Cisco Technology, Inc.

Pensando Systems Inc.

Alcatel Lucent

Alcatel-lucent USA Inc.

Vipin Jain

Shyam N Kapadia

Nilesh Shah

Dhananjaya Rao

Suran Saminda De Silva

Ashutosh Agrawal

Mahidas Prabhanjan

Enrico Schiattarella

Raghava Kodigenahalli Sivaramu

Sukhesh Halemane

Parag Bhide

Pirabhu Raman

Vijay Sampath

Yibin Yang

Varagur Chandrasekaran

Anil Lohiya

Shrey Ajmera

Alok Rathore

Pei-chun Cheng

Vijay Gopal Krishnan

Sameer Kittur

Michael Brian Galles

Swaminathan Narayanan

Govind Prasad Sharma

Chiajen Tsai

Balakrishnan Raman

Venkatesh Srinivasan

Padmanabhan Krishnan

Ravi Kumar Gadde

Palathingal Frank

Debashis Patnala Rao

Hrishikesh Narasimhan

Herman Levenson

Maruthi Ram Namburu

Shriram Srinivasan

Akshaya Nadahalli

Mark Q Llacuna

John Cruz

Srividya Vemulakonda

David Antony Clear

William R Long

Puto H Subagio

Deepa Seshadri

Chandrasekaran Swaminathan

A method is provided in one example embodiment and includes creating a segment organization, which includes a configuration profile. The method also includes attaching the configuration profile to a server in the segment organization. The method further includes sending the attached configuration profile to a database in a physical network.

Physical network orchestration for data centers

Network appliances can record log entries in log objects. An object store can receive the log objects and can use the log objects to create index objects and flow log objects. Each flow log object and index object can be associated with a time period wherein the flow log object includes flow log entries received during that time period. The index object includes shard tables that can be stored in different nonvolatile memories and can thereby be concurrently searched. Shard entries in the shard tables indicate flow entry indicators. The flow entry indicators indicate log entries in the flow log object. An internally indexed searchable object can include the flow log object and the index object. Numerous indexed fields in the flow log entries and can be indexed with each indexed field searchable via the shard entries.

Methods and systems for flow logs using an internally indexed searchable object

Synchronizing the databases maintained by network appliances can support high availability or high throughput topologies, but also consumes the devices' processing resources. To address that resource consumption, the network appliance's packet processing pipeline circuits can process synchronization packets to thereby synchronize the databases. A local data structure can be in a first local state. Processing a network packet can result in changing the local data structure to a second local state. A state sync packet can include state transition data that indicates a state difference between the first local state and the second local state. The state sync packet can be sent to a peer device that is configured to process the state transition data using the peer device's packet processing pipeline circuit. The peer device's packet processing pipeline can use the state transition data to update a peer device data structure that is in the peer device.

Methods and systems for distributed high speed state synchronization

Methods and network interface devices for establishing a secure and authenticated network connection are provided. The method comprises: receiving, from a requesting entity, a destination IP address and a first certificate that is used to establish a secure network connection, wherein the first certificate comprises a first security attribute that is associated with a source destination IP address; identifying, with aid of one or more processors, a stored second security attribute associated with the destination IP address; and determining, with aid of the one or more processors, a policy action based at least in part on the first security attribute and the second security attribute.

Methods and systems for cryptographic identity based network microsegmentation

A network appliance can have an input port that can receive network packets at line rate, two or more ingress queues, a line rate classification circuit that can place the network packets on the ingress queues at the line rate, a packet buffer that can store the network packets, and a sub line rate packet processing circuit that can process the network packets that are stored in the packet buffer. The line rate classification circuit can place a network packet on one of the ingress queues based on the network packet's packet contents. A buffer scheduler can select network packets for processing by a sub line rate packet processing circuit based on the priority levels of the ingress queues.

Methods and systems for line rate packet classifiers for presorting network packets onto ingress queues

Methods and systems for implementing security operations in an input/output (I/O) device are disclosed. In an embodiment, an I/O (Input/Output) device involves an I/O port, a host bus configured to be connected to a host, a data processing pipeline within the I/O device coupled to the I/O port and to the host bus to process and forward data between the I/O port and the host bus, and a hardware security module (HSM) within the I/O device coupled to the host bus and to the data processing pipeline, the HSM comprising a crypto engine configured to encrypt and decrypt data of the data processing pipeline, and a secure key storage coupled to the crypto engine containing encryption keys for use in encrypting and decrypting packets, wherein the secure key storage contains keys that are encrypted by the HSM and that are accessible through the HSM.

Method and system for implementing security operations in an input/output device

Methods and systems for a network flow log database

Described are platforms, systems, and methods for actuating transmission control protocol/Internet protocol (TCP/IP) through a method comprises: identifying a computer workload during a handshake process for establishing a network connection with a remote host; configuring, based on the computer workload, one or more TCP/IP parameters of the network connection; and completing the handshake process to establish the network connection with the remote host.

Application aware TCP performance tuning on hardware accelerated TCP proxy services

Described are platforms, systems, and methods for providing an in-line, transparent Transmission Control Protocol (TCP)/Transport Layer Security (TLS) proxy. In one aspect, a programmable input output (IO) device comprises at least one advanced reduced instruction set computer (RISC) machine (ARM) core communicably coupled to at least one central processing unit (CPU) core of a host device; a programmable P4 pipeline comprising a cryptographic offload subsystem; and a memory unit. The programmable IO device executing instruction stored on the memory unit comprising: establishing a session for an incoming TCP connection received from a remote host via the at least one ARM core; processing data packets received from the remote host via the programmable P4 pipeline; decrypting the received data packets via the cryptographic offload subsystem; and providing the decrypted data packets to the host device.

Proxy service through hardware acceleration using an IO device

A network appliance having a control plane and a data plane can process substantially every input packet at wire speed in a programmable packet processing pipeline of the data plane. Sensors, which can be processes implemented within the pipeline, can measure parameters of the network traffic flows and of the network appliance in accordance with monitoring policies. Reporting policies can be triggered when any one of many criteria are met by the parameters. The reporting policy can result in a report being sent to an outside recipient. Alternatively, the reporting policy can result in the network appliance implementing additional monitoring or reporting policies.

Methods and systems for smart sensor implementation within a network appliance data plane

A network appliance can maintain an active set indicating active backends for a load balanced network service. To monitor the health of the backends, the network appliance can transmit a network packet to a backend that is one of the active backends in the active set and can receive a response packet responsive to the network packet. An invariant hash can be calculated from the response packet using fields that are the same when the response is a normal response (e.g. not an error response) from a healthy backend. If the packet indicates an error or is otherwise indicative of a problem, the network appliance can determine, using the invariant hash, that the response packet does not match an expected result associated with the backend. Based on the error, the number of network packets resulting in errors, etc., the backend can be removed from the active set.

Methods and systems for accelerated health monitoring for load balancers

An authorization method using provisioned certificates is disclosed. The method includes writing security attributes to fields within a certificate and issuing the certificate to a software application on a principal node. The software application requests to perform actions on one or more resources on a resource node, sending one or more action requests along with a copy of its certificate. The resource node has an agent which verifies the permissions from the certificate and routes the request to its designated resource. The resource node returns one or more messages to the principal node, verifying whether or not complete the requests.

Authorization with a preloaded certificate

Techniques are presented herein for distributing address information of host devices in a network. At a first router device, a packet is received from a first host device that is destined for a second host device. The first host device is dually-connected to the first router and a second router device. The second router device is part of a virtual port channel pair with the first router device. A message is sent to the second router device, the message indicating that the first host device is connected to the second router device. The packet is encapsulated with an overlay header and is sent to a third router device that is connected to the second host device. The encapsulated packet contains a Layer 2 address associated with the first host device and a Layer 3 address associated with the first host device.

Using a virtual internet protocol address to represent dually connected hosts in an internet protocol overlay network

Growing community of inventors

San Jose, CA, United States of America

Vipin Jain