公开(公告)号：US09461968B2

公开(公告)日：2016-10-04

申请号：US14627223

申请日：2015-02-20

Applicant: Cisco Technology, Inc.

Inventor： David Chang ,  Abhijit Patra ,  Nagaraj Bagepalli ,  Rajesh Kumar Sethuraghavan

IPC: H04L12/721 ,  H04L29/06 ,  H04L12/931 ,  H04L29/08 ,  G06F21/53

CPC classification number: H04L63/0263 ,  G06F9/45558 ,  G06F2009/45587 ,  G06F2009/45595 ,  H04L29/08927 ,  H04L29/08972 ,  H04L49/356 ,  H04L49/70 ,  H04L63/0218 ,  H04L63/0227

Abstract: Techniques are provided for implementing a zone-based firewall policy. At a virtual network device, information is defined and stored that represents a security management zone for a virtual firewall policy comprising one or more common attributes of applications associated with the security zone. Information representing a firewall rule for the security zone is defined and comprises first conditions for matching common attributes of applications associated with the security zone and an action to be performed on application traffic. Parameters associated with the application traffic are received that are associated with properly provisioned virtual machines. A determination is made whether the application traffic parameters satisfy the conditions of the firewall rule and in response to determining that the conditions are satisfied, the action is performed.

公开(公告)号：US09300585B2

公开(公告)日：2016-03-29

申请号：US14081772

申请日：2013-11-15

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Surendra M. Kumar ,  Nagaraj A. Bagepalli ,  Dileep K. Devireddy ,  Abhijit Patra

IPC: H04L12/801 ,  H04L12/721 ,  H04L12/54 ,  H04L12/26 ,  H04L12/753 ,  H04L12/715

CPC classification number: H04L47/2475 ,  H04L12/56 ,  H04L43/026 ,  H04L45/12 ,  H04L45/38 ,  H04L45/48 ,  H04L45/64 ,  H04L47/12 ,  H04L47/17

Abstract: A method is provided in one example embodiment and includes receiving at a network element a flow offload decision for a first service node that includes a portion of a service chain for processing a flow; recording the flow offload decision against the first service node at the network element; and propagating the flow offload decision backward on a service path to which the flow belongs if the first service node is hosted at the network element. Embodiments may also include propagating the flow offload decision backward on a service path to which the flow belongs if the flow offload decision is a propagated flow offload decision and the network element hosts a second service node that immediately precedes the service node on behalf of which the propagated flow offload decision was received and a flow offload decision has already been received by the network element from the second service node.

Abstract translation: 在一个示例实施例中提供了一种方法，并且包括在网络元件处接收包括用于处理流的服务链的一部分的第一服务节点的流卸载决定; 记录网元上的第一服务节点的流量卸载决定; 并且如果第一服务节点驻留在网络元件处，则在流所属的服务路径上向后传播流卸载决策。 实施例还可以包括：如果流卸载决定是传播的流卸载决定，并且网络主机驻留在服务节点之前的第二服务节点，则在流所属的服务路径上向后传播流卸载决策， 接收到传播流卸载决定，网元从第二服务节点已经接收到流卸载决定。

公开(公告)号：US09178828B2

公开(公告)日：2015-11-03

申请号：US13872008

申请日：2013-04-26

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Surendra M. Kumar ,  Dileep K. Devireddy ,  Nagaraj A. Bagepalli ,  Abhijit Patra ,  Vina Ermagan ,  Fabio R. Maino ,  Victor Manuel Moreno ,  Paul Quinn

IPC: G06F9/455 ,  H04L12/851

CPC classification number: H04L47/2425 ,  G06F9/45533 ,  G06F2009/45562

Abstract: An example method for service insertion in a network environment is provided in one example and includes configuring a service node by tagging one or more interface ports of a virtual switch function to which the service node is connected with one or more policy identifiers. When data traffic associated with a policy identifier is received on a virtual overlay path the virtual switch function may then terminate the virtual overlay path and direct raw data traffic to the interface port of the service node that is tagged to the policy identifier associated with the data traffic.

Abstract translation: 在一个示例中提供了在网络环境中的服务插入的示例方法，并且包括通过标记服务节点与其连接的虚拟交换机功能的一个或多个接口端口与一个或多个策略标识符来配置服务节点。 当在虚拟覆盖路径上接收到与策略标识符相关联的数据流量时，虚拟交换机功能可以终止虚拟覆盖路径，并将原始数据流直接引导到标记为与数据相关联的策略标识符的服务节点的接口端口 交通。

公开(公告)号：US20150263901A1

公开(公告)日：2015-09-17

申请号：US14208453

申请日：2014-03-13

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Surendra M. Kumar ,  Nagaraj A. Bagepalli ,  Abhijit Patra ,  Paul Quinn ,  James N. Guichard ,  Hendrikus G. P. Bosch

IPC: H04L12/24

CPC classification number: H04L45/02 ,  H04L41/08 ,  H04L41/0813 ,  H04L41/0893 ,  H04L41/0896 ,  H04L41/12 ,  H04L45/308 ,  H04L45/38

Abstract: An example method for service node originated service chains in a network environment is provided and includes receiving a packet at a service node in a network environment that includes a plurality of service nodes and a central classifier, analyzing the packet for a service chain modification or a service chain initiation, classifying the packet at the service node to a new service chain based on the analysis, initiating the new service chain at the service node if the analysis indicates service chain initiation, and modifying an existing service chain for the packet to the new service chain if the analysis indicates service chain modification. In specific embodiments, the analysis includes applying classification logic specific to the service node. Some embodiments, service node attributes and order of service nodes in substantially all service chains configured in the network may be received from a central controller.

Abstract translation: 提供了一种网络环境中服务节点发起的服务链的示例方法，包括在包括多个服务节点和中心分类器的网络环境中的服务节点处接收分组，分析服务链修改的分组或 服务链启动，基于分析将服务节点处的分组分类到新的服务链，如果分析指示服务链启动，则在服务节点处启动新的服务链，并将分组的现有服务链修改为新的 服务链如果分析表明服务链修改。 在具体实施例中，分析包括应用对服务节点特定的分类逻辑。 可以从中央控制器接收一些实施例，服务节点属性和在网络中配置的基本上所有业务链中的服务节点的顺序。

公开(公告)号：US20150071285A1

公开(公告)日：2015-03-12

申请号：US14020649

申请日：2013-09-06

Applicant: CISCO TECHNOLOGY, INC

Inventor： Surendra M. Kumar ,  Dileep K. Devireddy ,  Nagaraj A. Bagepalli ,  Abhijit Patra

IPC: H04L12/741 ,  H04L12/725

CPC classification number: H04L45/306 ,  H04L45/54

Abstract: An example method for distributed service chaining in a network environment is provided and includes receiving a packet belonging to a service chain in a distributed virtual switch (DVS) network environment, wherein the packet includes a network service header (NSH) indicating a service path identifier identifying the service chain and a location of the packet on the service chain, evaluating a service forwarding table to determine a next service node based on the service path identifier and the location, with a plurality of different forwarding tables distributed across the DVS at a corresponding plurality of virtual Ethernet Modules (VEMs) associated with respective service nodes in the service chain, and forwarding the packet to the next service node, with substantially all services in the service chain provided sequentially to the packet in a single service loop on a service overlay.

Abstract translation: 提供了一种在网络环境中分布式服务链接的示例方法，包括：在分布式虚拟交换机（DVS）网络环境中接收属于服务链的分组，其中分组包括指示服务路径标识符的网络服务报头（NSH） 在所述服务链上识别所述服务链和所述分组的位置，评估服务转发表以基于所述服务路径标识符和所述位置来确定下一个服务节点，具有分布在所述DVS上的相应的多个不同的转发表 多个虚拟以太网模块（VEM），其与服务链中的相应服务节点相关联，并且将分组转发到下一个服务节点，服务链中的基本上所有服务在服务覆盖中的单个服务循环中顺序地提供给分组 。

公开(公告)号：US20140321459A1

公开(公告)日：2014-10-30

申请号：US13872008

申请日：2013-04-26

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Surendra M. Kumar ,  Dileep K. Devireddy ,  Nagaraj A. Bagepalli ,  Abhijit Patra ,  Vina Ermagan ,  Fabio R. Maino ,  Victor Manuel Moreno ,  Paul Quinn

IPC: H04L12/851

CPC classification number: H04L47/2425 ,  G06F9/45533 ,  G06F2009/45562

Abstract: An example method for service insertion in a network environment is provided in one example and includes configuring a service node by tagging one or more interface ports of a virtual switch function to which the service node is connected with one or more policy identifiers. When data traffic associated with a policy identifier is received on a virtual overlay path the virtual switch function may then terminate the virtual overlay path and direct raw data traffic to the interface port of the service node that is tagged to the policy identifier associated with the data traffic.

Abstract translation: 在一个示例中提供了在网络环境中的服务插入的示例方法，并且包括通过标记服务节点与其连接的虚拟交换机功能的一个或多个接口端口与一个或多个策略标识符来配置服务节点。 当在虚拟覆盖路径上接收到与策略标识符相关联的数据流量时，虚拟交换机功能可以终止虚拟覆盖路径，并将原始数据流直接引导到标记为与数据相关联的策略标识符的服务节点的接口端口 交通。

公开(公告)号：US20140280836A1

公开(公告)日：2014-09-18

申请号：US13843233

申请日：2013-03-15

Applicant: CISCO TECHNOLOGY , INC.

Inventor： Surendra M. Kumar ,  Nagaraj A. Bagepalli ,  Abhijit Patra ,  Paul Quinn ,  Ethan M. Spiegel

IPC: H04L12/24

CPC classification number: H04L41/5041 ,  H04L49/15 ,  H04L49/70

Abstract: An example method for workload based service chain insertion in a network environment is provided and includes partitioning a service-path into fragments at a service controller, where the service-path comprises an ordered sequence of services to be provided to a packet associated with a workload in a network. The method also includes determining a location of service nodes providing the services; and provisioning the fragments at interfaces at a distributed virtual switch. The method could further include generating a plurality of service insertion points corresponding to the fragments at a service dispatcher. The service dispatcher can include a plurality of data plane components, and the service insertion points are generated at the data plane components.

Abstract translation: 提供了一种在网络环境中基于工作负载的服务链插入的示例方法，并且包括将服务路径划分为服务控制器处的分段，其中服务路径包括要提供给与工作负载相关联的分组的有序序列的服务 在网络中。 该方法还包括确定提供服务的服务节点的位置; 并在分布式虚拟交换机的接口处配置片段。 该方法还可以包括在服务分派器处生成与片段相对应的多个服务插入点。 服务调度器可以包括多个数据平面组件，并且在数据平面组件处生成服务插入点。

公开(公告)号：US11606226B2

公开(公告)日：2023-03-14

申请号：US17221752

申请日：2021-04-02

Applicant: Cisco Technology, Inc.

Inventor： Nagaraj A. Bagepalli ,  David Wei-Shen Chang ,  Abhijit Patra ,  Murali Anantha ,  Prashanth Thumbargudi

IPC: H04L12/64 ,  H04L12/66 ,  H04L65/102 ,  H04L41/022 ,  H04L41/08 ,  H04L41/0246

Abstract: An example method for a programmable infrastructure gateway for enabling hybrid cloud services in a network environment is provided and includes receiving an instruction from a hybrid cloud application executing in a private cloud, interpreting the instruction according to a hybrid cloud application programming interface, and executing the interpreted instruction in a public cloud using a cloud adapter. The method is generally executed in the infrastructure gateway including a programmable integration framework allowing generation of various cloud adapters using a cloud adapter software development kit, the cloud adapter being generated and programmed to be compatible with a specific public cloud platform of the public cloud. In specific embodiments, identical copies of the infrastructure gateway can be provided to different cloud service providers who manage disparate public cloud platforms; each copy of the infrastructure gateway can be programmed differently to generate corresponding cloud adapters compatible with the respective public cloud platforms.

公开(公告)号：US11604658B2

公开(公告)日：2023-03-14

申请号：US17345882

申请日：2021-06-11

Applicant: Cisco Technology, Inc.

Inventor： David W. Chang ,  Abhijit Patra ,  Nagaraj Bagepalli ,  Dileep Kumar Devireddy ,  Ganesh Sadasivan

IPC: G06F15/16 ,  G06F9/4401 ,  H04L67/10 ,  H04L61/103 ,  H04L12/46 ,  G06F9/455 ,  H04L67/1097 ,  H04L9/40 ,  H04L47/70 ,  H04L45/00 ,  H04L101/622

Abstract: Many hybrid cloud topologies require virtual machines in a public cloud to use a router in a private cloud, even when the virtual machine is transmitting to another virtual machine in the public cloud. Routing data through an enterprise router on the private cloud via the internet is generally inefficient. This problem can be overcome by placing a router within the public cloud that mirrors much of the routing functionality of the enterprise router. A switch configured to intercept address resolution protocol (ARP) request for the enterprise router's address and fabricate a response using the MAC address of the router in the public cloud.

公开(公告)号：US10554620B2

公开(公告)日：2020-02-04

申请号：US14749391

申请日：2015-06-24

Applicant: Cisco Technology, Inc.

Inventor： David W. Chang ,  Abhijit Patra ,  Nagaraj Bagepalli ,  Dileep Kumar Devireddy ,  Ganesh Sadasivan

IPC: G06F15/16 ,  H04L29/12 ,  H04L29/08 ,  H04L12/911

Abstract: Many hybrid cloud topologies require virtual machines in a public cloud to use a router in a private cloud, even when the virtual machine is transmitting to another virtual machine in the public cloud. Routing data through an enterprise router on the private cloud via the internet is generally inefficient. This problem can be overcome by placing a router within the public cloud that mirrors much of the routing functionality of the enterprise router. A switch configured to intercept address resolution protocol (ARP) request for the enterprise router's address and fabricate a response using the MAC address of the router in the public cloud.