Network identifiers are extracted from route advertisements. A table associates virtual network identifiers with provider edge devices. When a virtual network identifier extracted from a route advertisement matches a virtual network identifier in the table, the route advertisement is propagated to the provider edge devices associated with that virtual network identifier in the table. The route advertisement is not propagated to provider edge devices not associated with that virtual network identifier in the table.

Techniques are described for generating a virtualized network function (VNF) descriptor (VNFD) indicative of resources for managing VNF components (VNFCs) across a plurality of virtualized infrastructure managers (VIMs) implemented in a virtualized computing environment configured in a user-specific configuration. A VNFD generator receives a solution description file (SDF) encoding user input pertaining to the user-specific configuration, and a VNFC descriptor encoding VNFC specific information. The SDF and VNFC descriptor are validated and translated to generate an abstracted VNFD that is independent of renderers implemented at the virtualized computing environment. The abstracted VNFD is translated to a VNFD that is specific to the renderers and VIM and VNFD-specific information at the virtualized computing environment.

Example data transmission methods and apparatus are described. In one example method, a data distribution point obtains a first correspondence between a first virtual extensible local area network identifier (VXLAN ID) and an address of a first terminal. The data distribution point receives a first VXLAN packet based on a tunnel of a first VXLAN, where the first VXLAN packet includes the first VXLAN ID and first data. The address of the first terminal is determined based on the first VXLAN ID carried in the first VXLAN packet and the first correspondence. The first distribution point sends the first data to the first terminal based on the address of the first terminal.

Systems are methods are described which allow for “zero-touch” provisioning (ZTP) to be used to seamlessly bring up devices such as Gateways/Access Points/Switches or any other networking devices connected over different uplink types such as aggregated links (Static LAG, LACP), trunk ports, and the like. Provisioning is adapted specifically for trunk and/or LACP ports in order to maintain the automation and optimization benefits typically provided by ZTP. A method can include transmitting a discover message, and receiving a response message based on the discover message. Then, determining whether a pre-defined extension is included in the response message that indicates a port type and a virtual local area network (VLAN) configuration. Automatic configuration of one or more ports and a VLAN can be performed as indicated by the pre-defined extension. Thus, ZTP can be restarted in accordance with the configuration of the network device.

A data communication network serves a user application in User Equipment (UE) over a Virtual Private Network (VPN) Gateway (GW), Application Function (AF), and Network Exposure Function (NEF). The user application in the UE transfers user data to a VPN application in the UE. The VPN application in the UE transfers the user data over a VPN to the VPN-GW for delivery to the NEF. The VPN-GW receives user data over the VPN and transfers the user data to the AF for delivery to the NEF. The AF receives the user data for delivery to the NEF and generates an Application Programming Interface (API) call with the user data. The AF transfers the API call to the NEF. The NEF receives the API call and responsively exposes the user data. The user data may comprise user signaling, and the UE may exchange user data with external systems over the VPN GW responsive to the user signaling.

A packet forwarding method includes obtaining, by a network device, a first tunnel identifier of a first packet. When the first tunnel identifier is a first value, and forwarding, by the network device, the first packet based on a first routing group in a virtual routing and forwarding (VRF) table. The first routing group consists of one or more local routes, and each next-hop outbound interface of the one or more local routes is a local outbound interface. The network device forwards the packet based on a local routing group including only a local route in the VRF table such that the packet is forwarded to a local virtual machine for processing, and is not forwarded to another tunnel endpoint device during packet forwarding.

Techniques are described for providing fast reroute for BUM traffic in EVPN. For example, a first provider edge (PE) device, elected as a designated forwarder (DF) of an Ethernet segment, configures a backup path using a label received from a second PE device of the Ethernet segment (e.g., backup DF) that identifies the second PE device as a “protector” of the Ethernet segment. For example, a routing component of the DF configures within a forwarding component a backup path to the second PE device, e.g., installing the label and operation(s) within the forwarding component to cause the forwarding component to add the label to BUM packets received from a core network. Therefore, when an access link to the local CE device has failed, the DF reroutes BUM packets from the core network via the backup path to the second PE device, which sends the BUM packets to the CE device.

A proxy device coupled to a network receives communications between a client and a server on the network. The proxy device operates transparently to the client and the server, while coupled to receive and process the communications from a node on the network via a network port in a one-armed configuration. The proxy device communicates packets of the communications with an external tool coupled to the proxy device via a tool port and operates transparently to the nod and the tool. In certain embodiments, the tool may be a network security device, such as a firewall.

A packet processing method is disclosed. According to the method, a first network device receives a first packet sent by a second network device, where the first packet includes a first group identifier corresponding to a VPN on the second network device, a first source device corresponding to the first packet belongs to the VPN, and the first source device is connected to the second network device. The first network device obtains a second group identifier based on a destination address of the first packet, where the second group identifier corresponds to the VPN on a third network device, a first destination device corresponding to the destination address of the first packet belongs to the VPN, and the first destination device is connected to the third network device. The first network device processes the first packet based on the first group identifier and the second group identifier.

Some embodiments of the invention provide a method for cloning a set of one or more applications implemented by a first set of machines connected through a first logical network that defines a virtual private cloud (VPC) in a set of one or more datacenters. The method detects that the first logical network does not have sufficient resources to process a set of network traffic destined for the set of one or more applications implemented by the first set of machines. Based on said detecting, the method uses a set of network configuration data that configures a set of logical forwarding elements (LFEs) of the first logical network to define a cloned, second logical network for connecting a cloned, second set of machines that implement a second set of one or more applications. The method uses the cloned, second logical network to process at least a subset of the network traffic destined to the set of applications.