Cisco Technology, Inc.

Graphiant, Inc.

Stefan Olofsson

Ijsbrand Wijnands

Hendrikus G P Bosch

Anubhav Gupta

Jeffrey Michael Napper

Neale Ranns

Vamsidhar Valluri

Pradosh Mohapatra

Sape Jurriën Mullender

Pranav Mehta

Hendrikus Gp Bosch

Mandeep Rohilla

David Carrel

Arjun Sreekantaiah

Khalid Raza

Cameron Ferdinands

In one embodiment, a router includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the router to perform operations including receiving software-defined networking in a wide area network (SD-WAN) policies from a component of an SD-WAN network. The operations also include establishing a session with a mobile device and receiving information associated with the mobile device in response to establishing the session with the mobile device. The operations further include filtering the SD-WAN policies based on the information associated with the mobile device to generate SD-WAN device-specific policies and communicating the SD-WAN device-specific policies to the mobile device.

Systems and methods for distributing SD-WAN policies

In one embodiment, an apparatus includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the apparatus to perform operations including receiving a user credential from a remote access client within a network and communicating the user credential to an authentication, authorization and accounting (AAA) server within the network. The operations also include receiving a user attribute from the AAA server and generating a contextual label based on the user attribute. The contextual label includes routing instructions associated with traffic behavior within the network. The operations further include advertising a control message, which includes the contextual label, to the remote access client.

Systems and methods for generating contextual labels

According to certain embodiments, a system comprises one or more processors and one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations comprising: receiving location data associated with a plurality of remote users accessing one or more existing remote access gateways that are located at one or more network locations; building a heatmap of user locations based at least in part on the received location data; and identifying, from the heatmap of user locations, at least one new network location in which to generate at least one new remote access gateway, or at least one existing network location in which to remove at least one of the existing remote access gateways.

Systems and methods for dynamically generating a mobile software-defined wide area network gateway location for remote users

Embodiments for bounded broadcast encryption key management in a peer-to-peer network are described. To realize bounded broadcast encryption key management, a second peer of the peer-to-peer network receives a first broadcast message from a first peer. The first broadcast message includes at least a public key associated with the first peer. The second peer then generates a key seed in response to receiving the first broadcast message, and creates a second message that includes the key seed encapsulated with the public key. The second peer then transmits the second message to the first peer, and in response to the transmission of the second message, receives a packet from the first peer. The packet includes data encrypted using a secret key derivable from the key seed and one or more portions of the second message.

Bounded broadcast encryption key management

Embodiments of a secure communication network are disclosed. To implement the embodiments, an ingress core node that includes a processor and a memory storing computer-executable instructions, is presented. The instructions, when executed, cause the processor to receive a data packet. The instructions further cause the processor to compare a slice identifier (ID) associated with the received data packet with one or more slice IDs in an access control list (ACL). The instructions further cause the processor to filter the received data packet based on the comparison indicating an occurrence of a match between the slice ID associated with the data packet and one of the one or more slice IDs in the ACL. The instructions further cause the processor to transmit the filtered data packet to an egress core node of the core network via one or more intermediate core nodes of the core network.

Method and system for filtering data packets to prevent crosstalk

Methods for establishing a stateless extranet in a secure communication network include transmitting a consumer NHOP to a provider CPE from a consumer CPE in a control plane. The consumer NHOP is associated with at least one attribute of an NHOP, including an encryption key available with the consumer CPE, to establish a secure communication tunnel in a data plane. The consumer CPE receives a service definition over the control plane associated with a service available with the provider CPE. A service anchor point is created based on an identifier of the service definition. A network address translation (NAT) IP request is transmitted to the provider CPE. The consumer CPE receives a NAT IP from the provider CPE in response to the NAT IP request. The NAT IP is associated with the service anchor point of the consumer CPE. A stateless service is thereby instantiated on the consumer CPE.

System and method for instantiation of stateless extranets

Embodiments of a method of communicating a packet by a network address translation (NAT) enabled router, are described. In an embodiment, the method includes receiving a return packet to be communicated to a destination. The destination is associated with a first source address in the context of a forward packet. The method further includes determining a return path to transmit the return packet to the destination based on security association data. The security association data is pre-recorded in a routing table of the NAT enabled router when the forward packet is received, prior to receiving the return packet, over a forward path established between the NAT enabled router and an enterprise node. The security association data uniquely identifies the forward path as the return path.

Network address translation with in-band return path resolution

In one embodiment, a method includes detecting a request to route traffic to a service associated with an application. The method also includes identifying an application identifier associated with the application and selecting, using the application identifier, a label from a plurality of labels included in a routing table. The label includes one or more routes. The method further includes routing the traffic to the service associated with the application using the label.

Systems and methods for routing network traffic using labels

The present disclosure provides for a loop avoidance technique that implements an upstream neighbor check to detect any forwarding inconsistencies. When a message is received from a neighbor routing element, an upstream neighbor check is performed to determine whether the neighbor routing element is an upstream neighbor toward a content provider of a datastream identified in the message. If the check determines that the neighbor routing element is not an upstream neighbor, then a forwarding inconsistency is not detected. If the check determines that the neighbor routing element is an upstream neighbor, then a forwarding inconsistency is detected.

Loop avoidance technique for the multicast control plane

In one embodiment, a node in a multicast label distribution protocol (mLDP) network determines a remote protecting node for a particular root node in the mLDP network. In addition, the node determines a protecting node address of the remote protecting node and a root node address of the particular root node, and establishes an mLDP label-switched path (LSP) via the remote protecting node by using the protecting node address as a root of an outer forwarding equivalent class (FEC) of a recursive FEC, and using the root node address as an inner FEC of the recursive FEC for the mLDP LSP. As such, when the remote protecting node is reached, the outer FEC is stripped and the remote protecting node continues establishing the mLDP LSP toward the particular root node.

Multicast label distribution protocol over a remote loop-free alternative

In one embodiment, a packet switching device determines backup forwarding paths based on route distinguisher correlation values. A route distinguisher correlation value is some value associated with multiple routes, which allows a packet switching device to consider routes associated with a same route distinguisher correlation value, but having different route distinguishers and a same prefix to be considered as going to a same destination. Examples of route distinguisher correlation value used in one embodiment include, but are not limited to: scalar values, a route distinguisher of a different route, a virtual private network associated with a different route; a route target associated with the a different route; or a Border Gateway Protocol (BGP) Next-hop address associated with a different route.

Growing community of inventors

Dubai, United Arab Emirates

Stefan Olofsson