-
公开(公告)号:US20240048509A1
公开(公告)日:2024-02-08
申请号:US18464783
申请日:2023-09-11
Applicant: Cisco Technology, Inc.
Inventor: Sridhar VALLEPALLI , Javed ASGHAR , Umamaheswararao KARYAMPUDI , Saad MALIK , Amitkumar V. PATEL
IPC: H04L49/15 , H04L45/02 , H04L45/00 , H04L45/745 , H04L47/20 , H04L67/563
CPC classification number: H04L49/1507 , H04L45/04 , H04L45/22 , H04L45/72 , H04L45/745 , H04L47/20 , H04L67/563 , H04L12/66
Abstract: Embodiments herein describe using translation mappings and security contracts to establish interconnects and policies between switching fabrics at different sites to create a unified fabric. In one embodiment, a multi-site controller can stretch endpoint groups (EPGs) between the sites so that a host or application in a first site can communicate with a host or application in a second site which is assigned to the same stretched EPG, despite the two sites have different namespaces. Further, the shadow EPGs can be formed to facilitate security contracts between EPGs in different sites. Each site can store namespace translation mapping that enable the site to convert namespace information in packets received from a different site into its own namespace values. As a result, independent bridging and routing segments in the various sites can be interconnected as well as providing application accessibility across different fabrics with independent and private namespaces.
-
公开(公告)号:US20160337235A1
公开(公告)日:2016-11-17
申请号:US14870722
申请日:2015-09-30
Applicant: Cisco Technology, Inc.
Inventor: James N. GUICHARD , Paul QUINN , Javed ASGHAR , Reinaldo PENNO , Yixing RUAN , Carlos M. PIGNATARO
IPC: H04L12/741 , H04L12/851
CPC classification number: H04L12/4633 , H04L63/0272
Abstract: A method for applying network services to data traffic forwarded between virtual private network (VPN) sites includes: receiving a data packet addressed to a target site associated with the VPN, determining services to be applied to the data packet according to a service chain, where the determining is a function of at least one of the VPN, the origin site or the target site, adding an indication of a VPN forwarding context onto the data packet, encapsulating the data packet with Network Service Header encapsulation, where a header for the encapsulated data packet indicates at least the service chain; forwarding the encapsulated data packet in accordance with the service chain, receiving the encapsulated data packet at the end of the service chain, terminating the service chain, removing the encapsulation, and forwarding the data packet to a target destination per the indication of a VPN forwarding context.
Abstract translation: 将网络服务应用于在虚拟专用网(VPN)站点之间转发的数据流量的方法包括:接收寻址到与VPN相关联的目标站点的数据分组,根据服务链确定应用于数据分组的服务,其中 所述确定是VPN,原始站点或目标站点中的至少一个的功能,将VPN转发上下文的指示添加到数据分组上,用网络服务报头封装封装数据分组,其中封装的报头 数据包至少指示服务链; 根据服务链转发封装的数据包,在服务链的末尾接收封装的数据包,终止服务链,去除封装,并根据VPN转发的指示将数据包转发到目标目标 上下文
-
公开(公告)号:US20200014634A1
公开(公告)日:2020-01-09
申请号:US16162199
申请日:2018-10-16
Applicant: Cisco Technology, Inc.
Inventor: Javed ASGHAR , Sridhar VALLEPALLI , Umamaheswararao KARYAMPUDI , Srinivas KOTAMRAJU
IPC: H04L12/933 , H04L12/931 , H04L12/46 , H04L12/24 , H04L12/741 , H04L12/715 , H04L12/761 , H04L12/707 , H04L29/06 , H04L29/12
Abstract: An endpoint group (EPG) can be stretched between the sites so that endpoints at different sites can be assigned to the same stretched EPG. Because the sites can use different bridge domains when establishing the stretched EPGs, the first time a site transmits a packet to an endpoint in a different site, the site learns or discovers a path to the destination endpoint. The site can use BGP to identify the site with the host and use a multicast tunnel to reach the site. A unicast tunnel can be used to transmit future packets to the destination endpoint. Additionally, a stretched EPG can be segmented to form a micro-stretched EPG. Filtering criteria can be used to identify a subset of the endpoints in the stretched EPG that are then assigned to the micro-stretched EPG, which can have different policies than the stretched EPG.
-
公开(公告)号:US20240244012A1
公开(公告)日:2024-07-18
申请号:US18623693
申请日:2024-04-01
Applicant: Cisco Technology, Inc.
Inventor: Javed ASGHAR , Sridhar VALLEPALLI , Umamaheswararao KARYAMPUDI , Srinivas KOTAMRAJU
IPC: H04L49/104 , H04L9/40 , H04L12/46 , H04L41/0893 , H04L45/02 , H04L45/16 , H04L45/24 , H04L45/74 , H04L49/15 , H04L49/201 , H04L61/106 , H04L69/22
CPC classification number: H04L49/104 , H04L12/462 , H04L12/4633 , H04L41/0893 , H04L45/04 , H04L45/16 , H04L45/24 , H04L45/74 , H04L49/1553 , H04L49/203 , H04L61/106 , H04L63/20 , H04L69/22
Abstract: An endpoint group (EPG) can be stretched between the sites so that endpoints at different sites can be assigned to the same stretched EPG. Because the sites can use different bridge domains when establishing the stretched EPGs, the first time a site transmits a packet to an endpoint in a different site, the site learns or discovers a path to the destination endpoint. The site can use BGP to identify the site with the host and use a multicast tunnel to reach the site. A unicast tunnel can be used to transmit future packets to the destination endpoint. Additionally, a stretched EPG can be segmented to form a micro-stretched EPG. Filtering criteria can be used to identify a subset of the endpoints in the stretched EPG that are then assigned to the micro-stretched EPG, which can have different policies than the stretched EPG.
-
公开(公告)号:US20220006758A1
公开(公告)日:2022-01-06
申请号:US17447773
申请日:2021-09-15
Applicant: Cisco Technology, Inc.
Inventor: Sridhar VALLEPALLI , Javed ASGHAR , Umamaheswararao KARYAMPUDI , Saad MALIK , Amitkumar V. PATEL
IPC: H04L12/933 , H04L12/715 , H04L12/707 , H04L12/721 , H04L12/741 , H04L12/813 , H04L29/08
Abstract: Embodiments herein describe using translation mappings and security contracts to establish interconnects and policies between switching fabrics at different sites to create a unified fabric. In one embodiment, a multi-site controller can stretch endpoint groups (EPGs) between the sites so that a host or application in a first site can communicate with a host or application in a second site which is assigned to the same stretched EPG, despite the two sites have different namespaces. Further, the shadow EPGs can be formed to facilitate security contracts between EPGs in different sites. Each site can store namespace translation mapping that enable the site to convert namespace information in packets received from a different site into its own namespace values. As a result, independent bridging and routing segments in the various sites can be interconnected as well as providing application accessibility across different fabrics with independent and private namespaces.
-
公开(公告)号:US20220006757A1
公开(公告)日:2022-01-06
申请号:US17448320
申请日:2021-09-21
Applicant: Cisco Technology, Inc.
Inventor: Javed ASGHAR , Sridhar VALLEPALLI , Umamaheswararao KARYAMPUDI , Srinivas KOTAMRAJU
IPC: H04L12/933 , H04L12/46 , H04L12/24 , H04L12/715 , H04L12/761 , H04L12/707 , H04L12/741 , H04L12/931 , H04L29/12 , H04L29/06
Abstract: An endpoint group (EPG) can be stretched between the sites so that endpoints at different sites can be assigned to the same stretched EPG. Because the sites can use different bridge domains when establishing the stretched EPGs, the first time a site transmits a packet to an endpoint in a different site, the site learns or discovers a path to the destination endpoint. The site can use BGP to identify the site with the host and use a multicast tunnel to reach the site. A unicast tunnel can be used to transmit future packets to the destination endpoint. Additionally, a stretched EPG can be segmented to form a micro-stretched EPG. Filtering criteria can be used to identify a subset of the endpoints in the stretched EPG that are then assigned to the micro-stretched EPG, which can have different policies than the stretched EPG.
-
公开(公告)号:US20210037057A1
公开(公告)日:2021-02-04
申请号:US16525362
申请日:2019-07-29
Applicant: Cisco Technology, Inc.
Inventor: Azeem M. SULEMAN , Rajagopalan JANAKIRAMAN , Pramila Deshraj SINGH , Sree Balaji VARADHARAJAN , Javed ASGHAR , Sachin GUPTA
Abstract: The present disclosure provides for system resource management in self-healing networks by grouping End Point Groups (EPGs) into a plurality of policy groups based on shared security policies; identifying a first policy group with a highest resource demand; assigning a first security policy corresponding to the first policy group to a first switch of a plurality of switches; identifying a second plurality of EPGs from the remaining EPGs that were not included in the first policy group; grouping the second plurality of EPGs into a second plurality of policy groups based on shared security policies; identifying a second policy group with a highest resource demand of the second plurality of policy groups; and assigning a second security policy corresponding to the second policy group to a second switch of the plurality of switches.
-
公开(公告)号:US20200014636A1
公开(公告)日:2020-01-09
申请号:US16164607
申请日:2018-10-18
Applicant: Cisco Technology, Inc.
Inventor: Sridhar VALLEPALLI , Javed ASGHAR , Umamaheswararao KARYAMPUDI , Saad MALIK , Amitkumar V. PATEL
IPC: H04L12/933 , H04L12/813 , H04L12/741 , H04L12/721 , H04L12/707 , H04L29/08 , H04L12/715
Abstract: Embodiments herein describe using translation mappings and security contracts to establish interconnects and policies between switching fabrics at different sites to create a unified fabric. In one embodiment, a multi-site controller can stretch endpoint groups (EPGs) between the sites so that a host or application in a first site can communicate with a host or application in a second site which is assigned to the same stretched EPG, despite the two sites have different namespaces. Further, the shadow EPGs can be formed to facilitate security contracts between EPGs in different sites. Each site can store namespace translation mapping that enable the site to convert namespace information in packets received from a different site into its own namespace values. As a result, independent bridging and routing segments in the various sites can be interconnected as well as providing application accessibility across different fabrics with independent and private namespaces.
-
-
-
-
-
-
-