Cisco Technology, Inc.

Vinay Prabhu

Sarah Adelaide Evans

Suraj Rangaswamy

Vamsidhar Valluri

Jigar Dinesh Parekh

Anand K Oswal

Praveen Raju Kariyanahalli

Saravanan Radhakrishnan

Atif Khan

Mosaddaq Hussain Turabi

Manan Shah

Shreyas Udayashankar Heranjal

Santosh Ramrao Patil

Sandeep Bajaj

Ashish Shendure

Sanalkumar Thekkanath

Pranav Narasimmaraj

Vandhana Somaskanthan

Mohil Khare

Kapil Dev

Gino John

Anvesh Reddy Podduturi

Shreyas Heranjal

Parth Sanjiv Doshi

Mohit Aggarwal

Neha Malhotra

Renuka Mohan Channapatna

Huayu Fu

Pradeep Budanuru Kenche Gowda

Farqad Moshili

Systems and methods provide for synergistic domain name system DNS security updates for an enterprise network operating under a Software Defined Wide Area Network (SD-WAN). A system may be configured to collect positive and/or negative unified threat defense (UTD) results, deploy a rules-based model that, when a threat or clearance is detected across several SD-WAN edge network devices, triggers an update to a local security blacklist/whitelist, wherein the update comprises a signature, and push the update to other devices that have not yet seen the threat or clearance.

Synergistic DNS security update

Systems and methods provide for provisioning a dynamic intent-based firewall. A network controller can generate a master route table for network segments reachable from edge network devices managed by the controller. The controller can receive zone definition information mapping the network segments into zones and Zone-based Firewall (ZFW) policies to apply to traffic between a source and destination zone specified by each ZFW policy. The controller can evaluate a ZFW policy to determine first edge network devices that can reach first network segments mapped to the source zone specified by the ZFW policy, second edge network devices that can reach second network segments mapped to the destination zone specified by the ZFW policy, and routing information (from the route table) between the first network segments, the first and second edge network devices, and the second network segments. The controller can transmit the routing information to the edge network devices.

Dynamic intent-based firewall

Systems, methods, and computer-readable media for scaling a source network. A system may be configured to receive a network configuration for a source network, wherein the source network comprising a plurality of nodes, receive and a scale target for a scaled network, and identify, based on the scale target, one or more selected nodes in the plurality of nodes in the source network for implementing in the scaled network. The system may further be configured to reconfigure data plane parameters and control plane parameters for each node in the one or more selected nodes.

Network scale emulator

The present disclosure is directed to management of migration of SD-WAN solutions in a multi-cloud structure upon detection of a failover event. In one aspect, a method includes monitoring, using virtual bonds of a network orchestration component, clusters of virtual management components of multiple cloud networks, corresponding virtual management components of one of the multiple cloud networks implementing one or more services of a Software-Defined Wide Access Network (SD-WAN) solution; detecting, using the virtual bonds, a failover event at the one of the multiple cloud networks; and identifying, by the virtual bonds, a new destination cloud network to migrate the one or more services of the SD-WAN solution to, from a source cloud network at which the failover event is detected.

Seamless multi-cloud SDWAN distaster recovery using orchestration plane

A method may include identifying an update file for a plurality of nodes; selecting a first set of nodes of the plurality of nodes based on a set of node selection criteria; sending the update file to the first set of nodes via a software-defined network (SDN); receiving a first message from a first node of the first set of nodes indicating that the first node is ready to host the update file; identifying a second node that is connected to the first node responsive to receiving the first message from the first node; sending a first instruction to the second node for the second node to obtain the update file from the first node; receiving a second message from the second node indicating that the second node is ready to host the update file; and adding the second node to the first set of nodes.

Node update in a software-defined network

Systems, methods, and computer-readable media for designing network performance and configuration include determining one or more use cases for a network to be provisioned, based on at least one or more business verticals related to a customer of the network. A data plane scale is determined from the use cases and an initial data plane scale generated using a linear regression on one or more data plane parameters. The data plane parameters include a platform type, feature set, packet size, or software version of the network. A control plane scale is determined from the use cases and an initial control plane scale generated using a linear regression on one or more control plane parameters of the network. The control plane parameters include a platform type, feature set, or software version of the network. The network is provisioned for the data plane scale and the control plane scale.

Tool for network performance design and configuration

Systems, methods, and computer-readable media for predicting policy changes in a network environment through a data serialization language. Running configurations of one or more network devices in a network environment can be collected. Further, a master device template of a new policy for the network environment can be generated through a data serialization language based on the running configurations of the one or more network devices. The master device template can include a directory-based tree structure of a simulated implementation of the new policy in the network environment. Policy changes in the network environment for the new policy can be predicted before implementing the new policy in the network environment based on simulated packet traversal through the directory-based tree structure of the simulated implementation of the policy in the network environment.

Live network sandboxing on a centralized management system

The present technology is directed to an automated end to end network migration process from on-premise to cloud-based management platforms and visa-versa. The disclosed technology describes an enhanced plug and play (PnP) software agent operationally coupled to a device and capable of interacting with a PnP service hosted on a target management platform to thereby initiate the migration process. The PnP service on the target management platform upon receiving a migration request from the device PnP agent, maps the requesting device onto a client profile existing on the target management platform and identifies therefrom the associated default controller for the device. Subsequently, the device is directed to acquire and boot up on a new software image compatible with the target management platform and following a conversion of its existing configuration into a version compatible with the new software image, the device is migrated to the associated default controller.

Seamless automation of network device migration to and from cloud managed systems

A method may include receiving a hub ID configuration preference message from a control device, wherein the hub ID configuration preference message includes an order in which to connect to network hubs that are associated with the hub IDs; selecting the first hub ID from the hub ID configuration preference message based on the first connection priority having a higher priority as compared to the second connection priority; identifying a first set of network hubs that are associated with the first hub ID; establishing a connection with at least one network hub associated with the first hub ID; in response to identifying a triggering event, selecting the second hub ID from the hub ID configuration preference message; identifying a second set of network hubs that are associated with the second hub ID; and establishing a connection with at least one network hub associated with the second hub ID.

Network hub site redundancy and failover

A method and system for managing connections with a distributed control plane is provided. The method includes generating, by a router, a controller identifier (ID) list comprising a plurality of controller group IDs of a plurality of controller groups, wherein one controller group ID uniquely identifies one controller group. The method also includes identifying a first controller group, by the router from the list, with which a connection is to be established. Further, the method includes establishing, by the router, the connection with a controller of the first controller group if at least one of following conditions is met I) the router has not exhausted maximum number of connections, 2) the router has previously had a connection with the controller of the first controller group, and 3) the router has an existing connection with a controller of a second controller group not present in the list.

Method and system for managing control connections with a distributed control plane

A method may include receiving monitor data via the control plane from at least one device of a set of devices in the SDN. The method may further include generating a data model based on a set of SDN parameters and the monitor data. The method may also include determining a change for at least one device of the set of devices in the SDN based on the data model. The method may include generating a policy, based on the change for at least one device of the set of devices in the SDN. The method may further include sending the policy via the control plane to the set of devices in the SDN.

Growing community of inventors

Milpitas, CA, United States of America

Vinay Prabhu