Abstract: Systems and methods are provided for programming a network device. A method includes receiving a wild card entry at the network device, the network device including a ternary content addressable memory (TCAM) table and an exact match (EM) table. The method determines whether the wild card entry is compatible with the EM table. In response to determining that the wild card entry is compatible with the EM table, the method determines the available space in the EM table, the usage of the TCAM table, and at least one flow characteristic of the wild card entry. The method evaluates the determined available space in the EM table, usage of the TCAM table, and the at least one flow characteristic against a set of stored rules that select the EM table or the TCAM table. The method programs the wild card entry in the EM table or TCAM table based upon the selection.

Abstract: A method and system for propagating network traffic flows between end points based on service and priority policies. Specifically, the method and system disclosed herein entail configuring network elements with network-disseminated traffic management policies. Each traffic management policy guides the handling of a network traffic flow between origination and termination end points (i.e., source and destination hosts), which may be defined through data link layer, network layer, and/or transport layer header information, as well as group assignment information, associated with the source and destination hosts.

Abstract: Security policies are translated into access-control list entries and can be stored by switches in the computer network. When a new device is connected to the computer network, the device may be resolved to the group for which it is a member and an ACL entry may be created for the new device. In networks having redundant switches, the ACL entries may be stored by each redundant network switch.

Abstract: A method and system for inspecting unicast network traffic between end points residing within a same zone. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.

Abstract: A method and system for inspecting cross-zone network traffic between end points residing within different zones. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.

Abstract: A method and system for steering bidirectional network traffic to a same service device. Specifically, the disclosed method and system entail the maintaining and synchronization of link aggregation group (LAG) tables tied to a pair of LAG ports instantiated on a network element directly connected to a pair of peer linking service devices. Network traffic (i.e., MAC frames) arriving at the network element, from a first host and intended for a second host (e.g., indicative of a first direction of the network traffic), may be steered towards one of the pair of service devices based on hashing of information included in a received MAC frame in conjunction with the LAG table tied to the LAG port (of the pair of LAG ports) that which received the MAC frame.

Abstract: A system and method for host discovery and tracking in a network. Specifically, the disclosed system and method entail maintaining bindings pertinent to the mapping of any host in the network, by way of their host IP address, to a respective virtual tunnel end point (VTEP). More specifically, these bindings may include: (i) a host IP address to host MAC address binding or mapping; and (ii) a host MAC address to VTEP IP address binding or mapping. Further, these bindings may be especially significant towards directing network traffic to a host over virtual layer-3 (L3) protocols.

Abstract: A method and system for inspecting broadcast network traffic between end points residing within a same zone. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.

Abstract: A method and system for optimizing service device traffic management. Specifically, the method and system disclosed herein entail filtering network traffic flows directed to service devices, distributed throughout a network, for inspection. Through the aforementioned filtering, a targeted subset of network traffic flows may be identified and excluded from service device processing. The filtering thus alleviates traffic congestion and improves traffic throughput at the service device(s), thereby optimizing the management and/or processing of network traffic flows redirected to the service device(s).

Abstract: Methods and systems for managing network device fabrics. The methods and systems may entail the re-assignment of enforcement responsibilities, pertinent to one or more traffic management and/or access rules, from a service device to a network device fabric.

Abstract: A method and system for steering bidirectional network traffic to a same service device. Specifically, the disclosed method and system entail the maintaining and synchronization of link aggregation group (LAG) tables tied to a pair of LAG ports instantiated on a network element directly connected to a pair of peer linking service devices. Network traffic (i.e., MAC frames) arriving at the network element, from a first host and intended for a second host (e.g., indicative of a first direction of the network traffic), may be steered towards one of the pair of service devices based on hashing of information included in a received MAC frame in conjunction with the LAG table tied to the LAG port (of the pair of LAG ports) that which received the MAC frame.

Abstract: A method and system for inspecting cross-zone network traffic between end points residing within different zones. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.

Abstract: A method and system for inspecting unicast network traffic between end points residing within a same zone. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.

Abstract: A method and system for inspecting broadcast network traffic between end points residing within a same zone. Specifically, the method and system disclosed herein entail the provisioning of unique forward-service and reverse-service virtual network identifiers (VNIs), and corresponding virtual layer-2 (VL2) forward-service and reverse-service broadcast domains, respectively, to communications originating from and destined to intercept hosts.

Abstract: A method and system for propagating network traffic flows between end points based on service and priority policies. Specifically, the method and system disclosed herein entail configuring network elements with network-disseminated traffic management policies. Each traffic management policy guides the handling of a network traffic flow between origination and termination end points (i.e., source and destination hosts), which may be defined through data link layer, network layer, and/or transport layer header information, as well as group assignment information, associated with the source and destination hosts.

Abstract: A method and system for steering network traffic towards a service device. Specifically, the disclosed method and system entail the installation of multiple service devices around a network. Service policies are cloned across the multiple service devices, and further, each service device is assigned common virtual routing and bridging addresses. Using at least these common virtual routing and bridging addresses, intercept virtual tunnel end points (VTEPs) redirect or bridge network traffic to a service device.

Abstract: A method and system for steering network traffic towards a service device. Specifically, the disclosed method and system entail the installation of multiple service devices around a network. Service policies are cloned across the multiple service devices, and further, each service device is assigned common virtual routing and bridging addresses. Using at least these common virtual routing and bridging addresses, intercept virtual tunnel end points (VTEPs) redirect or bridge network traffic to a service device.

Abstract: A system and method for host discovery and tracking in a network. Specifically, the disclosed system and method entail maintaining bindings pertinent to the mapping of any host in the network, by way of their host IP address, to a respective virtual tunnel end point (VTEP). More specifically, these bindings may include: (i) a host IP address to host MAC address binding or mapping; and (ii) a host MAC address to VTEP IP address binding or mapping. Further, these bindings may be especially significant towards directing network traffic to a host over virtual layer-3 (L3) protocols.

Abstract: A method and system for steering bidirectional network traffic to a same service device. Specifically, the disclosed method and system entail the maintaining and synchronization of link aggregation group (LAG) tables tied to a pair of LAG ports instantiated on a network element directly connected to a pair of peer linking service devices. Network traffic (i.e., MAC frames) arriving at the network element, from a first host and intended for a second host (e.g., indicative of a first direction of the network traffic), may be steered towards one of the pair of service devices based on hashing of information included in a received MAC frame in conjunction with the LAG table tied to the LAG port (of the pair of LAG ports) that which received the MAC frame.

Abstract: In general, embodiments of the disclosure relate to a method for handling media access control (MAC) frames. The method includes receiving, by a service virtual tunnel end point (VTEP) and from a source VTEP, a first virtual layer-3 (VL3) frame comprising a dedicated virtual network identifier (VNI), decapsulating the first VL3 frame to obtain a first media access control (MAC) frame comprising a dedicated virtual local area network (VLAN) tag, replacing, in the first MAC frame, the dedicated VLAN tag with an original VLAN tag, and bridging the first MAC frame to a service device directly connected to a first network element on which the service VTEP is executing.