Cisco Technology, Inc.

Vina Ermagan

Fabio Rodolfo Maino

Sateesh Kumar Addepalli

Alberto Rodriguez Natal

Pere Monclus

Lillian Lei Dai

Flavio Giovanni Bonomi

Preethi Natarajan

Sanjay Kumar Hooda

Victor Manuel Moreno

Marc Portoles Comeras

Johnson Leong

Alexander Loukissas

Brian Eliot Weis

Paul M Quinn

Rong Pan

Xiaoqing Zhu

Raghuram S Sudhaakar

John William Evans

Jesus Arango

Abhijit Patra

Nagaraj Bagepalli

Dileep Kumar Devireddy

Surendra M Kumar

Syed Khalid Raza

Atul Mahamuni

Atri Indiresan

Reshad Rahman

John Martin Graybeal

Ashok Krishnaji Moghe

Sudarshana Kandachar Sridhara Rao

Rodolfo Alberto Milito

Suraj Nellikar

Darrel Jay Lewis

Valentina Alaria

Mosaddaq Hussain Turabi

Horia Miclea

Kevin C Lee

Landon Curt Noll

Christopher Spain

Christian Ibars Casas

Erick D Lee

Marius Horia Miclea

Alberto Cabellos Aparicio

Massimiliano Menarini

Florin T Coras

In one illustrative example, network fabric policy data associated with an application, subscriber, and/or device may be received. Mobile network policy data that corresponds to the received network fabric policy data may be selected, based on stored policy mappings between a set of network fabric policy profiles of a fabric network and a set of mobile network policy profiles of a mobile network. A bearer or Quality of Service (QoS) flow of the mobile network may be established in satisfaction of the selected mobile network policy data. In addition, a packet filter of a traffic flow template (TFT) or a packet detection rule (PDR) may be generated and applied in order to direct IP traffic flows associated with the application to the established bearer or QoS flow for communication in the mobile network.

Enterprise network fabric extension across mobile networks

An ingress network element obtains data from a source endpoint associated with the ingress network element. The data identifies a destination endpoint remote from the ingress network element. The ingress network element provides a map request identifying the destination endpoint to a mapping server. The ingress network element obtains a map reply including a network address of an egress network element associated with the destination endpoint and a security association. The ingress network element encrypts the data for the destination endpoint with the security association according to a cryptographic policy based on the source endpoint, the destination endpoint, and the availability of cryptographic resources on the network. The ingress network element provides the encrypted data to the egress network element.

On-demand security association management

A method and a router device for managing memory for network overlay routes with fallback route support prioritization may be provided. A network overlay route as a candidate network overlay route may be obtained at a router for storage in a memory. The memory may store a plurality of network overlay routes for forwarding user plane traffic in a network. An assessment for storage of the candidate network overlay route based on a priority level indicator of the candidate network overlay route may be performed. The priority level indicator may be indicative of a fallback route support level of the candidate network overlay route in the router. Based on the assessment, at least one of the following may be performed: adding the candidate network overlay route to the memory and refraining from adding the candidate network overlay route to the memory.

Router methods and apparatus for managing memory for network overlay routes with fallback route support prioritization

A Location/Identifier Separation Protocol (LISP) mapping server, including: a network interface for communicating with a LISP-enabled network; a mapping database; a subscription database; and an overlapping subscription publication engine (OSPE) to: receive a first mapping of a first subnetwork to a first routing locator (RLOC); add the first mapping to the mapping database; receive from a first ingress tunnel router (ITR) a subscription request for an endpoint identifier (EID) within the first subnetwork; add to a first subscription entry for the first subnetwork in the subscription database a subscription for the first ITR; receive a second mapping of a second subnetwork to a second RLOC, wherein the second subnetwork overlaps the first subnetwork; add the second mapping to the mapping database; and copy at least part of the first subscription entry to a second subscription entry for the second subnetwork.

Stateful LISP subscription for overlapping subnetworks

A method is performed by an access router of an enterprise network including a first edge router to communicate with a second edge router over a wide area network (WAN). The method includes receiving a packet from a first endpoint, receiving from a mapping service a network location of a second edge router for which the packet is destined and a security association (SA) to encrypt the packet from the access router to the second edge router, and generating for the first edge router one or more path selectors for WAN path selection. The method includes encrypting the packet using the SA, and adding to the encrypted IP packet, in clear text, the path selectors and outer encapsulation including the network location, to produce an encrypted tunnel packet. The method also includes forwarding the encrypted tunnel packet to the second edge router via the first edge router and the WAN.

Secure WAN path selection at campus fabric edge

A method in one embodiment includes intercepting a message in an on-board unit (OBU) of a vehicular network environment between a source and a receiver in the vehicular network environment, verifying the message is sent from the source, verifying the message is not altered, evaluating a set of source flow control policies associated with the source, and blocking the message if the set of source flow control policies indicate the message is not permitted. In specific embodiments, the message is not permitted if a level of access assigned to the source in the set of source flow control policies does not match a level of access tagged on the message. In further embodiments, the method includes evaluating a set of receiver flow control policies associated with the receiver, and blocking the message if the set of receiver flow control policies indicates the message is not permitted.

System and method for wireless interface selection and for communication and access control of subsystems, devices, and data in a vehicular environment

Technologies are provided in example embodiments for associating a subscriber list to mapping data of a virtual machine, adding subscriber information of a network device to the subscriber list when a map request for the mapping data is received from the network device, and purging the subscriber information from the subscriber list when a preconfigured time period assigned to the subscriber information expires. In particular embodiments, the subscriber information includes an identification of the network device and the mapping data includes a virtual address of the virtual machine mapped to a physical address of the virtual machine. More specific embodiments include sending a notification signal with new mapping data of the virtual machine to each one of one or more network devices identified in corresponding subscriber information stored in the subscriber list. In further specific embodiments, the network device is either a map server or a map resolver.

Updating distributed caches in network devices in the event of virtual machine changes in a virtualized network environment

A mapping server provisions network elements to optimize the cryptographic resources of a computer network. The mapping server obtains from a source network element, a request for a source endpoint to communicate with a destination endpoint across the computer network. The mapping server determines a cryptographic policy based on the source endpoint, the destination endpoint, and an availability of cryptographic resources on the network elements. The mapping server identifies a destination network element based on the cryptographic policy. The destination network element is associated with the destination endpoint. The mapping server selects a security association based on the cryptographic policy to secure a communication from the source endpoint to the destination endpoint. The security association secures the communication between the source network element and the destination network element. The mapping server provides the security association to the source network element along with a network address of the destination network element.

In one embodiment, a router includes processors and computer-readable non-transitory storage media coupled to the processors including instructions executable by the processors. The router may store at least one virtual prefix and an associated aggregation threshold. The router may register, with a mapping database of an overlay network, ownership of individual prefixes served by the router. The router may determine an amount of prefixes served by the router that are within an address space of the virtual prefix. The router may register, based on a determination that the amount of prefixes satisfies the aggregation threshold, ownership of the virtual prefix with the mapping database of the overlay network. The registration of the virtual prefix may cause ownership of one or more of the registered individual prefixes served by the router that are within the address space of the virtual prefix to be deregistered.

Systems and methods for virtual prefix aggregation in on-demand overlay networks

Systems and methods for automatically executing an efficient longest internet protocol prefix match on non-relational and/or No-SQL databases, such as Cassandra. Clustering prefixes around common and/or standard prefix lengths ensures efficient use of Cassandra's underlying mechanisms and minimizes costly scan operations.

Efficient internet protocol prefix match support on No-SQL and/or non-relational databases

Aspects of the embodiments are directed to systems, methods, and computer program products to program, via a northbound interface, a mapping between an endpoint identifier (EID) and a routing locator (RLOC) directly into a mapping database at a mapping system; receive, from a first tunneling router associated with a first virtual network, a mapping request to a second virtual network, the first router compliant with a Locator/ID Separation Protocol, the mapping request comprising an EID tuple that includes a source identifier and a destination identifier; identify an RLOC based, at least in part, on the destination identifier of the EID tuple from the mapping database; and transmit the RLOC to the first tunneling router implementing an high level policy that has been dynamically resolved into a state of the mapping database.

Systems, methods, and devices for smart mapping and VPN policy enforcement

High-level network policies that represent a virtual private network (VPN) as a high-level policy model are received. The VPN is to provide secure connectivity between connection sites of the VPN based on the high-level network policies. The high-level network policies are translated into low-level device configuration information represented in a network overlay and used for configuring a network underlay that provides the connections sites to the VPN. The network underlay is configured with the device configuration information so that the network underlay implements the VPN in accordance with the high-level policies. It is determined whether the network underlay is operating to direct traffic flows between the connection sites in compliance with the high-level network policies. If it is determined that the network underlay is not operating in compliance, the network underlay is reconfigured with new low-level device configuration information so that the network underlay operates in compliance.

Dynamic VPN policy model with encryption and traffic engineering resolution

In one embodiment, a first device in a network receives application traffic sent from a source device towards a destination address. The first device sends the application traffic to a traffic identification service. The first device receives an instruction to establish a network tunnel to send the application traffic from the source device towards the destination address. The instruction is based on a classification of the application traffic by the traffic identification service. The first device establishes the network tunnel to send the application traffic from the source device towards the destination address.

Application identification and overlay provisioning as a service

Growing community of inventors

San Jose, CA, United States of America

Vina Ermagan