A customer premises device may include a memory configured to store day 0 configuration instructions, a first network interface to couple to an out-of-band network, a second network interface operatively coupled to a customer network, and at least one processor configured to automatically and without user input execute the day 0 configuration instructions. The at least one processor is configured to establish and maintain a secure tunnel connection with a security gateway device via the out-of-band network and to establish a connection with a configuration platform on the provider network via the secure tunnel connection. Orchestration instructions for configuring one or more VNFs are received from the configuration platform via the tunnel connection. The at least one processor is further configured to receive VNF management instructions via the secure tunnel connection, wherein the VNF management instructions include one of: updates, reconfigurations, or patches.

The present embodiments relate to a cloud shell extension framework. A cloud infrastructure (CI) service can invoke a cloud shell from a console to the CI. The service may request that context data to be added for use in a terminal session. The cloud shell extension can include a tool or script that can be used to obtain context data or sample code for preparing an environment specific to the service prior to the user interaction with the environment. The cloud shell extension can allow for a service to register an extension in the cloud shell framework, and their extension can be invoked when a client initiates the cloud shell with the service. The extension can allow for the invoked service to forward context data, such as environment variables, to be set in the terminal session for the client.

A method, apparatus and system for providing process-level forensics for a plurality of application containers includes for each of the plurality of application containers; monitoring forensics information of the application container, encoding the monitored forensics information using an encoder of a predetermined encoder/decoder pair to determine a forensics model, decoding the forensics model to determine a reconstructed representation of the forensics information, comparing the reconstructed representation of the forensics information to the monitored forensics information to determine an error and comparing the error to a threshold to determine if an error above the threshold exists. If the error is below the threshold, the forensics model is communicated to a higher-level manager to be used for higher-level management. If the error is above the threshold, the monitored forensics information of the application container is also communicated to the higher-level manager. The predetermined encoder/decoder pair is determined using an autoencoding process.

A new approach is proposed to support firewall protection of dynamically introduced routes in an internal communication network. Under the proposed approach, all routes dynamically introduced into the internal communication network via a dynamic routing service are dynamically learned and tagged by a route collection engine. A dynamic network object is created, which is a software component configured to store a plurality of single IP addresses and/or IP address ranges of the dynamically learned routes in a dynamic routing network. A firewall engine of the internal communication network is configured to create one or more firewall rules referencing the dynamic network object and apply various security measures/policies to network data packets routed on the dynamically learned routes in the dynamic routing network based on IP address matching with the dynamic network object.

The present disclosure provides technical solutions related to distributed IPSec gateway. A control plane and a data plane of the IPSec gateway are divided, a plurality of gateway processing nodes may be run in the data plane to process data packets of incoming ESP/AR traffic and/or data packets of outgoing IP traffic. IKE information interaction may be handled in the control plane and the traffic may be steered on each gateway processing node in the data plane.

Methods for provisioning and managing Internet-of-Things (IoT) devices over a network using device based tunneled nodes are provided. In one aspect, a method includes receiving, by a first network device in a network, data originated from an Internet-of-Things (IoT) device; identifying a device type of the IoT device by analyzing data packets of the received data; obtaining, by the first network device, a device profile for the IoT device, wherein the device profile is used for provisioning the IoT device to access the network; and provisioning the IoT device using the device profile, wherein the provisioning includes at least one of (1) identifying a tunneling attribute in the device profile; and (2) identifying a constrained application protocol (CoAP) parameter in the device profile, wherein the CoAP parameter is used to zero touch provision one or more device attributes of the IoT device. Systems and machine-readable media are also provided.

A network controller can register WAN edge routers and WAN optimizers distributed across a WAN. The controller can receive a request to establish a WAN optimized connection between first and second hosts. The controller can identify a first WAN optimizer to perform first services (e.g., de-duplication, compression, application acceleration, caching, etc.) for first traffic from the first host to the second host and first complementary services for second traffic from the second host to the first host, and a second WAN optimizer for the second traffic and second complementary services for the first traffic. The controller can establish the optimized connection comprising a first path including the first host, WAN optimizer, and router; a second path including the first router and a second router, and a third path including the second router, WAN optimizer, and host. The controller can route the first and second traffic through the optimized connection.

A method of separating identity IPs for identification of applications from the locator IPs for identifying the route is provided. A virtual service layer (VSL) protocol stack uses the IP addresses assigned by network administrators to the application endpoints to support the TCP/IP stack as the identity IP addresses that are not published to the underlay network for routing. On the other hand, the VSL stack uses the IP addresses assigned by the underlay network to the VSL enabled endpoints and VSL enabled routers as the locator IP addresses for routing packets. The VSL stack formats application flow packets with identity headers as identity packet and encapsulates identity packet with the locator header to route the packet. The separation of the identity and locator identifications are used to eliminate the network middleboxes and provide firewall, load balancing, connectivity, SD-WAN, and WAN-optimization, as a part of the communication protocol.

An internet end-user device includes a processor, a network interface controller; and a memory including instructions that, when executed by the one or more processors cause the end-user device to configure the end-user device to use a red network and perform dependency verification of the end-user device. A method includes configuring an end-user device to use a red network; and performing dependency verification of the end-user device. A non-transitory computer readable medium includes program instructions that when executed, cause an internet end-user device for use by end users to configure the end-user device to use a red network and perform dependency verification of the end-user device.

Certain edge networking devices such as application gateways may report status to a cloud-based threat management platform using a persistent network connection between the gateway and the cloud platform. Where a cloud computing platform for an edge networking device or the treat management platform imposes periodic timeouts, the threat management platform may monitor connects and disconnects for edge devices and asynchronously evaluate connection status of edge devices independently of a heartbeat or other signal through the persistent connection in order to distinguish periodic timeouts imposed by the cloud computing platform from networking devices that are compromised or malfunctioning.