Cisco Technology, Inc.

Zhiyong Fang

Bin Shi

Feng Ping Cai

Jun Hui Liu

Xiaorong Wang

Yin Wang

Jianda Liu

Lianxiang Wang

Linyu Lu

Danmu Wu

Yuping Wang

Yunpeng Zhang

Yuxiang Chen

According to an embodiment, a node comprises one or more processors operable to execute instructions to cause the node to perform operations that comprise receiving a packet from a first node associated with an SD-WAN domain. The packet comprises a header indicating a TLOC associated with a second node to send the packet, the second node associated with an SR domain. The operations comprise determining that the TLOC corresponds to a virtual TLOC used in the SD-WAN domain to identify the second node that is in the SR domain and, in response, determining a second node identifier used in the SR domain to identify the second node. The operations further comprise preparing the packet to be communicated via the SR domain. Preparing the packet comprises including the second node identifier in the packet. The operations further comprise sending the packet comprising the second node identifier to the second node.

Inter-working of a software-defined wide-area network (SD-WAN) domain and a segment routing (SR) domain

A network device stores a Virtual Extensible Local Area Network (VxLAN) Tunnel Endpoint (VTEP) membership information that associates VxLANs each with a corresponding set of VTEPs authorized to originate VxLAN packets on that VxLAN. The network device receives from a communication network a VxLAN packet that identifies a VxLAN and an originating VTEP. The VTEP compares the originating VTEP to the set of VTEPs associated with the VxLAN in the VTEP membership information that matches the identified VxLAN. If the comparison indicates that the originating VTEP is not included in the set of VTEPs authorized to originate VxLAN packets, the VTEP discards the received VxLAN packet. Otherwise the VTEP further processes the VxLAN packet.

VxLAN security implemented using VxLAN membership information at VTEPs

A tunnel endpoint of a virtual network monitors the flows between the tunnel endpoint and at least one other tunnel endpoint. The virtual network spans a physical network. A flow identifier for each flow is determined based on packet headers of packets in each respective flow. A path identifier for each flow is also determined based on the packet headers of the packets in each respective flow. Each path identifier indicates a route that the respective flow takes in the physical network to reach the respective destination tunnel endpoint. The path identifier and the flow identifier of the respective flows are then transmitted to a controller of the virtual network.

Virtual extensible local area network performance routing

A method enabling symmetric routing between a first host within a first AS and a second host within a second AS is disclosed. The method includes detecting that a first routing message was received at an edge router of the first AS from an edge router of the second AS. The first message identifies the second host as a source and the first host as a destination of a forward route. The method further includes determining that the first message further comprises an indication to implement symmetric routing between the first and second hosts and generating a second routing message for propagating to router(s) within the first AS. The second message identifies the first host as a source and the second host as a destination of a return route, and indicates that data is to be sent via the edge router of the first AS that received the first message.

Symmetric routing enforcement

Growing community of inventors

Chongqing, China

Zhiyong Fang