Abstract: When communication from a first virtual device to a second virtual device is received, it is determined a first virtual interface associated with the first virtual device and a second virtual interface associated with the second virtual device. It is then determined a first security domain associated with the first virtual interface and a second security domain associated with the second virtual interface to implement a security policy between the first security domain and second security domain. The communication between the virtual devices is allowed or blocked.

Abstract: According to an example, a file transfer protocol data transmission method applied in a stack system includes an FTP server master process receiving a file transfer request from an FTP client, for a file requested by the file transfer request, the FTP server master process judging whether the file and the FTP server master process are in a same chassis, when the file and the FTP server master process are not in the same chassis, the FTP server master process sends a file transfer notice to an FTP server slave process running on a chassis which is in the stack system and which the file is in.

Abstract: A method is provided for a master apparatus of a Virtual Router Redundancy Protocol (VRRP) in a dual-homed node that is a part of a dual-homed network to implement a Layer 3 apparatus. The dual-homed network includes the dual-homed node and a Layer 2 MPLS-Transport Profile (MPLS-TP) network. The method includes monitoring a state of an uplink, when the monitoring detects that the uplink has a failure, notifying an original backup apparatus of the VRRP to perform a master-backup switch, and notifying a downlink apparatus of the master apparatus of the VRRP that a remote link has a failure, thereby causing the downlink apparatus to switch a working channel within the MPLS-TP network. The method includes, when a notification indicating that the master-backup switch has been performed is received from the original backup apparatus of the VRRP, switching to a backup apparatus of the VRRP.

Abstract: Based on an example, two forwarding pipelines are configured in a software defined networking (SDN) switch. After receiving, from an SDN controller, a flow entry adding instruction comprising a flow entry to be added and a table identifier (ID) indicating a flow table that the flow entry is to be added to, an SDN switch adds the flow entry into the flow table corresponding to the table ID, wherein the flow table is in the first forwarding pipeline or the second forwarding pipeline. If the flow table and its next flow table are in different forwarding pipelines, the SDN switch adds an action of forwarding to the internal interface to the flow entry.

Abstract: At least two Ethernet sub-interfaces are established on a first Ethernet interface and a second Ethernet interface of a first device, and each Ethernet sub-interface is assigned to a VLAN. The Ethernet sub-interfaces on the same Ethernet interface are assigned to different VLANs, and Ethernet sub-interfaces of the first Ethernet interface and the second Ethernet interface which belong to the same VLAN are added into a link-aggregation group to establish an aggregated link with a second device.

Abstract: A network management apparatus according to an example may configure virtual Media Access Control (MAC) addresses for virtual machines (VMs). A virtual MAC addresses may include a Uniqueness identifier (ID), a DC ID, a Device ID and a Host ID. A number of bytes of the virtual MAC address may be equal to a number of bytes of an actual MAC address of the VM. VMs accessing the same access layer device in the same data center may have the same Uniqueness ID, DC ID, and Device ID and have different Host IDs. VMs accessing different access layer devices and in the same data center may have the same Uniqueness ID and DC ID and have different Device IDs.

Abstract: According to an example, to forward a packet, an access layer device searches a Layer 2 forwarding table according to a source Media Access Control (MAC) address of the packet, and replaces the source MAC address with a mapped virtual MAC address in a matching Layer 2 forwarding entry. The Layer 2 forwarding table is searched according to a destination MAC address of the Ethernet packet. In response to determining that a Layer 2 forwarding entry matching the destination MAC address of the Ethernet packet does not include a MAC address mapped to the destination MAC address, Very Large Layer 2 (VLL2) network protocol encapsulation is performed on the Ethernet packet of which the source MAC address is replaced according to an egress port in the Layer 2 forwarding entry matching the destination MAC address; and the Ethernet packet encapsulated with a VLL2 network protocol header is sent via the egress port.

Abstract: A member device of a stacked switches system sends a first received unicast packet via an inter-group stack port which belongs to an aggregated stack link group on a forwarding path towards a different stack group when the first received unicast packet is to be egressed by another member device in the different stack group. The member device is further to send a second received unicast packet via an intra-group stack port on a forwarding path towards another member device in a same stack group when the second received unicast packet which is to be egressed by the another member device in the same stack group. The member device is further to send a third received unicast packet via a data port on the member device which associates with a egress port identification of the third received unicast packet when the third received unicast packet is to be egressed by the member device.

Abstract: According to an example, a service coordination apparatus may include a processor that is to determine whether each GLB node-pair in a node-pair state table is at a normal state after receiving a DNS request. If a GLB node-pair in the node-pair state table is not at the normal state, a second DNS response may be sent to a node sending the DNS request according to a DNS parsing list. If each GLB node-pair in the node-pair state table is at the normal state, a proximity list may be inquired. If a record corresponding to the DNS request is searched out from the proximity list, a first DNS response may be sent to the node sending the DNS request according to the searched out record. If not, a second DNS response may be sent to the node sending the DNS request according to the DNS parsing list.

Abstract: A network device maintains a sharing token bucket for all sessions in a semi-connection state; a packet is received by the network device; a flow control for the packet is performed by using the sharing token bucket when determining the packet conforms to the semi-connection state; and a flow control for the packet is performed by using a dedicated token bucket of a session corresponding to the packet when determining the packet conforms to a full-connection state.

Abstract: A controller of a virtual switch system receives an uplink packet forwarded by a SDN switch hosted on a server from a VM (virtual machine) hosted on the server. The controller determines an outgoing interface from at least two uplink interfaces on the SDN switch respectively corresponding to aggregated member ports of a physical switch by using an aggregation algorithm according to the uplink packet. The controller generates a first flow table entry and sends the first flow table entry to the SDN switch, wherein the first flow table entry is to instruct the SDN switch to forward a received uplink packet to the physical switch through the outgoing interface.

Abstract: A work mode negotiation method is disclosed. A core backbone (CB) device transmits a Mode Negotiate Request packet through an Ethernet port to a port extender (PE) device, wherein the Mode Negotiate Request packet carries a set of identifications of the PE devices for cascade. Next, the CB device receives a Mode Negotiate Reply packet through the Ethernet port sent by the PE device, and transmits a Mode Negotiate Acknowledge packet through the Ethernet port to the PE device. Finally, the CB device changes a current work mode of the Ethernet port from an Ethernet mode to a cascade mode after transmitting the Mode Negotiate Acknowledge packet.

Abstract: In an example, a method for message forwarding in a network includes a first network device learning Media Access Control (MAC) address information received from a second network device. The MAC address information includes a Virtual Local Area Network (VLAN) identifier (ID), an aggregated MAC address, and an aggregated MAC address mask. The first network device receives a message addressed to the VLAN ID and a destination MAC address, and forwards the message to the second network device according to the MAC address information.

Abstract: According to an example, a relay device receives a DHCP request packet sent from a DHCP client, in which the DHCP request packet includes a user information sub-option including a node identifier of the DHCP client. The relay device adds a node identifier of the relay device and path information of receiving the DHCP request packet by the relay device to a relay agent information sub-option in the DHCP request packet, and forwards the DHCP request packet to a DHCP server, so that the DHCP server determines network topology according to the user information sub-option and the relay agent information sub-option.

Abstract: In a process of establishing a tunnel between a Hub device and a Spoke device, the Hub device in a DVPN obtains a public address and port information of a device in a public network after the public address and the port information are translated through a NAT device. The Hub device transmits the public address and the port information of the Spoke device to a server in the DVPN, so that another Spoke device obtains the public address and the port information to establish a direct tunnel with the Spoke device.

Abstract: After a RB in a TRILL network starts or establishes neighbor relationships with other RBs, the RB sends a nickname conflict detection packet. After receiving the packet, a DRB replies with a response packet carrying nickname information corresponding to all LSPs in the LSDB to the RB. The RB receives the response packet sent from the DRB, checks whether a nickname has a conflict with nicknames of other RBs and regenerates a nickname that is not conflict with the nicknames of other RBs.

Abstract: When a node device receives a packet transmitted from a device connecting with the node device, the node device searches a public network address of a next hop in a first table according to a private address of the next hop, searches for an IPsec security association (SA) in a second table according to the public network address searched out, performs IPsec encapsulation for the received packet by use of the IPsec SA corresponding to the public network address, and transmits the packet.

Abstract: In an example of the present disclosure, a method for adjusting virtual machine resources is provided. A VIP for a virtual service is distributed, and a scheduling policy and virtual machines (VM) for the VIP may be configured. The VIP and the VMs corresponding to the VIP are configured on an underlying physical device. When status information of the VIP is received, a new VM may be added into the VMs corresponding to the VIP in response to the determination that the VIP is overloaded based on the status information of the VIP. The scheduling policy of the VIP may be used to distribute bearer services to the VMs corresponding to the VIP.

Abstract: According to an example, in an AC pool including a MAC and a plurality of LACs registered on the MAC, after a first LAC is registered on the MAC, the MAC issues a first traffic rule to the first LAC, wherein the first traffic rule redirects a discovery packet sent from an AP to the MAC. When receiving the discovery packet sent from the AP or receiving a discovery packet sent from the AP and forwarded via a LAC, the MAC selects, from a plurality of the LACs, a second LAC for handling the AP. The MAC generates a second traffic rule associated with the AP and the second LAC, and issue the second traffic rule to a plurality of the LACs, so that when another LAC receives a communication tunnel protocol packet sent from the AP, the other LAC redirects the communication tunnel protocol packet to the second LAC.

Abstract: According to an example of the present disclosure, in a method for calculating a spanning tree, a SDN controller virtualizes a plurality of SDN forwarding devices in a SDN as a virtual network bridge device, performs interaction of spanning tree protocol (STP) data unit packets with an external network device through the virtual network bridge device to calculate a spanning tree between the virtual network bridge device and the external network device according to a STP running on the SDN controller and information carried in a STP data unit packet from the external network device.