Abstract: In general, embodiments described herein relate to methods and systems for automating the configuration of network devices. More specifically, embodiments of the invention relate to using configuration commands that specify protocol-specified relationships in order to generate granular (or specific) filtering rules (also referred to as rules). The rules are subsequently programmed into the network device.

Abstract: In general, embodiments described herein relate to methods and systems for automating the configuration of network devices. More specifically, embodiments of the invention relate to using configuration commands that specify protocol-specified relationships in order to generate granular (or specific) filtering rules (also referred to as rules). The rules are subsequently programmed into the network device.

Abstract: The invention is directed to techniques for initiating lawful intercept of packets associated with subscriber sessions on a network device of a service provider network based on identification triggers. A law enforcement agency may send an intercept request for a subscriber to an administration device of the service provider network. The administration device may then configure one or more identification triggers for the subscriber based on the intercept request. The techniques described herein initiate lawful intercept when one or more subscriber sessions on a network device match the one or more identification triggers. The techniques described herein include configuring trigger rules that include identification triggers for subscribers on a network device via a command line interface (CLI) of the network device. In addition, the techniques described herein include configuring identification triggers in a subscriber profile on an authentication device connected to a network device.

Abstract: Techniques are described for load balancing subscriber sessions across tunnel termination devices. A network device is described, for example, that includes a tunneling module that load balances subscriber sessions across a plurality of tunnel termination devices based on weightings associated with the tunnel termination devices. The weightings may be assigned to the tunnel termination devices by a user, or may be calculated by the network device based on resource constraints associated with the tunnel termination devices. The network device may calculate the weightings, for example, based on a maximum number of subscriber sessions supported by each of the tunnel termination devices. As one example, the techniques may be applied to load balance Point-to-Point (PPP) subscriber sessions across L2TP Network Servers (LNSs).

Abstract: A device associated with the authentication of a user on a network, i.e., an “authentication device,” initiates lawful interception of network traffic associated with the user. The authentication device communicates with a network service device, such as an edge router, providing network access or other services to the user to enable and disable monitoring of the network user. The authentication device may issue intercept requests to the network service device upon authenticating the network user during login or at any time while the network user's session is in progress. Upon receiving an intercept request from the authentication device, the network service device mirrors data packets flowing to and from the network user for which interception has been designated. The mirrored packets are sent to an analyzer, which analyzes the packets and provides packet analysis information to a law enforcement agency.

Abstract: The invention is directed to techniques for initiating lawful intercept of packets associated with subscriber sessions on a network device of a service provider network based on identification triggers. A law enforcement agency may send an intercept request for a subscriber to an administration device of the service provider network. The administration device may then configure one or more identification triggers for the subscriber based on the intercept request. The techniques described herein initiate lawful intercept when one or more subscriber sessions on a network device match the one or more identification triggers. The techniques described herein include configuring trigger rules that include identification triggers for subscribers on a network device via a command line interface (CLI) of the network device. In addition, the techniques described herein include configuring identification triggers in a subscriber profile on an authentication device connected to a network device.

Abstract: Techniques are described for load balancing subscriber sessions across tunnel termination devices. A network device is described, for example, that includes a tunneling module that load balances subscriber sessions across a plurality of tunnel termination devices based on weightings associated with the tunnel termination devices. The weightings may be assigned to the tunnel termination devices by a user, or may be calculated by the network device based on resource constraints associated with the tunnel termination devices. The network device may calculate the weightings, for example, based on a maximum number of subscriber sessions supported by each of the tunnel termination devices. As one example, the techniques may be applied to load balance Point-to-Point (PPP) subscriber sessions across L2TP Network Servers (LNSs).