Abstract: Aspects of the subject disclosure relate to methods for detecting a link failure between the first network device and a destination node, receiving a data packet addressed to the destination node, and rewriting encapsulation information of the first data packet. Subsequent to rewriting the encapsulation information of the first data packet, the first data packet is forwarded to a second network device (e.g., using updated address information in the packet header), wherein the second network device is paired with the first network device in the virtual port channel. In certain aspects, systems and computer readable media are also provided.

Abstract: Aspects of the subject disclosure provide methods for avoiding a packet bounce event in a virtual port channel (VPC). A method of the technology can include steps for detecting a link failure event (e.g., between a first network device and a destination node), and receiving a data packet addressed to the destination node. In some implementations, the method can additionally include steps for rewriting encapsulation information of the first data packet. Systems and computer-readable media are also provided.

Abstract: Systems, methods, and non-transitory computer-readable storage media for translating source addresses in an overlay network. An access switch in an overlay network, such as a VXLAN, may receive an encapsulated packet from a tunnel endpoint in the overlay network. The encapsulated packet may originate from a host associated with the tunnel endpoint and be encapsulated at the tunnel endpoint with a first source tunnel endpoint address and a destination tunnel endpoint address. The access switch may replace the first source tunnel endpoint address in the encapsulated packet with a second source tunnel endpoint address of the access switch to yield a translated packet. The access switch may then transmit the translated packet towards the destination tunnel endpoint address.

Abstract: Systems, methods, and computer-readable media for improving debugging and troubleshooting of datacenter networks, and more particularly improving the speed of forwarding/data path related problems without going into ASIC level debugging. A switch could, for example, have a processor which communicates with an ASIC. The processor can receive flow information and a notification from the ASIC, the notification indicating a predefined error condition has been identified in a packet. The processor can modify the ASIC programming based on the notification, such that the ASIC records additional, more-detailed, flow information for the switch. The processor can then receive, from the modified ASIC, the additional flow information. The additional flow information can then be used (either by the processor or by an operator) to identify the exact reason for the errors in the flow path.

Abstract: Disclosed is a method for continuous in-line monitoring of data-centric traffic to guarantee application performance. The method includes, in each switch of a plurality of switches in a network fabric, grouping all packets entering each respective switch of the plurality of switches based on either 5-tuple applications or EPG based applications, collecting performance statistics at every hop in the network fabric across all flows in-line in a flow table maintained in each respective switch and periodically exporting the performance statistics to analysis module.

Abstract: A determination is made at a network connected device that a network policy is to be verified. The network policy is applied to network packets sent to an endpoint within a network, and the application of the policy to network traffic can result in at least two outcomes. Another determination is made at the network connected device that a switch is provisionable to host the endpoint. The network connected device provisions a simulated endpoint version of the endpoint at the switch to host the policy. At least one packet is sent to the simulated endpoint via the network connected device for each of the at least two outcomes of the policy. At least one response is received by the network connected device from the simulated endpoint indicating how the policy was applied to each of the packets.

Abstract: Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

Abstract: Systems, methods, and non-transitory computer-readable storage media for translating source addresses in an overlay network. An access switch in an overlay network, such as a VXLAN, may receive an encapsulated packet from a tunnel endpoint in the overlay network. The encapsulated packet may originate from a host associated with the tunnel endpoint and be encapsulated at the tunnel endpoint with a first source tunnel endpoint address and a destination tunnel endpoint address. The access switch may replace the first source tunnel endpoint address in the encapsulated packet with a second source tunnel endpoint address of the access switch to yield a translated packet. The access switch may then transmit the translated packet towards the destination tunnel endpoint address.

Abstract: Internet Group Management Protocol (IGMP) snooping includes flooding an IGMP query received at a border leaf switch from a multicast router connected to the multicast router to all host devices in a given bridge domain through leaf switches in the bridge domain, and receiving multiple join requests from the connected host devices at the leaf switches. The IGMP snooping also includes consolidating the multiple join requests received at the leaf switches into a multicast groups membership repository to indicate for each leaf switch the multicast group membership of interest in the given bridge domain, and sending the repository to the border leaf switch to enable the border leaf switch to send a consolidated IGMP proxy report on behalf of the leaf switches to the multicast router based on the repository and that indicates the multicast membership of interest in the given bridge domain.

Abstract: Systems, methods, and computer-readable media for improving debugging and troubleshooting of datacenter networks, and more particularly improving the speed of forwarding/data path related problems without going into ASIC level debugging. A switch could, for example, have a processor which communicates with an ASIC. The processor can receive flow information and a notification from the ASIC, the notification indicating a predefined error condition has been identified in a packet. The processor can modify the ASIC programming based on the notification, such that the ASIC records additional, more-detailed, flow information for the switch. The processor can then receive, from the modified ASIC, the additional flow information. The additional flow information can then be used (either by the processor or by an operator) to identify the exact reason for the errors in the flow path.

Abstract: Systems, methods, and non-transitory computer-readable storage media for translating source addresses in an overlay network. An access switch in an overlay network, such as a VXLAN, may receive an encapsulated packet from a tunnel endpoint in the overlay network. The encapsulated packet may originate from a host associated with the tunnel endpoint and be encapsulated at the tunnel endpoint with a first source tunnel endpoint address and a destination tunnel endpoint address. The access switch may replace the first source tunnel endpoint address in the encapsulated packet with a second source tunnel endpoint address of the access switch to yield a translated packet. The access switch may then transmit the translated packet towards the destination tunnel endpoint address.

Abstract: Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

Abstract: Systems, methods and computer-readable storage devices each provide, for a given flow entry in a flow table associated with a packet flow, a first atomic counter associated with a first color and a second atomic counter associated with a second color. The system, for a first coloring interval, marks traffic in the packet flow from a tenant to a fabric as the first color and increments the first atomic counter. At a conclusion of the first coloring interval and for a second coloring interval, the system marks the traffic in the packet flow from the tenant to the fabric as the second color and increments the second atomic counter. The system compares first packet counts associated with the first color at an ingress point with second packet counts associated with the first color at an egress point to the fabric.

Abstract: Aspects of the subject technology relate to solutions for transporting network traffic over an overlay network. A first tunnel endpoint in an overlay network can receive an encapsulated packet from a second tunnel endpoint. The encapsulated packet may have been encapsulated at the second tunnel endpoint based on another packet originating from a source host that is associated with the second tunnel endpoint. The encapsulated packet can include a source host address for the source host and a source tunnel endpoint address for the second tunnel endpoint. The first tunnel endpoint can then update a lookup table based on an association between the source host address and the source tunnel endpoint address.

Abstract: The subject technology addresses a need for improving utilization of network bandwidth in a multicast network environment. More specifically, the disclosed technology provides solutions for extending multipathing to tenant multicast traffic in an overlay network, which enables greater bandwidth utilization for multicast traffic. In some aspects, nodes in the overlay network can be connected by virtual or logical links, each of which corresponds to a path, perhaps through many physical links, in the underlying network.

Abstract: Systems, methods, and non-transitory computer-readable storage media for managing routing information in overlay networks. A first tunnel endpoint in an overlay network may receive an encapsulated packet from a second tunnel endpoint. The encapsulated packet may have been encapsulated at the second tunnel endpoint based on another packet originating from a source host that is associated with the second tunnel endpoint. The encapsulated packet can include a source host address for the source host and a source tunnel endpoint address for the second tunnel endpoint. The first tunnel endpoint can then update a lookup table based on an association between the source host address and the source tunnel endpoint address.

Abstract: The subject technology addresses the need in the art for improving utilization of network bandwidth in a multicast network environment. More specifically, the disclosed technology addresses the need in the art for extending multipathing to tenant multicast traffic in an IP overlay network, which enables the network to fully utilize available bandwidth for multicast traffic. In some examples, nodes in the overlay network may be connected by virtual or logical links, each of which corresponds to a path, perhaps through many physical links, in the underlying network.

Abstract: Aspects of the subject disclosure provide methods for avoiding a packet bounce event in a virtual port channel (VPC). A method of the technology can include steps for detecting a link failure event (e.g., between a first network device and a destination node), and receiving a data packet addressed to the destination node. In some implementations, the method can additionally include steps for rewriting encapsulation information of the first data packet. Systems and computer-readable media are also provided.

Abstract: Aspects of the subject disclosure relate to methods for detecting a link failure between the first network device and a destination node, receiving a data packet addressed to the destination node, and rewriting encapsulation information of the first data packet. Subsequent to rewriting the encapsulation information of the first data packet, the first data packet is forwarded to a second network device (e.g., using updated address information in the packet header), wherein the second network device is paired with the first network device in the virtual port channel. In certain aspects, systems and computer readable media are also provided.

Abstract: A determination is made at a network connected device that a network policy is to be verified. The network policy is applied to network packets sent to an endpoint within a network, and the application of the policy to network traffic can result in at least two outcomes. Another determination is made at the network connected device that a switch is provisionable to host the endpoint. The network connected device provisions a simulated endpoint version of the endpoint at the switch to host the policy. At least one packet is sent to the simulated endpoint via the network connected device for each of the at least two outcomes of the policy. At least one response is received by the network connected device from the simulated endpoint indicating how the policy was applied to each of the packets.