Cisco Technology, Inc.

Palo Alto Networks, Inc.

Yegappan Lakshmanan

Sabita Jasty

Kaushik Pratap Biswas

Yanping Qu

Anand K Oswal

Fabio Rodolfo Maino

Balaji Sundararajan

Alberto Rodriguez Natal

Keith Neil Mark Dsouza

Madhusudana Rao Kata

Rohit Jindal

Nagaraj Arunkumar

Krishna Mohan Menon

Virajitha Karnatapu

Brian Richard Sarbin

Michael Francis O'Gorman

Michael Yeung

Simon James Trevor Spraggs

Andrew Persaud

Andrew Phillips

Atulya Chandra

Lang Zhang

Ramesh Pavadai

Joe Sutton

Vinay Singla

A host with a firewall and an offload device can be configured/programmed to balance security and cost. Services are instantiated on the firewall and on the offload device. The service on the firewall maintains data for offloaded flows that indicate the next-hops for the offloaded flows when offloaded. The service on the offload device periodically copies samples from offloaded flows and communicates the samples to the service on the firewall. The service on the firewall determines a next-hop for the copied samples according to the firewall's routing information. If the determined next-hop has changed from what is indicated in the offloaded flows data, then the service on the firewall updates the offloaded flows data and communicates the next-hop change to the service on the offload device which causes an update to the flow table on the offload device for relevant offloaded flows.

Route adaptive intelligent traffic offloading

Techniques for providing network traffic security in a virtualized environment are described. A threat aware controller uses a threat feed provided by a threat intelligence service to establish a threat detection engine on virtual switches. The threat aware controller and threat detection engine work together to detect any anomalous or malicious behavior of network traffic on the virtual switch and established virtual network functions to quickly detect, verify, and isolate network threats.

Virtual switch-based threat defense for networks with multiple virtual network functions

Systems, methods, and computer-readable media for requesting a cellular IP address by initiating a call with a modem, establishing data packet network connectivity with the cellular IP address, assigning the cellular IP address to a virtual L2-bridge interface, wherein the virtual L2-bridge interface includes a MAC address, mapping a MAC address of a virtual machine with the MAC address of the virtual L2-bridge interface, detecting a change in the cellular IP address, and updating the virtual L2-bridge interface with a different cellular IP address while maintaining the data packet network connectivity.

Dynamic cellular connectivity between the hypervisors and virtual machines

A virtual machine management service obtains a request to instantiate a virtual machine image (VMI) to implement a virtual network function (VNF). The request specifies a set of processor requirements corresponding to instantiation of the VMI. In response to the request, the service identifies, from a server comprising a set of processor cores, available processor capacity. The service determines, based on the available processor capacity and the set of processor requirements, whether to instantiate the VMI on to a subset of processor cores of the server. Based on this determination, the service instantiates the VMI on to the subset of processor cores to implement the VNF.

Computing resource allocation for virtual network functions

An elastic Internet Protocol (IP) address for hypervisor and virtual router management in a branch environment may be provided. First, an IP address may be assigned to a hypervisor associated with a virtual branch. Next, it may be determined that a virtual machine (VM) has been instantiated at the virtual branch. In response to determining that the VM has been instantiated at the virtual branch, the IP address may then be released. It may next be determined that the VM is in a failed state and then, in response to determining that the VM is in the failed state, the IP address may be reassigned to the hypervisor.

Elastic internet protocol (IP) address for hypervisor and virtual router management in a branch environment

An emulator module integrated with a hypervisor executes on a host computer having a physical network interface card (pNIC). The hypervisor hosts a virtual machine having a virtual NIC (vNIC). The pNIC has pNIC receive pointers to point to receive packets loaded into a receive buffer by the pNIC. The vNIC has vNIC receive pointers for retrieval of the receive packets from the receive buffer. The emulator module accesses a pNIC receive pointer in the pNIC that points to the receive packet loaded into the receive buffer by the pNIC, and maps a vNIC receive pointer to the pNIC receive pointer accessed by the emulator module, to enable the vNIC to retrieve the receive packet from the receive buffer using the vNIC receive pointer. The emulator module notifies the vNIC to retrieve the receive packet from the receive buffer.

Shim layer used with a virtual machine virtual NIC and a hardware platform physical NIC

A device is configured to support one or more virtual networking functions at a branch in a network. The device receives from a central control entity a command to deploy a particular virtual networking function, the command including or accompanied by a deployment file that identifies an external port at which the particular virtual networking function is accessed externally at the device. The device maps the external port to an internal port on an internal management network of the device, and stores a portmapping entry for the particular virtual networking function based on the mapping. The device sends to the central control entity a notification containing portmapping information that indicates the internal port to which the external port is mapped.

Addressing and managing an internal network of a virtual branch node

Growing community of inventors

Union City, CA, United States of America

Yegappan Lakshmanan