Abstract:
In general, embodiments of the invention relate to processing network traffic data units (NTDUs). More specifically, embodiments of the invention relate to processing NTDUs transmitted between client device and the one or more protected resources. The protected resources are logically surrounded by a perimeter, which is implemented as a set of network devices that manage the flow of NTDUs between client devices and the protected resources. The perimeter works in conjunction with a set of filtering devices to determine whether a given NTDU can ultimately be transmitted to, and processed by, a protected resource.
Abstract:
A method for detecting abnormalities in network element operation. The method includes monitoring at least a portion of the network element for abnormalities and making a determination that an abnormality exists, in response to the monitoring, and based on the determination, tracking the abnormality. An abnormality includes a measured performance that deviates from a nominal performance, but that does not cause erroneous behavior of the network element.
Abstract:
Embodiments of the invention may relate to methods, systems, and/or non-transitory computer readable mediums for sidelining Such sidelining may include making a first determination, by a first network device, that a first network device state has degraded and making a first request, based on the first determination, to receive a first sideline token from a network controller. The network controller, in response to the first request, may make a second determination that a remaining sideline token is available. The method may also include receiving, by the first network device and based on the second determination, the remaining sideline token from the network controller and initiating, by the first network device, a graceful offlining based on receiving the remaining sideline token.
Abstract:
A method and apparatus of a network element that processes control plane data in a network element is described. In an exemplary embodiment, the device receives control plane data with a network element operating system, where at least a functionality of the network element operating system is executing in a container of the network element. In addition, the network element includes a data plane with a plurality of hardware tables and the host operating system. Furthermore, the network element processes the control plane data with the network element operating system. The network element additionally updates at least one of the plurality of hardware tables with the process control plane data using the network element operating system.
Abstract:
A method and apparatus of a network element that hitlessly upgrades a network element operating system of a network element is described. In an exemplary embodiment, the network element receives a second image for the network element operating system, where a first image of the network element operating system is executing as a first set of processes in a first container and the first set of processes manages the plurality of hardware tables for the network element. The network element further instantiates a second container for the second image. In addition, the network element starts a second set of processes using at least the second image in the second container. The network element additionally synchronizes state data between the first set of processes and the second set of processes. Furthermore, the network element sets the second set of processes as managing the plurality of hardware tables, and stops the first set of processes within the first container.
Abstract:
A method for virtual extensible local area network (VXLAN) encapsulation. The method includes receiving a first augmented MAC frame on a first ingress port of a first network device, where the first augmented MAC frame includes a first egress port ID (EPID), a first ingress port ID (IPID), and a first MAC frame. The method further includes identifying a first destination VXLAN tunnel endpoint (VTEP) internet protocol (IP) address based on the first EPID, where the first destination VTEP IP address is associated with a first destination VTEP. The method further includes identifying a source VTEP IP address based on the first IPID, performing VXLAN encapsulation of the first MAC frame to obtain a VXLAN frame, and sending the VXLAN frame to the first destination VTEP via a first egress port of the first network device.
Abstract:
In general, the invention relates to a method for programming a network device to perform routing of data packets between and/or within networks. More specifically, the method provides a more efficient process for updating the forwarding equivalence class (FEC) table with minimal impacting of the mappings in the forward information base (FIB) of the network device.
Abstract:
A method and system for applying a network policy in a virtual extensible local area network (VXLAN) environment. The method includes receiving, at a network device, a VXLAN frame that includes a source VXLAN network identifier (VNI). The network device includes a first network policy. The method also includes examining the VXLAN frame to determine the source VNI; obtaining, based on the source VNI, the first network policy; and processing the VXLAN frame based on the application of the first network policy.
Abstract:
A method and system for sharing host entries between virtual tunnel endpoints (VTEPs). The method includes making a first determination that an NLHE is present in a locally learned host entry table on a VTEP where the NHLE is associated with a first timestamp, and making a second determination that a first entry corresponding to the NHLE is present in a Host-Specific Portion of Global Host Entry Table (HSPT) on the VTEP, where the first entry is associated with a second timestamp. Based on the second determination, making a third determination, using the timestamps, that the NHLE is more recent than the first entry and based on the third determination updating an active forwarding table on the first VTEP to include a second entry corresponding to the NHLE and to remove the first entry and sending the NHLE to a VXLAN controller operatively connected to the VTEP.
Abstract:
A method and apparatus of a device that notifies another device of a failed device is described. In an exemplary embodiment, a network element detects that a first device is unavailable, where the network element couples the first device to the second device. In response to detecting that the first device is unavailable, the network element configures a proxy for the first device. The network element additionally receives network data that is destined for the first device, where the second device originated the network data. If the proxy can process the network data, the network element transmits a response to the second device from the proxy, where the response indicates that the first device is unavailable, where the first response includes an address of the first device. If the proxy cannot process the network data, the network element drops the network data.