Cisco Technology, Inc.

Amazon Technologies, Inc.

Surendra M Kumar

Paul M Quinn

James Neil Guichard

Nagaraj Bagepalli

Hendrikus G P Bosch

Abhijit Patra

Jeffrey Michael Napper

Alessandro Duminuco

Humberto Jose La Roche

David Delano Ward

Michael R Smith

Kevin Shatzkamer

Dileep Kumar Devireddy

Sape Jurriën Mullender

Carlos M Pignataro

Navindra Yadav

Daniel George Wing

Louis Gwyn Samuel

Aeneas Sean Dodd-Noble

Bart A Brinckman

Ian McDowell Campbell

Ravi Shekhar

Luca Martini

Kent Kinchu Leung

Jayaraman R Iyer

Victor Manuel Moreno

Fabio Rodolfo Maino

Frank Brockners

Shwetha Subray Bhandari

Peter Bosch

David W Chang

Warren Scott Wainner

Jim Guichard

Ethan M Spiegel

Vina Ermagan

Govind Prasad Sharma

Burjiz F Pithawala

Hendrikus Gp Bosch

Anil Kumar Chandrupatla

Wei-Chun Chao

Swati Bansal

Joshua Page Starkweather

John Brett

Asela Jude Mallawaaratchy

Prashant Patadayya Hiremath

Vandana Saha

Yavindra Yadav

Nagaraj A Bagepalli

In a network environment, access to network devices is controlled using a multi-leveled locking mechanism. A method of applying the locking mechanism may include managing device locks configured to control access of a plurality of tools to a memory of a network device, where the device locks include a first level of device lock associated with a first priority and a second level of device lock associated with a second priority that is higher than the first priority. The method may further include generating an interleaved signal responsive to issuing the second level of device lock to a second tool while a first tool has an active first level of device lock. The interleaved signal may be communicated to the first tool and the first tool may coordinate subsequent changes to the network device in accordance with changes to the network device that are made by the second tool after the interleaved signal is generated.

Network device access control and synchronization

Technologies are provided for distributed network management. An access-point computing device is configured to receive commands that target network devices in different computer networks. When a command is received, the access-point device determines which network is targeted by the command and stores the command in a queue associated with that network. Other computing devices are configured to access the multiple computer networks and to execute commands that target devices in the multiple networks. These other computing devices can be configured to transmit requests for commands to the access-point device. When such a request is received, the access-point device determines which network the request is for, retrieves a command from the queue associated with the computer network, and transmits the command to the requestor. The requestor, upon receipt of the command, executes the command against network device(s) in the computer network and transmits any result back to the first computing device.

Distributed network management

An example method is provided in one example embodiment and may include receiving traffic associated with at least one of a mobile network and a Gi-Local Area Network (data-plane), wherein the traffic comprises one or more packets; determining a classification of the traffic to a service chain, wherein the service chain comprises one or more service functions associated at least one of one or more mobile network services and one or more data-plane services; routing the traffic through the service chain; and routing the traffic to a network using one of a plurality of egress interfaces, wherein each egress interface of the plurality of egress interfaces is associated with at least one of the one or more mobile network services and the one or more data-plane services.

System and method for hosting mobile packet core and value-added services using a software defined network and service chains

An example method is provided in one example embodiment and may include receiving traffic associated with at least one of a mobile network and a Gi-Local Area Network (Gi-LAN), wherein the traffic comprises one or more packets; determining a classification of the traffic to a service chain, wherein the service chain comprises one or more service functions associated at least one of one or more mobile network services and one or more Gi-LAN services; routing the traffic through the service chain; and routing the traffic to a network using one of a plurality of egress interfaces, wherein each egress interface of the plurality of egress interfaces is associated with at least one of the one or more mobile network services and the one or more Gi-LAN services.

In one embodiment, a method includes creating a catalog of service function ('SF') profiles, wherein each of the profiles is associated with an SF and indicates a type of the associated SF; storing the catalog of SF profiles in a memory device of a service controller associated with the DVS; creating a service profile group template ('SPGT') that includes at least one SF profile from the catalog of SF profiles, wherein the SPGT includes a service chain definition identifying at least one service chain comprising the SF associated with the at least one SF profile to be executed in connection with a service path and at least one policy for classifying traffic to the at least one service chain; deploying a first SPG instance based on the SPGT; and deploying an additional SPG instance based on the SPGT in accordance with a scaling policy included in the SPGT.

System and method for automated rendering of service chaining

An example method is provided in one example embodiment and may include configuring a measurement indication for a packet; forwarding the packet through a service chain comprising one or more service functions; recording measurement information for the packet as it is forwarded through the service chain; and managing capacity for the service chain based, at least in part, on the measurement information. In some cases, the method can include determining end-to-end measurement information for the service chain using the recorded measurement information. In some cases, managing capacity for the service chain can further include identifying a particular service function as a bottleneck service function for the service chain; and increasing capacity for the bottleneck service. In various instances, increasing capacity for the bottleneck service can include at least one of: instantiating additional instances of the bottleneck service; and instantiating additional instances of the service chain.

System and method for managing chained services in a network environment

A method is provided in one example embodiment and includes receiving at a network element an encapsulated packet including an encapsulation header, in which the encapsulation header includes an Analytics Proxy Function ('APF') flag; determining whether the APF flag is set to a first value; if the APF flag is set to the first value, forwarding the encapsulated packet to a local APF instance associated with the network element, in which the encapsulated packet is processed by the local APF instance to replicate at least a portion of the encapsulated packet, construct a record of the encapsulated packet, or both; and if the APF flag is not set to the first value, omitting forwarding the encapsulated packet to the local APF instance associated with the network element. The local APF instance is implemented as a service function anchored at the forwarding element.

Techniques for efficient service chain analytics

An example method for distributed service chaining is provided and includes receiving a packet belonging to a service chain in a distributed virtual switch (DVS) network environment, the packet includes a network service header (NSH) indicating a service path identifier identifying the service chain. The packet is provided to a virtual Ethernet module (VEM) connected to an agentless service node (SN) providing an edge service such as a server load balancer (SLB). The VEM associates a service path identifier corresponding to the service chain with a local identifier such as a virtual local area network (VLAN). The agentless SN returns the packet to the VEM for forwarding on the VLAN. Because the VLAN corresponds exactly to the service path and service chain, the packet is forwarded directly to the next node in the service chain. This can enable agentless SNs to efficiently provide a service chain for network traffic.

High-efficiency service chaining with agentless service nodes

Techniques are provided to decouple service chain structure from the underlying network forwarding state and allow for data plane learning of service chain forwarding requirements and any association between services function state requirements and the forward and reverse forwarding paths for a service chain. In a network comprising a plurality of network nodes each configured to apply a service function to traffic that passes through the respective network node, a packet is received at a network node. When the network node determines that the service function it applies is stateful, it updates context information in a network service header of the packet to indicate that the service function applied at the network node is stateful and that traffic for a reverse path matching the classification criteria is to be returned to the network node.

Data plane learning of bi-directional service chains

Presented herein are techniques performed in a network comprising a plurality of network nodes each configured to apply one or more service functions to traffic that passes the respective network nodes in a service path. At a network node, an indication is received of a failure or degradation of one or more service functions or applications applied to traffic at the network node. Data descriptive of the failure or degradation is generated. A previous service hop network node at which a service function or application was applied to traffic in the service path is determined. The data descriptive of the failure or degradation is communicated to the previous service hop network node.

Determining the operations performed along a service path/service chain

A method is provided in one example embodiment and includes receiving at a network element a packet including a Network Services Header ('NSH'), in which the NSH includes an Infrastructure ('I') flag and a service path header comprising a Service Index (&#x201c;SI&#x201d;), and a Service Path ID (&#x201c;SPI&#x201d;) and determining whether the I flag is set to a first value. The method further includes, if the I flag is set to the first value, setting the I flag to a second value and forwarding the packet to the service function that corresponds to the SI for processing. The method still further includes, if the I flag is not set to the first value, decrementing the SI and making a forwarding decision based on a new value of the SI and the SPI.

Infrastructure-exclusive service forwarding

A method is provided in one example embodiment and includes receiving at a network element a packet associated with a flow and determining whether a flow cache of the network element includes an entry for the flow indicating a classification for the flow. The method further includes, if the network element flow cache does not include an entry for the flow, punting the packet over a default path to a classifying service function, in which the classifying service function classifies the flow and determines a control plane service function for handling the flow, and receiving from the classifying service function a service path identifier ('SPI') of a service path leading to the determined control plane service function. The flow is subsequently offloaded from the classifying service function to the network element.

Multi-mobile core networks and value-added services

Particular embodiments described herein provide for a communication system that can be configured for receiving, at a network element, a flow offload decision for a first service node. The flow offload decision can include a portion of a service chain for processing a flow and updating next hop flow based routing information for the flow. A next hop in the flow can insert flow specific route information in its routing tables to bypass a packet forwarder serving the service that offloaded the flow in the reverse direction.

Leaking routes in a service chain

A first virtual machine is established in a virtual private service chain to provide a first network service to virtual private service chain traffic. A second virtual machine is also established the virtual private service chain to provide a second network service to the virtual private service chain traffic. The virtual private service chain traffic is encrypted for transmission within the virtual private service chain from the first virtual machine to the second virtual machine, wherein the encryption uses a key shared by the first and second virtual machines.

End-to-end security for virtual private service chains

In one embodiment, a method includes receiving a packet associated with a flow at a network device, classifying the packet at the network device based on information received from a policy layer, inserting a Network Address Translation (NAT) indicator for the flow into the packet, and transmitting the packet in a service chain comprising network address translation. The NAT indicator is associated with the flows before and after network address translation to provide symmetry between the service chain and a return traffic service chain. An apparatus and logic are also disclosed herein.

Dynamic service chain with network address translation detection

Growing community of inventors

San Ramon, CA, United States of America

Surendra M Kumar