with endpoints mapped to the policy agent and preventing the policy agent from advertising routes associated with a second set of virtual gateways in the spoke VPCs. The method can involve applying, via the policy agent, a group of policies on the policy agent to traffic received by the policy agent.

Elastic policy scaling in multi-cloud fabrics

Technologies for multi-cloud routing and policy interconnectivity are provided. An example method can include assigning different sets of data plane routers to data plane traffic associated with different address spaces in a cloud site of a multi-cloud fabric to yield a distributed mapping of data plane traffic and data plane routers. The method can further include providing, to an on-premises site in the multi-cloud fabric, routing entries from a control plane router on the cloud site, the routing entries reflecting the distributed mapping and identifying, for each address space, which data plane router handles data plane traffic for that address space; and when a data plane router is deployed at the cloud site, providing, to the on-premises site, updated routing information from the control plane router, the updated routing information identifying the data plane router as a next hop for data plane traffic associated with a respective address space.

Seamless multi-cloud routing and policy interconnectivity

Techniques for routing data packets through service chains within and between public cloud networks of multi-cloud fabrics. A router in a network, e.g., a public cloud network, receives data packets from nodes in the network through segments of the network. Based at least in part on (i) a source address of the data packet, (ii) a destination address of the data packet, and (iii) an identity of the segments of the network from which the data packets are received, the router determines a next node in the network to which the data packet is to be forwarded. The router may then forward the data packet through another segment of the network to the next node and then receive the data packet from the next node through the another segment.

Service chaining in multi-fabric cloud networks

Disclosed is a method that includes calculating, at a collector receiving a data flow and via a hashing algorithm, all possible hashes associated with at least one virtual attribute associated with the data flow to yield resultant hash values. Based on the resultant hash values, the method includes computing a multicast address group and multicasting the data flow to n leafs based on the multicast address group. At respective other collectors, the method includes filtering received sub-flows of the data flow based on the resultant hashes, wherein if a respective hash is owned by a collector, the respective collector accepts and saves the sub-flow in a local switch collector database. A scalable, distributed netflow is possible with the ability to respond to queries for fabric-level netflow statistics even on virtual constructs.

System and method for providing scalable flow monitoring in a data center fabric

Systems, methods, and computer-readable media for policy splitting in multi-cloud fabrics. In some examples, a method can include discovering a path from a first endpoint in a first cloud to a second endpoint in a second cloud; determining runtime policy table capacities associated with nodes in the path; determining policy distribution and enforcement for traffic from the first endpoint to the second endpoint based on the runtime policy table capacities; based on the policy distribution and enforcement, installing a set of policies for traffic from the first endpoint to the second endpoint across a set of nodes in the path; and applying the set of policies to traffic from the first endpoint in the first cloud to the second endpoint in the second cloud.

Systems and methods for on-demand flow-based policy enforcement in multi-cloud environments

Techniques for maintaining isolation and segregation for network paths through multi-cloud fabrics using VRF technologies. The techniques include running virtual routers in a cloud network that connect the cloud network to an on-premises network using a network overlay that preserves VRF information in data packets. Further, the virtual routers connect to individual gateways in the cloud network using tunnels, and each individual gateway is connected to multiple VPCs without overlapping subnets. The virtual routers may assign a sink VRF to each gateway connection that can be used to perform source-IP based VRF selection by mapping source IP addresses in each tunnel connection to appropriate VRFs for the source IP addresses. In this way, virtual routers may use sink VRFs to translate into the VRF information for data packets from the VPCs via source-IP based lookup, and use the corresponding VRF route table to determine next hops for data packets.

Isolation and segmentation in multi-cloud interconnects

Technologies for extending a subnet across on-premises and cloud-based deployments are provided. An example method may include creating a VPC in a cloud for hosting an endpoint being moved from an on-premises site. For the endpoint to retain its IP address, a subnet range assigned to the VPC, based on the smallest subnet mask allowed by the cloud, is selected to include the IP address of the endpoint. The IP addresses from the assigned subnet range corresponding to on-premises endpoints are configured as secondary IP addresses on a Layer 2 (L2) proxy router instantiated in the VPC. The L2 proxy router establishes a tunnel to a cloud overlay router and directs traffic destined to on-premises endpoints, with IP addresses in the VPC subnet range thereto for outbound transmission. The cloud overly router updates the secondary IP addresses on the L2 proxy router based on reachability information for the on-premises site.

Layer 2 mobility for hybrid multi-cloud deployments without host-overlay

Disclosed is a method that includes obtaining a list of processes in an application centric infrastructure fabric, sorting the list of processes according to an amount of memory increase associated with each respective process in the list of processes to yield a sorted list, selecting a group of processes from the sorted list and collecting a respective live process core for each process in the group of processes without pausing or killing any process in the group of processes. The method includes applying an offline leak detection tool to each process in the group of processes to yield a list of leaked memory addresses for a given process of the group of processes and transmitting a message to the given process with the list of leaked memory addresses, whereby the given process calls a function to release leaked memory associated with the given process as identified in the message.

System and method for self-healing of application centric infrastructure fabric memory

A method for detecting memory leaks with an administrative client begins by transmitting to all of the processes running on at least one computing device, a first command to return memory track information. The administrative client receives memory track information from each of the processes, and combines them into a first system wide memory allocation. The administrative client transmits an instruction to run a test case process, and then transmits, to each of the processes, a second command to return memory track information. The administrative client receives the second set of memory track information and combines it to generate a second system wide memory allocation. To generate a list of potential memory leaks originating from the test case process, the administrative client compares the first system wide memory allocation with the second system wide memory allocation.

Growing community of inventors

Fremont, CA, United States of America

Sivakumar Ganapathy