Cisco Technology, Inc.

William Mark Townsley

Pierre Pfister

David Delano Ward

Keyur Patel

Kyle Andrew Donald Mestery

Yoann Desmouceaux

Mark Alan Bakke

Hari Shankar

Luca Martini

Jerome Tollet

Wei Luo

Edward Albert Warnicke

Jon Langemak

Aloys Augustin

Giles Douglas Yorke Heron

Andrew Yourtchenko

Greg Weber

Jeffery Rodd Daviss

Rashmi Garg

Yoann Louis Simon Desmouceaux

Eui Sun Ahn

Zhiyuan Yao

Andre Surcouf

Vincent John Mammoliti

Huw Mandalay Jones

Iain Lockyer

Earl Iii Booth

The present disclosure is directed to network traffic management and load balancing at a cloud-based secure access service accessible to remotely connected user devices. In one example, a cloud-based secure service system includes a network controller configured to receive network traffic from one or more user devices remotely connected to the controller; parse the network traffic into flow data and contextual information associated with the network traffic; determine that the network traffic is to be serviced by a target firewall service at the cloud-based secure service system based on the flow data and the contextual information; and direct the network traffic to the target firewall service to be serviced.

Flow parser and per flow data center utilization in a cloud-based secure access service environment

Load aware load balancing may be provided. Flow duration data associated with a plurality of flows associated with a plurality of servers may be obtained. Then a plurality of queue lengths respectively associated with the plurality of servers may be obtained. Next, a Shortest Expected Delay (SED) score may be determined for each of the plurality of servers based on the flow duration data and the plurality of queue lengths. A flow may then be assigned to a one of the plurality of servers having the lowest SED score.

Layer 4 load aware load balancing

Techniques for routing Internet Protocol security (IPsec) data packets. An index is assigned to a Security Parameter Index (SPI) header of the IPsec data packet. The index includes information for routing the data packet to a particular Encapsulating Security Payload (ESP) processor. The data packet can be routed using techniques that are analogous to conventional routing protocols such as IPv4 routing protocol. This allows the data packet to be routed using less expensive routing protocols rather than relying solely on more expensive load balancing techniques to route the data packet. This also advantageously allows the data packet to be routed employing routing techniques developed over decades of routing protocol development.

Internet protocol security and security parameter index summarization and data routing

This disclosure describes methods and systems to externally manage network-to-network interconnect configuration data in conjunction with a centralized database subsystem. An example of the methods includes receiving and storing, in the centralized database subsystem, data indicative of user intent to interconnect at least a first network and a second network. The example method further includes, based at least in part on the data indicative of user intent, determining and storing, in the centralized database subsystem, a network intent that corresponds to the user intent. The example method further includes providing data indicative of the network intent from the centralized database subsystem to a first data plane adaptor, associated with the first network, and a second data plane adaptor, associated with the second network.

Method and system for managing network-to-network interconnection

Techniques for a hub node to, provisioned in a network site of a hub and spoke overlay network, to receive a network advertisement from the spoke, decode network routing requirements from a border gateway protocol (BGP) large community associated with the network advertisement, and store the network routing requirements in association with a route associated with the spoke. The routing requirements may indicate one or more service(s) to be applied to the packet, a trust level associated with the spoke, and/or a trust zone associated with the spoke. The hub node may receive a packet from the spoke to be transmitted to destination spoke. The hub node may then route the packet to the destination spoke, drop the packet, or send the packet to a service node configured to apply the one or more services to the packet based on the routing requirements.

Marking spoke links for network segregation and service chaining in hub and spoke overlay networks

Growing community of inventors

San Francisco, CA, United States of America

William Mark Townsley