Cisco Technology, Inc.

Yuefeng Jiang

Fang Yang

Xiaopu Zhang

Jiang Yu

Bo Sun

Jeffrey Cai

Lijian Yang

Xurui Huang

Yuchen Zhou

Yibin Yang

Liqin Dong

Chia Alex Tsai

Saravanan Radhakrishnan

Yu Jiang

Weng Hong Chan

Siwei Wu

Disclosed herein are systems, methods, and computer-readable media for managing Layer 2 (L2) and Layer 3 (L3) policies. Traffic is routed from a first VM to a first CGW within a Service Node, where the Service Node can include a centralized policy for both L2 functions and L3 functions, and the first CGW can integrate both L2 gateways and L3 gateways. Based on a floating IP address of the packet, the traffic is routed within the Service Node, the traffic being routed by an access BD from an ingress BD-VIF to an egress BD-VIF. The traffic is then routed from a second CGW that integrates both L2 gateways and L3 gateways to the destination VM.

Enhanced service node network infrastructure for L2/L3 GW in cloud

Techniques for improving options templates are described. The techniques may be performed at least in part by a network edge device and may include receiving, from a network collector device, a request for an options template download, the request indicating whether a full options template or partial options template are requested. Based at least in part on whether a full options template or a partial options template are requested, the method may also include, transmitting a response to the network collector device including a segment of the options template, wherein each segment includes a flag indicating whether the segment is a last segment of at least one more segment will follow. Finally, the method may include receiving from the collector device and in response to transmitting a segment having the flag indicating the segment is a last segment, an acknowledgement that the full options template has been received.

Options template transport for software defined wide area networks

Techniques for extending unicast to multicast service reflection to SD-WAN overlay networks using a virtual interface (VIF) through a centralized policy are described herein. The techniques may include receiving, by a network controller of a SD-WAN, a centralized data policy for unicast to multicast service reflection, transmitting, by the network controller and to a network edge device, the centralized data policy, designating, by the network edge device, a primary replicator to act as a multicast source and replicate packets toward a last hop router (LHR), configuring, on the primary replicator, a VIF usable to translate unicast packets to multicast packets, and applying, by the primary replicator, the centralized data policy on received packets.

Unicast to multicast service reflection in SD-WAN fabric

Techniques for improving options templates for network traffic monitoring and analysis, using pull mode by a network collector device, and sending an acknowledgement, by the network collector device that the download was successfully received are described. The techniques may include transmitting, by a network collector device and to a network edge device, a request to download a full options template, receiving, by the network collector device, responses from the network edge device, each response including a segment of the full options template and each segment including a last segment flag indicating whether the segment is a last segment, and in response to receiving a segment having the last segment flag set, transmitting, by the network collector device and to the network edge device, an acknowledgement that the full options template has been received.

Systems and methods for causation analysis of network anomalies in a network include detecting an alarm condition at a network device, the alarm condition pertaining to an anomaly or increase in a traffic condition such as packet loss. A dominant key is identified in each of one or more key types which contributed to the alarm condition, the key types including dimensions of traffic flow. Two or more dominant keys of two or more key types are aggregated and clustered to determine a combination of dominant keys which contributed to the alarm condition. A dominant traffic flow comprising the combination of dominant keys which contributed to the alarm condition is identified based on the aggregation and clustering. Malware or security threats can be identified from detecting a dominant source IP address or host which contributed to a predominant number of packet drops or retransmissions at ports of the network.

Systems and methods for causation analysis of network traffic anomalies and security threats

A network device may receive a request seeking a location identifier for an endpoint identifier from a first router. The network device may determine that the endpoint identifier belongs to a dynamic endpoint identifier range associated with a plurality of routers. The request may be forwarded to the plurality of routers to discover a host having the endpoint identifier and a notification may be received from one of the plurality of routers reporting discovery of the host having the endpoint identifier. The network device may send an identifier of the one of the plurality of routers which reports discovery of the host to the first router as the location identifier for the endpoint identifier.

Pro-active mechanism to detect LISP movable silent host

In one embodiment, a method includes receiving a packet from a host at a first hop router in a network site, the first hop router in communication with a core network and operable to encapsulate packets received from the host for transmission to a remote network site, setting a status for the host in a table at the first hop router as active, starting a timer for the host at the first hop router, transmitting a probe message from the first hop router to the host if a packet is not received at the first hop router from the host before the timer expires, updating the status of the host at the table based on whether a response message is received from the host, and using the host status to detect host migration. An apparatus and logic are also disclosed herein.

Proactive detection of host status in a communications network

Techniques provided herein use aggregate endpoints in a virtual overlay network. In general, aggregate endpoints operate as a single receiving entity for certain packets/frames sent between different physical proximities of the virtual overlay network.

Growing community of inventors

Shanghai, China

Yuefeng Jiang