Abstract: A line card of a set of line cards is configured to be coupled to a set of switch-fabric cards to collectively define at least a portion of an orthogonal cross fabric without a midplane board. The line card has an edge portion, a first side and a second side, opposite the first side. The line card includes a set of first set of connectors and a second set of connectors. The first set of connectors is disposed along the edge portion on the first side of the line card and the second set of connectors is disposed along the edge portion on the second side of the line card.
Type:
Grant
Filed:
October 26, 2018
Date of Patent:
June 15, 2021
Assignee:
Juniper Networks, Inc.
Inventors:
Boris Reynov, Jack W. Kohn, Ben T. Nitzan, Venkata S. Raju Penmetsa, Oscar Diaz-Landa, Shreeram Siddhaye
Abstract: An auto-discovery route reflector (auto-discovery-RR) may obtain a route from an originating network device and may update a data structure to include at least some information contained in the route. The auto-discovery-RR may identify, based on the data structure, a plurality of target network devices, wherein the plurality of target network devices includes at least one route reflector (RR) and at least one route reflector client (RR-client). The auto-discovery-RR may send the route to the plurality of target network devices to facilitate establishment of a connection between the originating network device and at least one target network device of the plurality of target network devices.
Abstract: A node of an LSP may inform the ingress node of the LSP, for example via RSVP signaling, about its temporary unavailability for a certain time. In response, the ingress node can stop using any affected LSP(s) and divert the traffic to other LSPs. This provides a faster mechanism to signal traffic shift then traditional IGP overload which causes considerable churn into the network as all the nodes need to compute the SPF. It is sufficient for ingress node to be aware of this node maintenance and it can use information to divert the traffic to other equal cost multipath (ECMP) LSP(s), or other available LSP(s). If no alternative LSP path exists when the ingress node receives such a message, a new LSP can be built during this time and traffic diverted smoothly (e.g., in a make-before-break manner) before the node goes offline for maintenance.
Abstract: A separate dedicated channel is set up and used for tunnel keepalive exchanges. Using such a dedicated channel permits tunnel keepalives to be processed completely at forwarding plane, without needing to send them to the control plane for processing. This dedicated channel can implement its own sequencing (in a way that avoids the need to use the control plane for processing). Alternatively, this dedicated channel might not use sequencing at all.
Abstract: A network device may intercept, from an application associated with a user space of the network device, a request message to join a multicast group or to leave the multicast group. The request message may be addressed to a kernel of the network device. The network device may direct the request message to a service daemon associated with the user space of the network device. The network device may determine, using the service daemon, whether another application associated with the user space is a member of the multicast group. The network device may selectively generate, using the service daemon and based on whether the other application associated with the user space is the member of the multicast group, an advertisement message based on the request message, and transmit the advertisement message when the advertisement message is generated.
Abstract: A network node may receive a packet having an inner internet protocol (IP) header and an outer IP header. The inner IP header may be encrypted. The network node may generate a copy of the packet to obtain a copied packet. The network node may perform decryption on one of the packet or the copied packet to identify a recipient address of the inner IP header. The network node may update the outer IP header of the other of the packet or the copied packet to obtain an updated packet with an updated outer IP header. A destination address of the updated outer IP header may be updated to a tunnel endpoint of a receiving network node that is associated with the recipient address. The network node may route the updated packet according to the updated outer IP header.
Type:
Grant
Filed:
June 28, 2019
Date of Patent:
June 8, 2021
Assignee:
Juniper Networks, Inc.
Inventors:
Goutham Kondapavuluru, Vijay Sai Ram Paruchuri
Abstract: A network device receives a packet from a client device, and identifies, based on receiving the packet, a destination of the packet. The network device determines, based on information included in an application cache, an application associated with the destination of the packet, where the first network device, the client device, and the application cache are included in a first local network. The network device determines, based on the information included in the application cache, a policy rule associated with the application, and applies the policy rule to the packet.
Abstract: A first network device of a network receives first traffic and second traffic, and assigns a first priority to the first traffic and a second priority to the second traffic. The first network device provides, to a second network device, a first message requesting whether the second network device can process the first traffic, and receives, from the second network device, a first response with a first value indicating that the second network device can process the first traffic. The first network device establishes, with the second network device, a path that includes a first security association and a second security association. The first network device provides, to the second network device, the first traffic with the first priority, via the first security association of the path, and the second traffic with the second priority, via the second security association of the path.
Abstract: A first device may provide, to a second device, a first message that includes a first request for a first type of precision time protocol (PTP) message and a second request for a second type of PTP message. The first device may receive, from the second device, a second message based on the first message. The second message may identify whether the first request and the second request are granted. The first device may provide, to the second device, a third message that instructs the second device to provide a first set of messages, associated with the first type of PTP message, and a second set of messages associated with the second type of PTP message. The first device may synchronize a first clock of the first device with a second clock of the second device based on the first set of messages and the second set of messages.
Abstract: A first device may receive a packet that includes information identifying a path through a network. The first device may configure a header of the packet to include a first set of identifiers that identifies the path and the first device via which the packet was received. The first device may configure the header of the packet to include a second set of identifiers that identifies a set of devices associated with the path. The set of devices may be associated with providing the packet via a network. The first device may determine whether a counter associated with the first set of identifiers has been initialized. The first device may modify a value of the counter to record a metric. The first device may provide the packet to a second device. The first device may perform an action related to the packet or based on the value of the counter.
Abstract: A device receives end user device information for end user devices associated with a network, and creates a data structure that includes the end user device information. The device creates a data structure that includes false account credentials, and maps the end user device information and the false account credentials to create a mapped data structure. The device provides the false account credentials to memory locations of corresponding ones of the end user devices, and provides information from the mapped data structure to one or more network devices associated with the network, wherein the information from the mapped data structure enables the one or more network devices to detect an unauthorized access attempt of the network using one or more of the false account credentials.
Abstract: In one embodiment, an apparatus can include a switch fabric. The apparatus can also include a first edge device operatively coupled to an edge of the switch fabric and having a plurality of ports. The apparatus can also include a second edge device operatively coupled to the edge of the switch fabric and having a plurality of ports, the switch fabric defining a plurality of single-hop paths between the first edge device and the second edge device. The first edge device configured to send to a peripheral processing device operatively coupled to the first edge device a representation of a mapping of a portion of the plurality of ports of the first edge device and a portion of the plurality of ports of the second edge device to a plurality of ports included in a non-edge device represented within a virtual multi-hop network topology.
Type:
Grant
Filed:
November 22, 2019
Date of Patent:
June 1, 2021
Assignee:
Juniper Networks, Inc.
Inventors:
Joseph L. White, Simon Jonathan Gordon, Suresh Boddapati
Abstract: Load balancing in a network section implementing VRRPv3 may be supported in a way that is easier to implement than that described in § 4.2 of RFC 5798.
Abstract: Echo or traceroute functionality is supported in a path spanning multiple autonomous systems (ASes) having segment routing (SR) enabled, the path including an ingress node and an egress node, by: (a) obtaining a return label stack to reach the ingress node from either (A) the egress node, or (B) a transit node in the path; (b) obtaining a label stack to reach, from the ingress node, either (A) the egress node, or (B) the transit node; (c) generating a request message including the return label stack; and (d) sending the request message towards either (A) the egress node, or (B) the transit node using the label stack.
Abstract: A device may determine a boot up identifier for the device using information related to a deployment of the device. The boot up identifier may identify the deployment of the device. The device may perform a comparison of the boot up identifier and a provisioned identifier to determine whether the deployment of the device and an intended deployment of the device match. The provisioned identifier may identify the intended deployment of the device. The device may perform a boot up of the device in a particular mode of operation based on a result of the comparison. The comparison may indicate whether the deployment of the device and the intended deployment of the device match. The particular mode of operation may cause the device to boot up to recover or reconfigure the device.
Abstract: A network device may receive a timing control packet from a first client device. The network device may determine that the network device is in a synchronized state relative to a network grandmaster clock. The network device may modify a first field of a header of the timing control packet to indicate that the network device is in a synchronized state. The network device may modify a second field of the header of the timing control packet to indicate a time at which the network device received the timing control packet from the first client device. The network device may forward, via the network, the timing control packet toward a second client device.
Type:
Grant
Filed:
January 31, 2020
Date of Patent:
May 11, 2021
Assignee:
Juniper Networks, Inc.
Inventors:
Kamatchi S. Gopalakrishnan, Rajagopalan Subbiah, Julian Kazimierz Lucek
Abstract: In general, the disclosure describes techniques for assigning traffic originating from an unknown application to a link based on known application quality of experience metrics. For instance, a network device may receive an application data packet of a data flow for an application and determine an application signature of the application data packet. The network device may determine whether the application signature matches an entry in an application signature database, and if the application signature does not match, the network device may identify a class of the application based on one or more characteristics of the application data packet. The network device may then assign the application data packet of the data flow to a first link of a plurality of links based on the class of the application and quality of experience (QoE) metrics for each link.
Type:
Grant
Filed:
March 14, 2019
Date of Patent:
May 11, 2021
Assignee:
Juniper Networks, Inc.
Inventors:
Bhaskar Jain, Rajneesh Kumar, Ravi Kumar G V Subrahmanya, Sai Sundar Ramamurthy, Unni Dilip, Vijay Sai Ram Paruchuri, Sanjay Kumar Gupta
Abstract: An example control plane that is executed on one or more processors in a distributed computing system is configured to receive an indication of a node to be onboarded into the distributed computing system, wherein the node comprises one of a compute node or a network device node, to discover one or more compute resources or network device resources that are associated with the node, and to assign, based on the discovery, the node to a collector that is executed in the distributed computing system, wherein the collector is configured to collect real-time telemetry data for the node during operation of the node. The control plane is further configured to receive, from the collector, the real-time telemetry data for the node that is collected by the collector, and to output, for display, a visual representation of the real-time telemetry data for the node.
Abstract: Techniques are described for avoiding traffic black-holing in a multi-homed Ethernet virtual private networks (EVPNs) in which a customer device (CE) is multi-homed to a plurality of multi-homing provider edge devices (PEs) via respective links of an Ethernet segment. An overlay network is created over the Ethernet segment, and the multi-homing PEs of the EVPN are configured with a common anycast IP address for respective virtual network interfaces. Upon election as active designated forwarder (DF) for the EVPN, the DF PE of the multi-homing PEs advertises toward the customer network an IGP metric for the anycast IP address that is lower than the IGP metric(s) advertised by any of the non-DF standby PE routers segment to direct the CE to forward network packets from the customer network to the DF PE over the respective link of the Ethernet segment.
Abstract: A network node may determine parameters of an authenticated client session for a client device, wherein the parameters comprise a network address of the client device. The network node may determine inactivity of the client device in the authenticated client session. The network node may generate, based on determining the inactivity of the client device, an address resolution protocol (ARP) message or a neighbor solicitation (NS) message to send to the client device, wherein the ARP message or the NS message is to trigger a response from the client device to indicate that the network address of the client device is in use. The network node may provide, toward the client device, the ARP message or the NS message. The network node may perform one or more actions based on receiving or not receiving the response, from the client device, to the ARP message or the NS message.