Hewlett Packard Enterprise Development LP

Hewlett-packard Development Company, L.p.

Venkatavaradhan Devarajan

Vinayak Joshi

Tathagata Nandy

Anil Raj

Anoop Govindan Nair

Saumya Dikshit

Balaji Sankaran

Rajib Majila

Vijay Kannan

Rangaprasad Sampath

Chivukula Koundinya

Vijeesh Erankotte Panayamthatta

Mithun Kumar Halder

Suresh Kumar Reddy Beeram

Duane Edward Mentze

Craig Joseph Mills

Ravindra Guntur

Anand Eswaran

Celestian K Sebastian

Chethan Chavadibagilu Radhakrishnabhat

Jechun Chiu

Karthikeyan Ramachandran

Saurabh Mohan

Subin Cyriac Mathew

Sivakumar Murugan

Haris Palapra

Sivasankaran Nagarajan

Guru Gurram Janardhan

Venkatachalam Swaminathan

Rajeev Jain

Ram Iakhan Patel

Ram Prasad Allu Ram

Vamsi Krishna Devaki

Yasser Salim Sait

Jagmeet Singh Hanspal

Mamata Hegde

Chetan Ambi

Allu Ramaprasad

Gudiputi Suma Chowdary

Prasad Moola Mangalam

Pavankumar Kulkarni

Viswanath Reddy Bayapureddy

Prasanth Gopinathan Nair Saraswathy Amma

Gopinatha Rao P

A network management system (NMS) for provisioning and managing an overlay network is provided. During operation, the NMS can determine that a loop associated with a media access control (MAC) address is detected in the network. The NMS can probe a first switch in the loop by instructing the first switch to observe the MAC address for a predetermined period. The NMS can receive a first message indicating a first set of ports of the first switch observing the MAC address. The NMS can probe an upstream switch reachable via each of the first set of ports by instructing the upstream switch to observe the MAC address for the predetermined period. Here, observing the MAC address at an upstream port of the upstream switch causes further upstream probing. Based on probing the switches in the loop, the NMS can determine one or more loop origination points (LOPs) for the loop.

Identifying loop-origination points in an overlay network

A system for facilitating loop-free traffic forwarding is provided. During operation, the system can operate a switch as a tunnel endpoint for a plurality of tunnels with corresponding remote endpoints. The system can determine a tunnel network identifier (TNI) associated with a respective virtual local area network (VLAN) configured at the switch. The system can then enable the TNI for a first tunnel among the plurality of tunnels for carrying traffic of the VLAN. Here, traffic of the VLAN is only forwarded over the first tunnel. Therefore, the system can prevent the rest of the plurality of tunnels from looping the traffic of the VLAN back to the switch. The system can select a second tunnel as a standby tunnel for the TNI from the rest of the plurality of tunnels. If the first tunnel is unavailable, the system can enable the TNI for the second tunnel for traffic forwarding.

Active tunnel selection for facilitating loop-free layer-2 traffic forwarding in an overlay network

A system for providing fast multicast convergence for Precision Time Protocol (PTP) at a switch is provided. During operation, the system can receive a multicast control message based on a multicast protocol used for PTP from a respective neighbor switch. The multicast control message can indicate neighbor information associated with the multicast protocol. The system can then determine a role associated with the PTP for a remote switch from the control message. Upon receiving a register message for a multicast group associated with the PTP, the system can determine whether a multicast path from the switch to a PTP source includes a device with a role of a boundary clock (BC) of PTP. If the multicast path includes a device with a role of a BC, the system can send a gratuitous register-stop message for the multicast group toward the PTP source in absence of a native path.

Fast multicast convergence for time synchronization in a network

A system for facilitating traffic redirection for a multi-chassis link aggregation group (MCLAG) is provided. During operation, the system can participate in an MCLAG using a first interface of a first switch. The MCLAG can also include a second interface of a second switch. Based on predetermined unavailability for the first switch, the system can determine a sequence of applications for a plurality of traffic forwarding configurations. A respective configuration can facilitate loop prevention for traffic forwarded via the MCLAG. The system can then apply the plurality of configurations to the first switch based on the sequence of applications to redirect unicast traffic from the first switch to the second switch. Here, applying a respective configuration can include programming corresponding switch hardware with the configuration. Subsequently, the system can perform a set of operations on the first switch that triggers the predetermined unavailability.

Efficient traffic redirection for an MCLAG for controlled unavailability events

In an example, a network device may receive, from a client device, a multicast query for a service advertised by a host device connected to another network device. The network device is configured as a first Virtual tunnel endpoint (VTEP) and the other network device is configured as a second VTEP in an overlay network. The network device may determine whether a host name, of the host device, corresponding to the service name in the multicast query is present in a resource record. In response to determining that the host name is present in the resource record, the network device may identify, from the resource record, an overlay network path corresponding to the host name. The network device may encapsulate the multicast query based on an overlay encapsulation protocol implemented at the first VTEP and route, the encapsulated multicast query, via the overlay network path, to the host device.

Service discovery across tunnel endpoints in overlays

A system for policy management in a switch is provided. During operation, the system can generate, from a first policy defined for the switch, a second policy. The first policy can indicate whether a type of traffic is allowed from a source role to a destination role via an overlay tunnel. The second policy can indicate a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel. Upon identifying a host associated with a role at a port of the switch, the system can determine whether the role belongs to the plurality of destination roles based on the second policy. If the role belongs to the plurality of allowed destination roles, the system can allow the port to forward a multi-destination packet, which is received via the overlay tunnel and associated with the type of traffic.

Policy enforcement on multi-destination packets in a distributed tunnel fabric

In an example, a switch may receive an authentication request from a host associated with a first wireless access point (WAP) connected to the switch. The switch acts as a VXLAN Tunnel Endpoint (VTEP) in a Border Gateway Protocol (BGP) Ethernet Virtual Private Network (EVPN) based Virtual Extensible Local Area Network (VXLAN). The switch forwards the authentication request to an authentication server and on successful authentication of the host, may associate a role information with the host based on an authentication response from the authentication server. Further, the switch may create a BGP extended community field carrying the role identifier indicative of network policies to be implemented for the host and attach the BGP extended community field with a route advertisement. The switch then sends the route advertisement to another switch. The another switch is configured as a peer VTEP in the VXLAN. The switch and the another switch is configured in a single Virtual Local Area Network (VLAN).

Role information propagation in access switches

In an example, a failure event is detected in a network, where the failure event is indicative of a network outage in a network device or a peer network device of an MC-LAG. The network device and the peer network device may be configured as a first VTEP in an overlay network. It may be determined that reprovisioning of virtual tunnels in the network device is incomplete. State parameters between the network device and the peer network device is synchronized. The set of virtual tunnels in the network device is provisioned based on the state parameters. After completion of provisioning of the virtual tunnels, an IP address of the first VTEP is published to underlay network devices connecting the first VTEP to a second VTEP over an underlay network. Subsequently, communication links between the MC-LAG and a host device is enabled.

Failure detection and mitigation in an MC-LAG environment

Examples disclosed herein relate to a method for defining an ingress access policy at an ingress network device based on instructions from an egress network device. The egress network device receives data packets directed to a first entity from a second entity connected to an ingress network device. Each data packet transmitted includes a source role tag corresponding to the second entity. At the egress network device, the data packets may be dropped based on the enforcement of an egress access policy. When the number of data packets that are being dropped increases beyond a pre-defined threshold, the egress network device transmits a command to the ingress network device instructing the ingress network device to create a restriction on the transmission of subsequent data packets. The command is transmitted in a Border Gateway Protocol (BGP) Flow Specification (FlowSpec) route.

Enabling restriction on transmission of data packets at ingress network device

An apparatus for detecting a loop in a domain comprising a plurality of overlay tunnel fabrics is provided. The apparatus can include an indicator logic block that can insert a predetermined value, which can be unique for the apparatus in the domain, into an egress tunnel header of a packet of a data flow. The header's destination address can correspond to a remote apparatus of an overlay tunnel fabric that includes the apparatus. Tunnel encapsulation can be initiated and terminated within the corresponding overlay tunnel fabric. The indicator logic block can determine, for a respective packet of the data flow from a remote overlay tunnel fabric of the domain, whether the predetermined value is present in an ingress tunnel header. Upon identifying the predetermining value in the ingress tunnel header, a loop logic block of the apparatus can determine that a loop is present in the domain.

Loop detection in a complex topology with multiple distributed tunnel fabrics

A first ingress interface on a switch receives a first control packet for establishing a Transmission Control Protocol (TCP) session and selects a first engine running on a first line card in the switch. A second ingress interface receives a second control packet and selects the same first engine. Data associated with the TCP session received by the first or second ingress interface subsequent to establishing the TCP session is to be forwarded to the first engine. The first ingress interface receives a third control packet and sends, to the selected first engine, a notification indicating the TCP session which is to be tracked. The first or second ingress interface receives a fourth packet with a payload associated with the TCP session and forwards, to the selected first engine, a copy of the fourth packet, thereby facilitating a plurality of engine instances to support application identification.

Asymmetric application identification detection on switches

A member switch of multiple connected switches receives a stack-discovery packet from a first coupled switch and, in response, generates and transmits a stack-discovery-response packet to the first coupled switch to allow the member switch to be discovered. The member switch receives stack-configuration information from a stack-control node and forwards the stack-discovery packet to a second coupled switch to facilitate discovery of the second coupled switch. The first coupled switch, the member switch, and the second coupled switch are coupled to each other according to a predetermined order, thereby facilitating an ordered discovery of the multiple connected switches. In response to receiving, from the stack-control node, a control packet, the member switch reboots based on the received stack-configuration information. The stack-configuration information comprises a stack-member identifier allocated, based on the predetermined order, by the stack-control mode to the member switch, thereby facilitating formation of an ordered stack.

Ordered stack formation with reduced manual intervention

In an example, a wired network device receives a first join message originating from a client device associated with a first wireless access point (WAP) connected to another wired network device in a broadcast domain. An entry corresponding to the client device is created in a remote receiver record of the wired network device. In response to the client device transitioning from the first WAP to a second WAP connected to the wired network device, it is determined that the client device is locally connected to the wired network device. Intention of the client device to receive multicast traffic is identified. A second join message directed to the network address of the multicast group and distributed in the broadcast domain. A traffic flow path for the multicast traffic via the wired network device and the second WAP to the client device is configured.

Seamless mobility for clients receiving multicast traffic

Examples disclosed herein relate to performing a software update on a network device forming a MC-LAG. In an example, a software update onto a first network device and a second network device may be downloaded. The first network device and the second network device may form a MC-LAG that may provide a redundant connectivity to a network device in a network. A shutdown of routing protocols on the first network device may be performed. Each of the routing protocols may advertise a maximum metric on the first network device, leading to a recalculation of network routes by the network device. The first network device may be updated with the software update. Until the software update on the first network device is complete, network traffic on the network may be routed through the second network device.

Software update on a network device forming a multi-chassis link aggregation group (MC-LAG)

A system for dynamically activating a virtual network is provided. During operation, the system can operate a switch as a tunnel endpoint of a tunnel in conjunction with a remote switch. The tunnel can facilitate a virtual private network (VPN) spanning the switch and the remote switch. The system can maintain an inactive state for a virtual local area network (VLAN) and a corresponding tunnel network identifier identifying the VLAN for the tunnel. If a notification indicating the activation of the VLAN at a downstream switch is received by the switch, the system can activate the VLAN at the switch. The system can then activate the tunnel network identifier in a routing process of the VPN, thereby enabling sharing of a media access control (MAC) address associated with the VLAN via the tunnel.

Method and system for dynamically activating virtual networks in a distributed tunnel fabric

Growing community of inventors

Bengaluru, India

Venkatavaradhan Devarajan