公开(公告)号：US20210258216A1

公开(公告)日：2021-08-19

申请号：US17244941

申请日：2021-04-29

Applicant: Cisco Technology, Inc.

Inventor： Rajagopalan Janakiraman ,  Sivakumar Ganapathy ,  Gianluca Mardente ,  Giovanni Meo ,  Patel Amitkumar Valjibhai

IPC: H04L12/24 ,  H04L12/46 ,  H04L12/751 ,  H04L12/715 ,  H04L12/721

Abstract: Technologies for multi-cloud routing and policy interconnectivity are provided. An example method can include assigning different sets of data plane routers to data plane traffic associated with different address spaces in a cloud site of a multi-cloud fabric to yield a distributed mapping of data plane traffic and data plane routers. The method can further include providing, to an on-premises site in the multi-cloud fabric, routing entries from a control plane router on the cloud site, the routing entries reflecting the distributed mapping and identifying, for each address space, which data plane router handles data plane traffic for that address space; and when a data plane router is deployed at the cloud site, providing, to the on-premises site, updated routing information from the control plane router, the updated routing information identifying the data plane router as a next hop for data plane traffic associated with a respective address space.

公开(公告)号：US11582100B2

公开(公告)日：2023-02-14

申请号：US17719792

申请日：2022-04-13

Applicant: Cisco Technology, Inc.

Inventor： Rajagopalan Janakiraman ,  Sivakumar Ganapathy ,  Gianluca Mardente ,  Giovanni Meo ,  Patel Amitkumar Valjibhai

IPC: G06F15/177 ,  H04L41/0816 ,  H04L12/46 ,  H04L41/0806 ,  H04L41/0893 ,  H04L45/02 ,  H04L45/44

Abstract: Technologies for multi-cloud routing and policy interconnectivity are provided. An example method can include assigning different sets of data plane routers to data plane traffic associated with different address spaces in a cloud site of a multi-cloud fabric to yield a distributed mapping of data plane traffic and data plane routers. The method can further include providing, to an on-premises site in the multi-cloud fabric, routing entries from a control plane router on the cloud site, the routing entries reflecting the distributed mapping and identifying, for each address space, which data plane router handles data plane traffic for that address space; and when a data plane router is deployed at the cloud site, providing, to the on-premises site, updated routing information from the control plane router, the updated routing information identifying the data plane router as a next hop for data plane traffic associated with a respective address space.

公开(公告)号：US11509578B2

公开(公告)日：2022-11-22

申请号：US16713650

申请日：2019-12-13

Applicant: Cisco Technology, Inc.

Inventor： Gianluca Mardente ,  Shrey Ajmera ,  Cheng Wang ,  Maithili Narasimha ,  Aleksandr Oshurkov

IPC: G06F11/34 ,  G06F9/50 ,  H04L45/64 ,  H04L41/0893 ,  H04L43/08

Abstract: This disclosure describes a method of utilizing network controllers to store mappings between policies, dynamic operating attributes (DOA), and trigger values in a manifest and utilizing software agents in communication to monitor DOAs of respective workloads or workload groupings for trigger values associated with the DOAs to apply a corresponding policy at run-time. The method provides for flexible policy semantics and on-demand policy provisioning. The method includes receiving at a network controller, a definition of a policy, a DOA associated with a workload, and a trigger value associated with the DOA, storing a mapping between the policy, DOA and trigger value, sending the DOA and the trigger value to a datapath agent monitoring respective workloads, receiving an indication that a current value of the DOA of the workload corresponds to the trigger value from the software agent, and sending the policy to the software agent for distribution to the workload.

公开(公告)号：US11863591B2

公开(公告)日：2024-01-02

申请号：US18058113

申请日：2022-11-22

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Panchalingam ,  Umamaheswararao Karyampudi ,  Gianluca Mardente ,  Aram Aghababyan

IPC: H04L9/40 ,  H04L41/0806 ,  H04L41/12 ,  H04L41/0893

CPC classification number: H04L63/20 ,  H04L41/0806 ,  H04L41/0893 ,  H04L41/12 ,  H04L63/00 ,  H04L63/0227 ,  H04L63/101

Abstract: Systems, methods, and computer-readable media for on-demand security provisioning using whitelist and blacklist rules. In some examples, a system in a network including a plurality of pods can configure security policies for a first endpoint group (EPG) in a first pod, the security policies including blacklist and whitelist rules defining traffic security enforcement rules for communications between the first EPG and a second EPG in a second pods in the network. The system can assign respective implicit priorities to the one or more security policies based on a respective specificity of each policy, wherein more specific policies are assigned higher priorities than less specific policies. The system can respond to a detected move of a virtual machine associated with the first EPG to a second pod in the network by dynamically provisioning security policies for the first EPG in the second pod and removing security policies from the first pod.

公开(公告)号：US20210136124A1

公开(公告)日：2021-05-06

申请号：US17146204

申请日：2021-01-11

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Panchalingam ,  Umamaheswararao Karyampudi ,  Gianluca Mardente ,  Aram Aghababyan

IPC: H04L29/06 ,  H04L12/24

Abstract: Systems, methods, and computer-readable media for on-demand security provisioning using whitelist and blacklist rules. In some examples, a system in a network including a plurality of pods can configure security policies for a first endpoint group (EPG) in a first pod, the security policies including blacklist and whitelist rules defining traffic security enforcement rules for communications between the first EPG and a second EPG in a second pods in the network. The system can assign respective implicit priorities to the one or more security policies based on a respective specificity of each policy, wherein more specific policies are assigned higher priorities than less specific policies. The system can respond to a detected move of a virtual machine associated with the first EPG to a second pod in the network by dynamically provisioning security policies for the first EPG in the second pod and removing security policies from the first pod.

公开(公告)号：US10917436B2

公开(公告)日：2021-02-09

申请号：US16014644

申请日：2018-06-21

Applicant: Cisco Technology, Inc.

Inventor： Murukanandam Panchalingam ,  Umamaheswararao Karyampudi ,  Gianluca Mardente ,  Aram Aghababyan

IPC: H04L29/06 ,  H04L12/24

Abstract: Systems, methods, and computer-readable media for on-demand security provisioning using whitelist and blacklist rules. In some examples, a system in a network including a plurality of pods can configure security policies for a first endpoint group (EPG) in a first pod, the security policies including blacklist and whitelist rules defining traffic security enforcement rules for communications between the first EPG and a second EPG in a second pods in the network. The system can assign respective implicit priorities to the one or more security policies based on a respective specificity of each policy, wherein more specific policies are assigned higher priorities than less specific policies. The system can respond to a detected move of a virtual machine associated with the first EPG to a second pod in the network by dynamically provisioning security policies for the first EPG in the second pod and removing security policies from the first pod.

公开(公告)号：US20220239559A1

公开(公告)日：2022-07-28

申请号：US17719792

申请日：2022-04-13

Applicant: Cisco Technology, Inc.

Inventor： Rajagopalan Janakiraman ,  Sivakumar Ganapathy ,  Gianluca Mardente ,  Giovanni Meo ,  Patel Amitkumar Valjibhai

IPC: H04L41/0816 ,  H04L12/46 ,  H04L41/0806 ,  H04L41/0893 ,  H04L45/02 ,  H04L45/00 ,  H04L45/44

Abstract: Technologies for multi-cloud routing and policy interconnectivity are provided. An example method can include assigning different sets of data plane routers to data plane traffic associated with different address spaces in a cloud site of a multi-cloud fabric to yield a distributed mapping of data plane traffic and data plane routers. The method can further include providing, to an on-premises site in the multi-cloud fabric, routing entries from a control plane router on the cloud site, the routing entries reflecting the distributed mapping and identifying, for each address space, which data plane router handles data plane traffic for that address space; and when a data plane router is deployed at the cloud site, providing, to the on-premises site, updated routing information from the control plane router, the updated routing information identifying the data plane router as a next hop for data plane traffic associated with a respective address space.

公开(公告)号：US11329876B2

公开(公告)日：2022-05-10

申请号：US17244941

申请日：2021-04-29

Applicant: Cisco Technology, Inc.

Inventor： Rajagopalan Janakiraman ,  Sivakumar Ganapathy ,  Gianluca Mardente ,  Giovanni Meo ,  Patel Amitkumar Valjibhai

IPC: G06F15/177 ,  H04L41/0816 ,  H04L12/46 ,  H04L41/0806 ,  H04L41/0893 ,  H04L45/02 ,  H04L45/00 ,  H04L45/44

Abstract: Technologies for multi-cloud routing and policy interconnectivity are provided. An example method can include assigning different sets of data plane routers to data plane traffic associated with different address spaces in a cloud site of a multi-cloud fabric to yield a distributed mapping of data plane traffic and data plane routers. The method can further include providing, to an on-premises site in the multi-cloud fabric, routing entries from a control plane router on the cloud site, the routing entries reflecting the distributed mapping and identifying, for each address space, which data plane router handles data plane traffic for that address space; and when a data plane router is deployed at the cloud site, providing, to the on-premises site, updated routing information from the control plane router, the updated routing information identifying the data plane router as a next hop for data plane traffic associated with a respective address space.

公开(公告)号：US20210182169A1

公开(公告)日：2021-06-17

申请号：US16713650

申请日：2019-12-13

Applicant: Cisco Technology, Inc.

Inventor： Gianluca Mardente ,  Shrey Ajmera ,  Cheng Wang ,  Maithili Narasimha ,  Aleksandr Oshurkov

IPC: G06F11/34 ,  G06F9/50

Abstract: This disclosure describes a method of utilizing network controllers to store mappings between policies, dynamic operating attributes (DOA), and trigger values in a manifest and utilizing software agents in communication to monitor DOAs of respective workloads or workload groupings for trigger values associated with the DOAs to apply a corresponding policy at run-time. The method provides for flexible policy semantics and on-demand policy provisioning. The method includes receiving at a network controller, a definition of a policy, a DOA associated with a workload, and a trigger value associated with the DOA, storing a mapping between the policy, DOA and trigger value, sending the DOA and the trigger value to a datapath agent monitoring respective workloads, receiving an indication that a current value of the DOA of the workload corresponds to the trigger value from the software agent, and sending the policy to the software agent for distribution to the workload.

公开(公告)号：US20200322437A1

公开(公告)日：2020-10-08

申请号：US16375638

申请日：2019-04-04

Applicant: Cisco Technology, Inc.

Inventor： Gianluca Mardente ,  Maithili Narasimha

IPC: H04L29/08

Abstract: Systems, methods, and computer-readable media for distributing policies in a SDN environment through chunking. A policy can be chunked into a plurality of policy chunks having corresponding chunk identifications at a controller of a SDN environment. Each of the plurality of policy chunks can be hashed to create corresponding chunk hashes for each of the plurality of policy chunks. Further, the plurality of policy chunks, the chunk identifications of the plurality of policy chunks, and the chunk hashes of the plurality of policy chunks can be distributed from the controller of the SDN environment to an intermediate policy node in a fabric of the SDN environment. The chunk hashes and the chunk identifications of the plurality of policy chunks can be used to control distribution of the plurality of policy chunks to one or more edge nodes in the SDN environment.