Abstract: A controller at an IP (e.g., client) layer in a multi-layer network can request a network topology map from another controller at an optical (e.g., server) layer in the multi-layer network. The controller at the optical layer of the network can use a layer mapping function and common attributes between the formats used to describe the network topology map at the two layers to generate a common layer abstraction model representing the network topology map stored at the controller at the optical layer of the network. A controller-to-controller interface can translate and/or send the common layer abstraction model to the controller at the IP layer for processing data on the network.

Abstract: Techniques are disclosed for providing automatic policy configuration for packet flows. For example, a computing device comprises a virtual node and one or more virtual execution elements coupled to the virtual node. The computing device may also comprise one or more processors configured to: receive a packet originating from an application workload hosted on the one or more virtual execution elements and destined for a remote destination device; determine the packet is part of a new packet flow; in response, configure, by a kernel of the computing device and without sending the packet to a user space of the computing device, a policy for a forward packet flow for the new packet flow; configure, by the kernel, a policy for a reverse packet flow associated with the forward packet flow; and send the packet toward the remote destination device in accordance with the policy for the forward packet flow.

Abstract: An example method includes receiving, from a network device, data indicating characterizations of network traffic on a plurality of ports of the network device; determining, by processing circuitry, for each port of the plurality of ports, an indicator of a port type for the port based on the data indicating the characterizations of network traffic on the plurality of ports, wherein the port type indicates a link type of network traffic exchanged by the port; and outputting, by the processing circuitry, the indicator of the port type to an output device.

Abstract: Methods and apparatus for processing and using signals transmitted by a device, e.g., a low cost beacon transmitter device, to facilitate making location determinations with regard to the transmitting device and/or making a decision of when or how to use location information generated based on received signals are described. In accordance with some features the processing performed on the received signal strength measurements is based on whether or not the device from which the signals are received is in motion. The size of a sample period used as a processing window when determining device location is based, in some embodiments, on the rate of motion. When and/or how to use location determinations are performed is also based on motion in some embodiments. Machine learning updates of location determination parameters, based on received signals, are disabled when the signals are from devices determined to be in motion.

Abstract: A disaggregated broadband network gateway (DBNG) control plane system may be configured to receive a first initialization packet associated with a user device via a first user plane and a second initialization packet associated with the user device via a second user plane. The DBNG control plane system may be configured to determine, based on at least one of the first initialization packet or the second initialization packet, one or more load balancing parameters. The DBNG control plane system may be configured to cause, based on at least one of the one or more load balancing parameters, a communication session for the user device to be established via the first user plane and not via the second user plane.

Abstract: A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.

Abstract: Techniques are described by which a network management system (NMS) provides a common user interface (UI) to enable a user to collectively configure network devices to establish an EVPN topology. For example, an NMS is configured to: generate data representative of a common UI comprising UI elements representing a plurality of network devices to be configured in an EVPN topology; receive, via the common UI, an indication of a user input selecting one or more of the UI elements representing selected network devices; generate UI elements representing a plurality of ports of the selected network devices; receive, via the common UI, an indication of a user input selecting the UI elements representing one or more selected ports; and generate, based on the one or more selected network devices and one or more selected ports, topology relationship information of the one or more selected devices to establish the EVPN topology.

Abstract: A device may receive license data identifying device licenses and organization licenses associated with an organization of users of a multi-tenant system, and may identify, in the license data, entitlements for licenses associated with the organization. The device may combine the entitlements to generate combined entitlements, and may determine an entitlement count of the combined entitlements. The device may add quantities of new entitlements to the entitlement count, and may identify, in the license data, roles of the users and capabilities associated with each of the roles. The device may map the entitlements and the capabilities to generate a mapping, and may authorize a particular user based on the mapping. The device may process usage of the entitlements, with a machine learning model, to predict future usage of the entitlements, and may determine entitlement recommendations based on the future usage. The device may provide the entitlement recommendations for display.

Abstract: A controller device manages a plurality of network devices. The controller device includes a memory comprising a configuration database including a set of stored network device configurations, wherein each stored network device configuration of the set of stored network device configurations corresponds to a network device of the set of network devices. Additionally, the controller device includes processing circuitry configured to receive an intent file corresponding to an intended configuration for the set of network devices; receive a message from a network device of the set of network devices indicating an out-of-band configuration change at the network device; and determine, based on a stored network device configuration corresponding to the network device and an actual configuration of the network device, whether the intent file is compatible with the out-of-band configuration change.

Abstract: A device may receive a configuration of a network device, where the configuration includes configuration blocks with references to high level objects. The device may receive an out-of-band configuration change from the network device, and may compare the out-of-band configuration change and the configuration to identify an impacted high level object. The device may determine an impacted reference and an impacted configuration block associated with the impacted high level object, and may determine whether to reject the out-of-band configuration change, accept the out-of-band configuration change, or merge the out-of-band configuration change with the configuration based on the impacted high level object, the impacted reference, and the impacted configuration block. The device may perform one or more actions based on determining whether to reject the out-of-band configuration change, accept the out-of-band configuration change, or merge the out-of-band configuration change with the configuration.

Abstract: The problem of bandwidth insufficiency within an Intermediate System-to-Intermediate System (IS-IS) flood reflection (FR) cluster, and its associated problem(s) of increased signaling failures (and increased crank-bank signaling attempts, also referred to as “signaling churn”) when traffic engineered (TE) paths are computed, is avoided by signaling a more realistic “available bandwidth” advertisement on the FR TE links.

Abstract: A network device includes one or more dies, wherein each die, of the one or more dies includes one or more packet forwarding components and a switch fabric component. The switch fabric component of a particular die, of the one or more dies, may be connected to the one or more forwarding components of the particular die, and may be configured to provide a switching plane for the one or more packet forwarding components of the particular die. A first die, of the one or more dies, may be connected to the one or more packet forwarding components of a second die of the one or more dies, and may be configured to provide a switching plane for the one or more packet forwarding components of the second die. The switch fabric component may be included in each of the one or more dies and the network device does not include a standalone switch fabric component.

Abstract: An access point, which is a Power over Ethernet (PoE) Powered Device (PD) measures input voltage and input current. The access point determines a power requirement of the access point based on the measured current, measured voltage, and information about power requirements of access point components or devices coupled to the access point a power requirement of the access point. The access point communicates the determined power request to a power sourcing equipment (PSE), e.g., a network switch in some embodiments, the access point further communicates one of measured input current and measured input voltage to the PSE. The PSE uses the information received from the access point, e.g., power request and power measurements to determine an amount of power to be granted to the access point. If the access point does not receive the requested power level the access point selects internal components and/or external devices to de-power.

Abstract: This disclosure describes techniques including assessing trust in a computer network. In one example, this disclosure describes a method that includes determining a level of trust that a first network entity has for a second network entity; determining a level of trust that the second network entity has for a third network entity; determining that the first network entity is separated from the third network entity by the second network entity; determining, based on the level of trust that the first network entity has for the second network entity and further based on the level of trust that the second network entity has for the third network entity, a level of trust that the first network entity has for the third network entity; and enabling, based on the level of trust that the first network entity has for the third network entity, the first network entity to perform an operation.

Abstract: In general, techniques are described for a creating a virtual network router via a user interface (UI) presented by a software defined network (SDN) architecture. A network controller comprising a memory and processing circuitry may perform the techniques. The memory may store the UI, while the processing circuitry may present the UI and execute a control node. The UI may graphically represent a topology of a network including first and second virtual networks. The UI may dynamically generate a graphical element representative of a virtual network router by which to interconnect the first and second virtual networks. The virtual network router may represent a logical abstraction of one or more policies that cause one or more of import and export of routing information between the first and second virtual networks. The control node configures the first virtual network and the second virtual network according to the one or more policies.

Abstract: A system comprising one or more processors configured to receive a query indicating one or more of filtering information, sorting information, or joining information and retrieve, from a first datastore, an intent graph for a network, wherein the intent graph comprises nodes representing components of the network and edges representing connections between the components. The one or more processors being further configured to select a subset of a plurality of network devices of the network based on the query and the intent graph retrieved from the first datastore and retrieve, from a second datastore, data received from the plurality of network devices of the network. The one or more processors being further configured to determine a response to the query based on the selected subset of the plurality of network devices and the data retrieved from the second datastore and output the response to the query.

Abstract: A network device sends, via a first port of the network device and to a server device, first traffic, wherein the server device provides a NFV service line card of the network device, and wherein the first traffic is at least one of first management plane traffic associated with the NFV service line card, first control plane traffic associated with the NFV service line card, or first data plane traffic associated with the NFV service line card. The network device receives, via a second port of the network device and from the server device, second traffic, wherein the second traffic is at least one of second management plane traffic associated with the NFV service line card, second control plane traffic associated with the NFV service line card, or second data plane traffic associated with the NFV service line card.

Abstract: A resource controller module of a network management system receives a request for an allocation of threads to perform a job associated with a job category for a tenant associated with the network management system. The resource controller module determines, based on the request, a number of available threads associated with the job category of the system at a particular time and causes, based on the request and the number of available threads associated with the job category at the particular time, a group of threads associated with the job category to be allocated to perform the job to be allocated to perform the job.

Abstract: Techniques are described for creating isolated pools of external, failover, and/or floating IP addresses. In one example, this disclosure describes a method including creating a plurality of virtual networks, creating a plurality of pools of external IP addresses, detecting a request to instantiate an object that identifies a specific pool from the plurality of pools of external IP addresses; and instantiating the object and configuring the object with an external IP address drawn from the specific pool. The pools of external IP addresses may be created and isolated on a per-namespace, per-service, or per-ingress basis.

Abstract: A cloud-based architecture includes a cloud-based network management system (NMS) that provides the management plane and one or more cloud-based NAC systems that provide NAC services, including end-point device authentication. The cloud-based NAC system may have multiple groups of authentication server instances. Each group may have multiple authentication server instances to allow the authentication service provided by the group to serve more client devices than a single authentication server instance alone. Different Groups can be configured differently to serve different tenant sets.