Distributed neighbor state management for networked aggregate peers

    公开(公告)号:US11502943B2

    公开(公告)日:2022-11-15

    申请号:US16866152

    申请日:2020-05-04

    Inventor: Rajib Majila

    Abstract: Methods for performing neighbor state management between peers of a Multi-Chassis Link Aggregation Group (MCLAG) are provided. In one method, a first peer of a Multi-Chassis Link Aggregation Group (MCLAG) performs state management for each neighbor entry in a first set of neighbor entries. Similarly, a second peer of the MCLAG connected in parallel with the first peer performs state management for each neighbor entry in a second set of neighbor entries, the second set of neighbor entries containing contain at least one neighbor entry absent from the first set of neighbor entries.

    Monitoring flow activity on a network device

    公开(公告)号:US10958554B2

    公开(公告)日:2021-03-23

    申请号:US16108836

    申请日:2018-08-22

    Abstract: Examples disclosed herein relate to monitoring flow activity on a network device. In an example, a neighbor table is maintained on a network device. The neighbor table may include a record of a neighbor network device and a hit bit corresponding to the neighbor network device. The hit bit may be used to represent a flow activity of the neighbor network device. A determination may be made whether a status of the hit bit corresponding to the neighbor network device is inactive. If the status of the hit bit is inactive, a flow entry corresponding to the neighbor network device may be deleted from an ASIC table on the network device.

    POLICY SYNTHESIS TO ENFORCE GROUP-BASED POLICIES TO UNKNOWN FLOWS

    公开(公告)号:US20230113466A1

    公开(公告)日:2023-04-13

    申请号:US17498029

    申请日:2021-10-11

    Abstract: A system determines a first set of policies, wherein at least one policy entry for a destination role comprises a source role, a traffic attribute, and an action to be taken for the packet. The system represents the policies as a matrix, wherein a first entry in the matrix indicates the source and destination role, the traffic attribute, and the action of the at least one policy entry. The system replaces, in the first entry, the action with the destination role if the action indicates to allow the packet, and with a null value if the action indicates to deny the packet, to obtain a first data structure with entries indicating, for a respective source role, traffic attributes and corresponding sets of allowed destination roles. The system resolves an overlapping pair comprising a first and a second traffic attribute to obtain a second set of synthesized policies.

    SOURCE PORT-BASED IDENTIFICATION OF CLIENT ROLE

    公开(公告)号:US20230089819A1

    公开(公告)日:2023-03-23

    申请号:US17482079

    申请日:2021-09-22

    Abstract: One aspect of the instant application facilitates a source port-based identification of client role. During operation, the system can receive, at a network device, a network packet from a client device coupled to the network device via a port. The system can in response to determining that the port is a trusted port, apply a global trusted port configuration based on a first mapping table. The global trusted port configuration corresponds to a default client role. The system can in response to determining that a per-port configuration exists in a second mapping table and the client device is coupled to the trusted port, identify the per-port configuration that corresponds to a port-based client role to override the global trusted port configuration; and apply, based on the per-port configuration and a third mapping table, a policy to the subsequent network packets received via the port.

    Monitoring flow activity on a network device

    公开(公告)号:US20200067808A1

    公开(公告)日:2020-02-27

    申请号:US16108836

    申请日:2018-08-22

    Abstract: Examples disclosed herein relate to monitoring flow activity on a network device. In an example, a neighbor table is maintained on a network device. The neighbor table may include a record of a neighbor network device and a hit bit corresponding to the neighbor network device. The hit bit may be used to represent a flow activity of the neighbor network device. A determination may be made whether a status of the hit bit corresponding to the neighbor network device is inactive. If the status of the hit bit is inactive, a flow entry corresponding to the neighbor network device may be deleted from an ASIC table on the network device.

    Policy synthesis to enforce group-based policies to unknown flows

    公开(公告)号:US12126535B2

    公开(公告)日:2024-10-22

    申请号:US17498029

    申请日:2021-10-11

    CPC classification number: H04L47/20

    Abstract: A system determines a first set of policies, wherein at least one policy entry for a destination role comprises a source role, a traffic attribute, and an action to be taken for the packet. The system represents the policies as a matrix, wherein a first entry in the matrix indicates the source and destination role, the traffic attribute, and the action of the at least one policy entry. The system replaces, in the first entry, the action with the destination role if the action indicates to allow the packet, and with a null value if the action indicates to deny the packet, to obtain a first data structure with entries indicating, for a respective source role, traffic attributes and corresponding sets of allowed destination roles. The system resolves an overlapping pair comprising a first and a second traffic attribute to obtain a second set of synthesized policies.

Patent Agency Ranking