Cisco Technology, Inc.

Cumulus Networks Inc.

Wilson Kok

Michael Fine

Padmanabha Nallur

Michael R Smith

Shrijeet Subhabrata Mukherjee

Sameer Merchant

Roopa Prabhu

Fabio Rodolfo Maino

James P Rivers

Andrew Richard Harding

Rajesh Bhandari

Irene H Kuffel

Jed Lin Lau

Identity information is decoupled from reachability information in packets transferred between hosts of a computer network by replacing forwarding information within said packets with an identifier having a format of the forwarding information, and applying forwarding labels, derived from the identifiers, which are then used in lieu of the forwarding information for conveying the packets within the network. During such conveyance, the packets are treated according to one or more policies prescribed on a basis of the identifier, which may be an IPv6 address. The forwarding labels may be MPLS labels.

Methods and systems for flow virtualization and visibility

To accommodate graceful offloading of connections from a port of a network element, thereby allowing the port to be decommissioned, both existing and new connections allocated to that port according to a load balancing protocol are replicated on a backup port. Thereafter, or concurrently therewith, the port is configured to drop acknowledgements of the new connections, and the port is monitored so as to eventually identify an absence of connections thereon. At that time, the port may be decommissioned inasmuch as all new connections will have been established on the backup port and no previously existing connections on the original port will remain.

Flow based session drain director

A method and system for including security information with a packet is disclosed. A packet is detected as it exits a first network and enters a second network. The first network is configured to support a network security technique, and the second network is not configured to support the network security technique. Network security information associated with the network security technique is included with the packet. A network device is configured to include network security information in overhead of a packet. A method for identifying a first network device in a network is also disclosed. Identification information of the first network is communicated to a second network device.

Method and system for including security information with a packet

Techniques for selecting authentication roles when establishing a link between devices in a secure network are provided. By assigning role levels to devices, devices may be more likely to assume a preferred role when establishing a link. For example, during a negotiation process, each device may establish a timer value based on their role level. Each device may initiate a timer with the timer value and, the device whose timer value expires first may assume a role as authenticator.

Role determination for network devices

Various systems and method are disclosed for disseminating security server contact information in a network. For example, one method (e.g., performed by a security server) involves determining that a network device is a secure network device, in response to participating in a security exchange with the network device; and then sending a server list to the network device. The server list includes the network address of at least one security server. Another method (e.g., performed by a network device) involves initiating an authentication exchange; receiving a server list, which includes the network address of a security server, as part of the authentication exchange; and communicating with the security server by sending a packet to the network address included in the server list.

Method and apparatus for securely disseminating security server contact information in a network

Various methods and systems for dynamically determining the role of a network device in a link authentication protocol exchange are disclosed. In one embodiment, such a method involves monitoring several (e.g., two) link authentication protocol exchanges. These link authentication protocol exchanges can be initiated at substantially the same time. A first network device acts as an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges. One of the link authentication protocol exchanges is terminated prior to completion.

Growing community of inventors

San Jose, CA, United States of America

Wilson Kok