H04L12/775

Securing Layer-3 virtual private network

A data packet from a sub-virtual routing and forwarding (sub-VRF) in a virtual routing and forwarding (VRF) is received. The VRF includes more than one sub-VRF. A value in a Border Gateway Protocol (BGP) attribute attached to the data packet is determined. Based on the value in the BGP attribute, whether to route the data packet to a different sub-VRF in the VRF is determined.

Packet Processing Method and Router
20210218669 · 2021-07-15 ·

This application discloses a packet processing method and an LSR. The method includes: receiving, by an Ingress LSR of a first MPLS tunnel, a first notification packet that is based on an IGP, where the first notification packet includes an ELC flag, which is used to indicate that the first Egress LSR has ELC; after learning from the first notification packet that the first Egress LSR has ELC, inserting a label into a first packet, to generate a second packet, where the label forms an MPLS label stack, which includes, from bottom to top, a first EL, a first ELI, and a first TL; and sending the second packet to the first Egress LSR through the first MPLS tunnel.

Method and system for sharing state between network elements
11082282 · 2021-08-03 · ·

A method for processing state information updates. The method includes receiving, by a coordination point, a plurality of state information from a plurality of network elements; processing at least one of the plurality of state information to generate a result; and applying the result to at least one of the plurality of network elements in order to modify an operation of the at least one of the plurality of network elements.

AUTOMATED NETWORK CHANGE SYSTEM

Methods, systems, and apparatus, for automatically changing a network system. A method includes receiving a set of first intents that describe a state of a first switch fabric; receiving a set of second intents that describe a state of a second switch fabric; computing a set of network operations to perform on the first switch fabric to achieve the second switch fabric, the set of operations also defining an order in which the operations are to be executed, and the set of operations determined based on the set of first intents, the set of second intents, and migration logic that defines a ruleset for selecting the operations based on the set of first intents and the second intents; and executing the set of network operations according to the order, to apply changes to elements within the first switch fabric to achieve the state of the second switch fabric.

Network information transmission systems
20210306166 · 2021-09-30 ·

A network information transmission system. The network information transmission system includes a packet handling device including a control plane configured to open a remote direct memory access (RDMA) connection with a destination external to the network information transmission system, an encapsulator configured to encapsulate one or more packets traversing the packet handling device, producing one or more encapsulated packets, and a transmitter configured to transmit the one or more encapsulated packets, via the RDMA connection, to the destination external to the network information transmission system. Related apparatus and methods are also described.

PEER-TO-PEER FEATURE EXCHANGE FOR EDGE INFERENCE OF FORECASTING MODELS

In one embodiment, a network element in a network receives one or more machine learning models configured to make an inference about the network. The network element requests, according to a predefined peering plan, telemetry attribute data from one or more peer network elements specified by the peering plan. The network element receives the telemetry attribute data from the one or more peer network elements. The network element makes, using the one or more machine learning models, an inference about the network based in part on the received telemetry attribute data.

Best path computation offload in a network computing environment

Systems, methods, and devices for offloading best path computations in a networked computing environment. A method includes storing in memory, by a best path controller, a listing of a plurality of paths learnt by a device, wherein each of the plurality of paths is a route for transmitting data from the device to a destination device. The method includes receiving, by the best path controller, a message from the device. The method includes processing, by the best path controller, a best path computation to identify one or more best paths based on the message such that processing of the best path computation is offloaded from the device to the best path controller. The method includes sending the one or more best paths to the device.

Automated network change system

Methods, systems, and apparatus, for automatically changing a network system. A method includes receiving a set of first intents that describe a state of a first switch fabric; receiving a set of second intents that describe a state of a second switch fabric; computing a set of network operations to perform on the first switch fabric to achieve the second switch fabric, the set of operations also defining an order in which the operations are to be executed, and the set of operations determined based on the set of first intents, the set of second intents, and migration logic that defines a ruleset for selecting the operations based on the set of first intents and the second intents; and executing the set of network operations according to the order, to apply changes to elements within the first switch fabric to achieve the state of the second switch fabric.

Remote socket splicing system
11012524 · 2021-05-18 · ·

A remote socket splicing system includes a first computing device and a second computing device that are coupled to a router device. A proxy system is coupled to the router device. The proxy system is configured to operate on a first connection with the first computing device through the first router device, and operate on a second connection with the second computing device through the first router device. The proxy system is also configured to send an instruction to perform a socket splicing operation to the first router device subsequent to operating on the first connection and the second connection. The first router device is configured to perform the socket splicing operation to provide a data path between the first computing device and the second computing device that does not include the proxy system.

MULTIPOINT MESH VIRTUAL PRIVATE NETWORK (MMVPN)
20210112036 · 2021-04-15 ·

The disclosure is directed to a method and system including a first node that stores a first multipoint mesh VPN database including a plurality of underlay addresses in an underlay network for a plurality of nodes, respectively, and a plurality of VPN addresses in a multipoint mesh VPN for the plurality of nodes, respectively. The first node also receives a second multipoint mesh VPN database from a second node, the second multipoint mesh VPN database including underlay and VPN addresses for the third node. The first node further receives a third multipoint mesh VPN database from the third node, the third multipoint mesh VPN database including underlay and VPN addresses for the second node. The first node additionally compares the databases to determine if underlay addresses and VPN addresses are missing from the first multipoint mesh VPN database.