Label based policy enforcement
    12.
    发明授权

    公开(公告)号:US11552824B2

    公开(公告)日:2023-01-10

    申请号:US17391790

    申请日:2021-08-02

    Abstract: Examples disclosed herein relate to a method comprising receiving a data packet originating from a first device and intended for a second device, wherein the first device and the first access device belong to a first branch of a Wide Area Network (WAN) using a MPLS overlay and the second device belongs to a second branch of the WAN. The method includes encapsulating the data packet in VXLAN including a VXLAN label identifying a role type and transmitting the data packet to a first core device. The method includes determining an MPLS label corresponding to the role type and transmitting the data packet over the MPLS overlay to a second core device belonging to the second branch of the WAN. The method includes translating the MPLS label into the VXLAN label and transmitting the data packet including the VXLAN label to a second access device for an enforcement action.

    LABEL BASED POLICY ENFORCEMENT
    13.
    发明申请

    公开(公告)号:US20220345330A1

    公开(公告)日:2022-10-27

    申请号:US17391790

    申请日:2021-08-02

    Abstract: Examples disclosed herein relate to a method comprising receiving a data packet originating from a first device and intended for a second device, wherein the first device and the first access device belong to a first branch of a Wide Area Network (WAN) using a MPLS overlay and the second device belongs to a second branch of the WAN. The method includes encapsulating the data packet in VXLAN including a VXLAN label identifying a role type and transmitting the data packet to a first core device. The method includes determining an MPLS label corresponding to the role type and transmitting the data packet over the MPLS overlay to a second core device belonging to the second branch of the WAN. The method includes translating the MPLS label into the VXLAN label and transmitting the data packet including the VXLAN label to a second access device for an enforcement action.

    Validating reachability for liaison VRFs using OAM ping packets

    公开(公告)号:US12192086B2

    公开(公告)日:2025-01-07

    申请号:US17728395

    申请日:2022-04-25

    Abstract: Systems and methods provide a new type of time-length-value data stream (TLV) which can be encapsulated in an OAM ping packet. This “EVI TLV” encapsulating OAM ping packet can be sent to a network device (e.g., a border router) that a liaison VRF is provisioned on. Upon receipt, the encapsulated EVI TLV instructs the network device to determine whether the configuration of the liaison VRF is mapped to an EVI value specified by the EVI TLV. If the configuration of the liaison VRF is mapped to the specified EVI value, the network device returns an echo response indicating that the configuration of the liaison VRF is mapped onto the specified EVI value. Such a response may indicate that the liaison VRF is reachable for the EVPN.

    EFFICIENT VIRTUAL ADDRESS LEARNING IN OVERLAY NETWORK

    公开(公告)号:US20240364625A1

    公开(公告)日:2024-10-31

    申请号:US18141048

    申请日:2023-04-28

    CPC classification number: H04L45/586 H04L45/64 H04L45/72

    Abstract: A system for efficient multicast forwarding at a switch is provided. During operation, the switch can maintain a first tunnel with a first switch in a first overlay tunnel fabric, and a second tunnel with a second switch in a second overlay tunnel fabric. The switch can operate as the gateway for both fabrics. The system can obtain a first fabric identifier and a second fabric identifier from multicast control packets received via the first and second tunnels, respectively. A fabric identifier can uniquely identify a fabric. The system can then store, in a data structure, a first network address of the first switch and a second network address of the second switch in association with the first and second fabric identifiers, respectively. The system can determine whether to forward multicast traffic to either one of the first and second fabrics based on the first and second fabric identifiers, respectively.

    LOOP DETECTION IN VIRTUAL EXTENSIBLE LOCAL AREA NETWORK OVERLAY

    公开(公告)号:US20240022451A1

    公开(公告)日:2024-01-18

    申请号:US17813103

    申请日:2022-07-18

    CPC classification number: H04L12/4641 H04L45/645 H04L12/42 H04L45/04

    Abstract: In an example, a network switch is to receive a loop detect packet from an access netwssork connected to a Data center network (DCN). The DCN includes a VXLAN overlay and the network switch is configured as a VTEP. The network switch compares the VNI of a source VTEP from which the loop detect packet originates with a locally configured VNI. In response to a match, it is determined that the network switch is configured as a peer VTEP. Import RT in the loop detect packet is compared with an export RT of the peer VTEP and the export RT in the loop detect packet is compared with an import RT of the peer VTEP. Based on the comparison, it is determined whether a VXLAN tunnel is configured between the peer and the source VTEPs. In response to the VXLAN tunnel being configured, the switch may determine that a network loop is present.

    Dynamic traffic redirection for a virtual gateway of a distributed tunnel fabric

    公开(公告)号:US11528224B1

    公开(公告)日:2022-12-13

    申请号:US17503157

    申请日:2021-10-15

    Abstract: A system for redirecting traffic is provided. The system can allow a first switch to participate in a virtual switch in conjunction with a second switch of an overlay tunnel fabric. A path between a respective switch pair of an underlying network of the fabric can be determined based on a routing process. The first and second switches may individually participate in the routing process. Hence, the packets to a tunnel to the virtual switch can be distributed among paths to the first and second switches. The system can determine a trigger condition indicating that packets subsequently received via the tunnel is to be directed to a path to the second switch. The first and second switches can remain in an operational state. The system can then advertise a high cost for a link to the first switch for the routing process in the underlying network.

    TRAFFIC FLOW TRACE IN A NETWORK
    19.
    发明申请

    公开(公告)号:US20220191120A1

    公开(公告)日:2022-06-16

    申请号:US17221813

    申请日:2021-04-04

    Abstract: An example network orchestrator of a SDN is configured to receive, based on a user input, credentials associated with a traffic flow. Based on the credentials, it is determined whether the traffic flow is received at an ingress overlay network node. Route information and encapsulation information of the traffic flow is extracted from the ingress overlay network node. A first set of underlay network nodes each of which is a potential next hop for the traffic flow is identified. It is determined, based on the encapsulation information, whether the traffic flow is received by one of the first set of underlay network nodes, It is determined whether the traffic flow is received at an egress overlay network node from one of the first. A network trace of the traffic flow is determined based on the determinations of whether the traffic flow is received at the ingress overlay network node, one of the first set of underlay network nodes, and the egress overlay network node. Based on the network trace, a fault in a link between network nodes or in the ingress overlay network node or in the egress overlay network node or in one of the first set of underlay network nodes is detected.

Patent Agency Ranking