Juniper Networks, Inc.

Sunanda L Kommula

Nitin Kumar

Dmitry A Shokarev

Jonathan C Barth

Alex Baban

Sri Karthik Goud Gadela

Jamsheed R Wania

Pranay Pogde

Babu Singarayan

Rudramahesh S Rugge

Kurt J Windisch

Nandan Paramashiva

Liang Zhang

Swamy Sadashivaiah Renu Kananda

Sharmila Koppula

Ramesh Kandula

Anshu Verma

Surya Nimmagadda

A network device is configured to receive an inbound packet from a first server device via a network tunnel, the first inbound packet including an outer header, a virtual private network (VPN) label, an inner header, and a data payload, the inner header including an inner source IP address of a source virtual machine. The processors are also configured to determine a first tunnel identifier, determine, based on the inner source IP address, a second tunnel identifier associated with a second server device hosting the source virtual machine, compare the second tunnel identifier with the first tunnel identifier to determine whether the tunnel on which the first inbound packet was received is the same as a tunnel used for forwarding traffic to the source virtual machine, and drop the inbound packet when the second tunnel identifier does not match the first tunnel identifier.

Anti-spoofing techniques for overlay networks

A device receives network information associated with a network and server information associated with one or more server devices, wherein the network is associated with a network device and the one or more server devices. The device generates, based on the network information and the server information, an encapsulation profile for a tunnel encapsulation path and a route profile for the tunnel encapsulation path. The device provides, to the network device, the encapsulation profile for the tunnel encapsulation path and the route profile for the tunnel encapsulation path, and provides, to the one or more server devices, the encapsulation profile for the tunnel encapsulation path. The tunnel encapsulation path is provided between the network device and the one or more server devices, via the network, based on the encapsulation profile for the tunnel encapsulation path and the route profile for the tunnel encapsulation path.

Generating flexible, programmable, and scalable network tunnels on demand

The techniques describe forwarding multicast traffic using a multi-level cache in a network device forwarding plane for determining a set of outgoing interfaces of the network device on which to forward the multicast traffic. For example, a multi-level cache is configured to store a multicast identifier of a multicast packet and multicast forwarding information associated with the multicast identifier, such as identification of one or more egress packet processors of the network device to which the multicast packet is to be sent for forwarding to the set of one or more egress network devices, and/or outgoing interfaces of the network device toward each egress network device of the set of one or more egress network devices. The multi-level cache is also configured to store respective multicast identifiers that are to be encapsulated with outgoing multicast packets that are forwarded to the set of one or more egress network devices.

Optimized multicast forwarding with a cache

A network device selects a primary source for multicast traffic and a secondary source for the multicast traffic, where the multicast traffic is provided to endpoint devices communicating with a network, and where the primary source and the secondary source are redundant sources. The network device provides a first join request that includes information that causes a primary path to be provided from the primary source through the network. The network device provides a second join request that includes information that causes a secondary path to be provided from the secondary source through the network. The network device receives the multicast traffic from the primary source via the primary path and the secondary source via the secondary path, and provides the multicast traffic received from the primary source to the endpoint devices. The network device prevents the multicast traffic received from the secondary source from reaching the endpoint devices.

Utilizing upstream routing of multicast traffic from redundant multicast sources to increase multicast resiliency and availability

A device receives policy information associated with configuring a network, and receives network information associated with the network. The device determines, based on the network information, that the policy information is associated with implementation of egress peer engineering techniques for the network, and identifies, based on the network information, a first set of destinations of the network that satisfies a particular threshold bandwidth. The device assigns costs and bandwidths to the first set of destinations based on the policy information, and monitors bandwidth utilization by the first set of destinations. The device processes information associated with the first set of destinations, with a model, based on the bandwidth utilization and based on the egress peer engineering techniques, to generate a first set of ranked destinations, and causes traffic in the network to be managed based on the first set of ranked destinations and the policy information.

Determining and implementing egress peer engineering and/or ingress peer engineering for destinations in a network

The disclosed method may include (1) receiving, at a route server that serves an Internet exchange, a request from an autonomous system to join the Internet exchange, (2) obtaining, from the autonomous system, a policy that defines which routes pertaining to the autonomous system are to be shared with additional autonomous systems that have joined the Internet exchange, (3) obtaining, from the autonomous system, a plurality of routes pertaining to the autonomous system, (4) storing, at the route server, the plurality of routes pertaining to the autonomous system, and then (5) advertising at least a portion of the plurality of routes to at least one of the additional autonomous systems in accordance with the policy obtained from the autonomous system. Various other apparatuses, systems, and methods are also disclosed.

Apparatus, system, and method for improving the process of establishing peering relationships via internet exchanges

A system and method for selecting packets to be forwarded from redundant multicast streams. A primary multicast stream and a secondary multicast stream are received, wherein the primary multicast stream and the secondary multicast stream are redundant multicast streams received over disjoint multicast forwarding paths. A hardware-based analyzer in a forwarding plane of the network device is applied to detect when a quality of one of the primary multicast stream or the secondary multicast stream has fallen below a threshold. In response to detecting that a quality of one of the primary multicast stream or the secondary multicast stream has fallen below a threshold, selecting, via a thread executing in a forwarding component of the network device, a different one of the primary multicast stream or the secondary multicast stream having a quality that meets the threshold, wherein selecting includes dynamically rewriting next hop operations associated with the selected stream. Packets received on the selected one of the primary multicast stream or the secondary multicast stream are forwarded and packets of the multicast stream received on the other one of the primary multicast stream or the secondary multicast stream for which the quality has fallen below the threshold are discarded.

Fast reroute of redundant multicast streams

A network device is provided in a private virtual local area network (VLAN). The network device receives a packet on one of multiple private VLAN ports of the network device, and assigns a classified VLAN signature to the packet. The network device also assigns a primary VLAN signature to the packet, and stores a media access control (MAC) address and the classified VLAN signature of the packet in a single MAC address table.

Optimizing private virtual local area networks (VLANS)

In general, techniques are described for performing packet loss measurement in a distributed data plane. In one example, a local router includes a plurality of forwarding units that implement a distributed data plane. First and second forwarding units may switch layer two (L2) packet data units (PDUs) between the local router and a remote router using a virtual path. The first and second forwarding may unit may increment, in response to processing any PDU of the PDUs for the virtual path, respective counters stored by the first and second forwarding units. The first and second forwarding units may update, based on the respective counters, a loss-measurement packet (LMP). For instance, the first forwarding unit, upon updating the LMP, may internally forward the LMP to the second forwarding unit. The second forwarding unit, upon updating the LMP, may send the LMP to the remote router.

Growing community of inventors

Cupertino, CA, United States of America

Sunanda L Kommula