公开(公告)号：US10581744B2

公开(公告)日：2020-03-03

申请号：US15367317

申请日：2016-12-02

Applicant: Cisco Technology, Inc.

Inventor： Munish Mehta ,  Saurabh Jain ,  Praveen Jain ,  Ronak K. Desai ,  Yibin Yang

IPC: H04L12/815 ,  H04L12/24 ,  H04L12/761 ,  H04L12/931 ,  H04L12/715 ,  H04L12/717 ,  H04L12/753

Abstract: Presented herein are traffic pruning techniques that define the pruning at the group level. A software defined network (SDN) controller determines first and second endpoint groups (EPGs) of an SDN associated with the SDN controller. The SDN runs on a plurality of networking devices that interconnect a plurality of endpoints that are each attached to one or more host devices. The SDN controller determines a host-EPG mapping for the SDN, as well as a networking device-host mapping for the SDN. The SDN controller then uses the host-EPG mapping, the networking device-host mapping, and one or more group-based policies associated with traffic sent from the first EPG to the second EPG to compute hardware pruning policies defining how to prune multi-destination traffic sent from the first EPG to the second EPG. The hardware pruning policies are then installed in one or more of the networking devices or the host devices.

公开(公告)号：US20190141010A1

公开(公告)日：2019-05-09

申请号：US16236757

申请日：2018-12-31

Applicant: Cisco Technology, Inc.

Inventor： Vijay Chander ,  Yibin Yang ,  Praveen Jain ,  Munish Mehta

IPC: H04L29/12 ,  H04L12/751 ,  H04L12/46

Abstract: According to one or more embodiments of this disclosure, a network controller in a data center network establishes a translation table for in-band traffic in a data center network, the translation table resolves ambiguous network addresses based on one or more of a virtual network identifier (VNID), a routable tenant address, or a unique loopback address. The network controller device receives packets originating from applications and/or an endpoints operating in a network segment associated with a VNID. The network controller device translates, using the translation table, unique loopback addresses and/or routable tenant addresses associated with the packets into routable tenant addresses and/or unique loopback addresses, respectively.

公开(公告)号：US20180159781A1

公开(公告)日：2018-06-07

申请号：US15367317

申请日：2016-12-02

Applicant: Cisco Technology, Inc.

Inventor： Munish Mehta ,  Saurabh Jain ,  Praveen Jain ,  Ronak K. Desai ,  Yibin Yang

IPC: H04L12/815 ,  H04L12/24 ,  H04L12/761 ,  H04L12/931

Abstract: Presented herein are traffic pruning techniques that define the pruning at the group level. A software defined network (SDN) controller determines first and second endpoint groups (EPGs) of an SDN associated with the SDN controller. The SDN runs on a plurality of networking devices that interconnect a plurality of endpoints that are each attached to one or more host devices. The SDN controller determines a host-EPG mapping for the SDN, as well as a networking device-host mapping for the SDN. The SDN controller then uses the host-EPG mapping, the networking device-host mapping, and one or more group-based policies associated with traffic sent from the first EPG to the second EPG to compute hardware pruning policies defining how to prune multi-destination traffic sent from the first EPG to the second EPG. The hardware pruning policies are then installed in one or more of the networking devices or the host devices.

公开(公告)号：US20180139150A1

公开(公告)日：2018-05-17

申请号：US15353093

申请日：2016-11-16

Applicant: Cisco Technology, Inc.

Inventor： Saurabh Jain ,  Vijay K. Chander ,  Vijayan Ramakrishnan ,  Ronak K. Desai ,  Praveen Jain ,  Munish Mehta ,  Yibin Yang

IPC: H04L12/919 ,  H04L12/24 ,  H04L12/26

CPC classification number: H04L47/765 ,  H04L41/0823 ,  H04L41/0896 ,  H04L41/12

Abstract: The techniques presented herein use dynamic endpoint group (EPG) binding changes to facilitate cross-tenant resource sharing. A first node of a multi-tenant software defined network determines that an application on a first endpoint has initiated operation and needs temporary access to resources located at a second endpoint. The first and second endpoints are associated with first and second tenants, respectively, that are logically segregated from one another by the software defined network. The first node dynamically changes an initial EPG binding associated with the first endpoint to a second EPG binding that enables the first endpoint to temporarily directly access the resources at the second endpoint. The first node subsequently determines that the application on the first endpoint no longer needs access to the resources located at a second endpoint and, as such, changes the second EPG binding associated with the first endpoint back to the initial EPG binding.

公开(公告)号：US20170346736A1

公开(公告)日：2017-11-30

申请号：US15208018

申请日：2016-07-12

Applicant: Cisco Technology, Inc.

Inventor： Vijay Chander ,  Yibin Yang ,  Praveen Jain ,  Munish Mehta

IPC: H04L12/741 ,  H04L12/46

CPC classification number: H04L45/745 ,  H04L12/4633 ,  H04L12/4641 ,  H04L45/74

Abstract: According to one or more embodiments of this disclosure, a network controller in a data center network establishes a translation table for in-band traffic in a data center network, the translation table resolves ambiguous network addresses based on one or more of a virtual network identifier (VNID), a routable tenant address, or a unique loopback address. The network controller device receives packets originating from applications and/or an endpoints operating in a network segment associated with a VNID. The network controller device translates, using the translation table, unique loopback addresses and/or routable tenant addresses associated with the packets into routable tenant addresses and/or unique loopback addresses, respectively.

公开(公告)号：US20230300105A1

公开(公告)日：2023-09-21

申请号：US18069836

申请日：2022-12-21

Applicant: Cisco Technology, Inc.

Inventor： Vijay Chander ,  Yibin Yang ,  Praveen Jain ,  Munish Mehta

IPC: H04L61/2592 ,  H04L12/46 ,  H04L45/02

CPC classification number: H04L61/2592 ,  H04L12/4641 ,  H04L45/02 ,  H04L61/2514

Abstract: According to one or more embodiments of this disclosure, a network controller in a data center network establishes a translation table for in-band traffic in a data center network, the translation table resolves ambiguous network addresses based on one or more of a virtual network identifier (VNID), a routable tenant address, or a unique loopback address. The network controller device receives packets originating from applications and/or an endpoints operating in a network segment associated with a VNID. The network controller device translates, using the translation table, unique loopback addresses and/or routable tenant addresses associated with the packets into routable tenant addresses and/or unique loopback addresses, respectively.

公开(公告)号：US11546288B2

公开(公告)日：2023-01-03

申请号：US17174215

申请日：2021-02-11

Applicant: Cisco Technology, Inc.

Inventor： Vijay Chander ,  Yibin Yang ,  Praveen Jain ,  Munish Mehta

IPC: H04L29/12 ,  H04L61/2592 ,  H04L12/46 ,  H04L45/02 ,  H04L61/2514 ,  H04L61/2521

Abstract: According to one or more embodiments of this disclosure, a network controller in a data center network establishes a translation table for in-band traffic in a data center network, the translation table resolves ambiguous network addresses based on one or more of a virtual network identifier (VNID), a routable tenant address, or a unique loopback address. The network controller device receives packets originating from applications and/or an endpoints operating in a network segment associated with a VNID. The network controller device translates, using the translation table, unique loopback addresses and/or routable tenant addresses associated with the packets into routable tenant addresses and/or unique loopback addresses, respectively.

公开(公告)号：US11336515B1

公开(公告)日：2022-05-17

申请号：US17179692

申请日：2021-02-19

Applicant: Cisco Technology, Inc.

Inventor： Munish Mehta ,  Sundeep Kumar Singh ,  Shyam N. Kapadia ,  Mohammed Javed Asghar ,  Lukas Krattiger

IPC: H04L41/0806 ,  H04L61/2596 ,  H04L69/22 ,  H04L12/46

Abstract: Presented herein are systems and methods to enable simultaneous interoperability with policy-aware and policy-unaware data center sites. A multi-site orchestrator (MSO) device can be configured to obtain configuration information for each of a plurality of different data center sites. The data center sites may include one or more on-premises sites and one or more off-premises sites, each of which may include one or more policy-aware sites and/or one or more policy-unaware sites. The MSO can selectively use namespace translations to create a unified fabric across the different data center sites, enabling one or more hosts and/or applications at a first of the data center sites to communicate with one or more hosts and/or applications at a second of the data center sites, regardless of the sites' respective configurations.

公开(公告)号：US11303576B2

公开(公告)日：2022-04-12

申请号：US16656353

申请日：2019-10-17

Applicant: Cisco Technology, Inc.

Inventor： Ajay K. Modi ,  Atul Garg ,  Murukanandam K. Panchalingam ,  Umamaheswararao Karyampudi ,  Munish Mehta

IPC: H04L12/50 ,  H04L47/2483 ,  H04L45/7453 ,  H04L47/125 ,  H04L49/9057 ,  H04L49/00 ,  H04L12/18

Abstract: A network device receives a fragmented packet of an internet protocol (IP) packet. The fragmented packet is subsequently received relative to an initial fragmented packet of the IP packet and includes a first set of tuple information. The network device determines an entry of a hash table associated with the IP packet, based on the first set of tuple information and a fragment identifier (ID) within the fragmented packet. The network device retrieves a second set of tuple information associated with the fragmented packet from the hash table entry, and transmits an indication of the first and second sets of tuple information.

公开(公告)号：US10171507B2

公开(公告)日：2019-01-01

申请号：US15159379

申请日：2016-05-19

Applicant: Cisco Technology, Inc.

Inventor： Praveen Jain ,  Munish Mehta ,  Saurabh Jain ,  Yibin Yang

IPC: G06F21/00 ,  H04L29/06 ,  H04L12/931 ,  G06F9/455 ,  H04L12/713

Abstract: Microsegmentation in a heterogeneous software-defined network can be performed by classifying endpoints associated with a first virtualized environment into respective endpoint groups based on respective attributes, and classifying endpoints associated with a second virtualized environment into respective security groups based on respective attributes. Each respective endpoint group can correspond to a respective security group having the same attribute. Each respective endpoint group and corresponding security group can be associated with a respective policy model defining rules for processing associated traffic. Each of the respective security groups can be used to generate a respective network attribute endpoint group, which can include the network addresses of those endpoints in the respective security group. Each respective network attribute endpoint group can inherit the policy model of the respective endpoint group corresponding to the respective security group. Traffic between the endpoints can then be processed based on the various classifications and associated rules.