For a network controller for managing hosts in a network, a method for configuring a host to resolve network addresses is described. The method configures an address resolution module in a host to resolve a network address. The method configures a managed forwarding element in the host to (1) avoid sending a request to resolve the network address to another host by using the address resolution module to resolve the network address and (2) forward packets using the resolved network address.

For a network controller for managing hosts in a network, a method for configuring a host to resolve network addresses is described. The method configures an address resolution module in a host to resolve a network address. The method configures a managed forwarding element in the host to (1) avoid sending a request to resolve the network address to another host by using the address resolution module to resolve the network address and (2) forward packets using the resolved network address.

Examples include a computing system having a plurality of processing cores and a memory coupled to the plurality of processing cores. The memory has instructions stored thereon that, in response to execution by a selected one of the plurality of processing cores, cause the following actions. The selected processing core to receive a packet and get an original tuple from the packet. When no state information for a packet flow of the packet exists in a state table, select a new network address as a new source address for the packet, get a reverse tuple for a reverse direction, select a port for the packet from an entry in a mapping table based on a hash procedure using the reverse tuple, and save the new network address and selected port. Translate the packet's network address and port and transmit the packet.

Examples include a computing system having a plurality of processing cores and a memory coupled to the plurality of processing cores. The memory has instructions stored thereon that, in response to execution by a selected one of the plurality of processing cores, cause the following actions. The selected processing core to receive a packet and get an original tuple from the packet. When no state information for a packet flow of the packet exists in a state table, select a new network address as a new source address for the packet, get a reverse tuple for a reverse direction, select a port for the packet from an entry in a mapping table based on a hash procedure using the reverse tuple, and save the new network address and selected port. Translate the packet's network address and port and transmit the packet.

The present disclosure envisages enforcing micro-segmentation policies on a user computer that intermittently migrates between a secured enterprise network and an unsecured network, for instance, a public network. The present disclosure envisages switching between appropriate micro-segmentation policies, in-line with the change in the current location of the user device, the change triggered by the user device migrating from the enterprise network to an unsecured network or vice-versa. The present disclosure envisages selectively enforcing micro-segmentation policies upon a user device based on the current location thereof, such that the micro-segmentation policies and the corresponding access permissions assigned to the user device differ in line with the current location of the user device, thereby exposing sensitive enterprise resources, forming a part of the enterprise network, in a selective and restricted manner, in line with the micro-segmentation policies enforced upon the user device based primarily on the current location of the user device.

Provided are methods, apparatus, and system for policy based wide area network. A network of network appliances is configured with a policy configuration. Each network appliance is configured to validate each wide area network packet against the policy configuration. The validation can include verifying that the packets meet the SD-WAN network segment requirements and security rules including verifying that the source and destination address of the packet meet the firewall zone requirements. Each wide area network packet contains a policy header that is checked by the sending and receiving network appliance against the policy configuration.

Provided are methods, apparatus, and system for policy based wide area network. A network of network appliances is configured with a policy configuration. Each network appliance is configured to validate each wide area network packet against the policy configuration. The validation can include verifying that the packets meet the SD-WAN network segment requirements and security rules including verifying that the source and destination address of the packet meet the firewall zone requirements. Each wide area network packet contains a policy header that is checked by the sending and receiving network appliance against the policy configuration.

A message encapsulation method and apparatus, and a message decapsulation method and apparatus are provided. The message encapsulation method includes encapsulating a first message according to a preset encapsulation format to obtain a second message, where the first message is obtained by encapsulating a traffic stream, the second message carries stream attribute information, and the stream attribute information is used for indicating a feature attribute of the traffic stream.

Techniques for virtualized network functions (VNFs) that provide for domain isolation of networks coupled to the VNF are described. A virtual network function (VNF) includes a cloud virtual domain coupling the VNF to a cloud service, a management virtual domain coupling the VNF to a management service, and an external virtual domain having a public Internet Protocol (IP) address. The external virtual domain receives an authentication request providing access credentials for a VNF customer from a cloud client device, provides the authentication request to the management service via the management virtual domain, receives an authentication response from the management service, and, in response to determining that the VNF customer access credentials are valid, initiates application of a policy that allows the cloud client device to configure the cloud virtual domain or the cloud service and disallows configuration of the external virtual domain and the management virtual domain.

Systems and methods of network packet switching use a table representation of a trie data structure to identify a timestamp (TS) range (or time range) for a received packet based on the packet timestamp (TS). The trie data structure is programmed with a plurality of predetermined time ranges. Each node in the trie data structure corresponds to a TS prefix and is associated with a corresponding predetermined time range. A search engine in the network switch can use the packet TS as a key to traverse the trie data structure and thereby matching the packet TS to a predetermined time range according to a Longest Prefix Match (LPM) process. Provided with the TS ranges of the incoming packets, various applications and logic engines in the network switch can accordingly process the packets, such as determining a new destination IP address and performing channel switch accordingly.