公开(公告)号：US20220021707A1

公开(公告)日：2022-01-20

申请号：US16931610

申请日：2020-07-17

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Kamalam Panchalingam ,  Umamaheswararao Karyampudi ,  Junyun Li ,  Muralidhar Annabatula ,  Ronak K. Desai ,  Thomas J. Edsall

IPC: H04L29/06 ,  H04L12/24 ,  H04L12/813 ,  H04L29/08 ,  H04L12/803

Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and selects a group of policy proxy network elements. The network controller assigns an exclusive range of endpoint groups to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for its assigned range of endpoint groups. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoint groups. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint group to a first policy proxy network element based on a destination of the packet.

公开(公告)号：US11277447B2

公开(公告)日：2022-03-15

申请号：US16931610

申请日：2020-07-17

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Kamalam Panchalingam ,  Umamaheswararao Karyampudi ,  Junyun Li ,  Muralidhar Annabatula ,  Ronak K. Desai ,  Thomas J. Edsall

IPC: H04L29/06 ,  H04L41/0806 ,  H04L41/0893 ,  H04L67/56 ,  H04L47/125 ,  H04L47/20

Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and selects a group of policy proxy network elements. The network controller assigns an exclusive range of endpoint groups to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for its assigned range of endpoint groups. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoint groups. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint group to a first policy proxy network element based on a destination of the packet.

公开(公告)号：US20240056386A1

公开(公告)日：2024-02-15

申请号：US17819260

申请日：2022-08-11

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Panchalingam ,  Rajagopalan Janakiraman ,  Muralidhar Annabatula ,  Junyun Li ,  Hari Hara Prasad Muthulingam

IPC: H04L45/302 ,  H04L45/745

CPC classification number: H04L45/306 ,  H04L45/74591

Abstract: An embodiment of the present disclosure is directed a set of data centers and associated controls in which the data centers include network fabric comprises network routing devices configured to route bi-directional traffic symmetrically through insertable service, e.g., via the associated inter-site and intra-site controls, for a given set of policies or contracts using an ASIC or circuit-assisted arithmetic logic, enforcing such policies at the local network devices, to deterministically select the insertable services.

公开(公告)号：US11184325B2

公开(公告)日：2021-11-23

申请号：US16431615

申请日：2019-06-04

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam K. Panchalingam ,  Umamaheswararao Karyampudi ,  Muralidhar Annabatula ,  Darpan R. Kathoke ,  Junyun Li

IPC: H04L29/06 ,  H04L29/08

Abstract: The present disclosure provides for application-centric enforcement for multi-tenant workloads with multi-site data center fabrics by: receiving, at a local switch at a first site, a packet from a first host at the first site intended for a second host located at a second site; identifying class identifiers (ID) for the hosts; determining, based on the class IDs, a security policy for transmitting data between the hosts; in response to determining that the security policy indicates that the second site exclusively manages security policies for the hosts' network: setting a policy applied indicator on the packet indicating that enforcement of the security policy is delegated from the first switch to a second switch connected to the second host; including the class IDs in the packet; and transmitting the packet to the second site.

公开(公告)号：US11924160B2

公开(公告)日：2024-03-05

申请号：US17677560

申请日：2022-02-22

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Panchalingam ,  Umamaheswararao Karyampudi ,  Sudhakar Chunduru ,  Junyun Li ,  Ajay Kumar Modi

IPC: G06F15/16 ,  H04L61/2503 ,  H04L101/622

CPC classification number: H04L61/2503 ,  H04L2101/622

Abstract: Techniques for management of traffic in a network. The techniques provide application awareness in a Network Address Translation (NAT) system. In some examples, a first traffic is received at a first switch in a network from a first application hosted behind the first switch. The first switch identifies a first resource tag associated with the application from the first traffic. Further, the first switch identifies a first rule from the first resource tag indicating that the first traffic is to be routed through an intermediate device that performs network address translation. Moreover, the first switch transmits the traffic to an intermediate device, which perform NAT to translate the source IP address of the first traffic to a second IP address. Finally, the intermediate device sends the traffic to a destination device indicated by the first traffic.

公开(公告)号：US20230046070A1

公开(公告)日：2023-02-16

申请号：US17677560

申请日：2022-02-22

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Panchalingam ,  Umamaheswararao Karyampudi ,  Sudhakar Chunduru ,  Junyun Li ,  Ajay Kumar Modi

IPC: H04L61/2503

Abstract: Techniques for management of traffic in a network. The techniques provide application awareness in a Network Address Translation (NAT) system. In some examples, a first traffic is received at a first switch in a network from a first application hosted behind the first switch. The first switch identifies a first resource tag associated with the application from the first traffic. Further, the first switch identifies a first rule from the first resource tag indicating that the first traffic is to be routed through an intermediate device that performs network address translation. Moreover, the first switch transmits the traffic to an intermediate device, which perform NAT to translate the source IP address of the first traffic to a second IP address. Finally, the intermediate device sends the traffic to a destination device indicated by the first traffic.

公开(公告)号：US11553006B2

公开(公告)日：2023-01-10

申请号：US17589199

申请日：2022-01-31

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Kamalam Panchalingam ,  Umamaheswararao Karyampudi ,  Junyun Li ,  Muralidhar Annabatula ,  Ronak K. Desai ,  Thomas J. Edsall

IPC: H04L9/40 ,  H04L41/0806 ,  H04L41/0893 ,  H04L47/125 ,  H04L47/20 ,  H04L67/56

Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and assigns a range of endpoints to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for traffic belonging to a corresponding assigned range of endpoints. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoints. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint to a first policy proxy network element based on a destination of the packet.

公开(公告)号：US20220159042A1

公开(公告)日：2022-05-19

申请号：US17589199

申请日：2022-01-31

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Kamalam Panchalingam ,  Umamaheswararao Karyampudi ,  Junyun Li ,  Muralidhar Annabatula ,  Ronak K. Desai ,  Thomas J. Edsall

IPC: H04L9/40 ,  H04L41/0806 ,  H04L41/0893 ,  H04L67/56 ,  H04L47/125 ,  H04L47/20

Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and assigns a range of endpoints to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for traffic belonging to a corresponding assigned range of endpoints. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoints. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint to a first policy proxy network element based on a destination of the packet.