Abstract: A method and system for steering network traffic towards a service device. Specifically, the disclosed method and system entail the installation of multiple service devices around a network. Service policies are cloned across the multiple service devices, and further, each service device is assigned common virtual routing and bridging addresses. Using at least these common virtual routing and bridging addresses, intercept virtual tunnel end points (VTEPs) redirect or bridge network traffic to a service device.

Abstract: In general, embodiments of the disclosure relate to a method for handling media access control (MAC) frames. The method includes receiving, by a service virtual tunnel end point (VTEP) and from a source VTEP, a first virtual layer-3 (VL3) frame comprising a dedicated virtual network identifier (VNI), decapsulating the first VL3 frame to obtain a first media access control (MAC) frame comprising a dedicated virtual local area network (VLAN) tag, replacing, in the first MAC frame, the dedicated VLAN tag with an original VLAN tag, and bridging the first MAC frame to a service device directly connected to a first network element on which the service VTEP is executing.

Abstract: In one embodiment, a method includes obtaining addresses of end hosts at a switch, the switch configured with a primary virtual local area network and a secondary virtual local area network, creating a private virtual local area network access list comprising the addresses of end hosts permitted to communicate on the secondary virtual local area network, and applying the private virtual local area network access list to interfaces connected to the end hosts permitted to communicate on the secondary virtual local area network. An apparatus is also disclosed.

Abstract: In one embodiment, a method includes receiving static profiles each comprising one or more properties of an operating environment, receiving a dynamic profile for identifying a configuration of an interface based on the static profile associated with said dynamic profile, associating the dynamic profile with one of the static profiles based on the operating environment of the interface, and automatically updating the association upon identifying a change in the operating environment. An apparatus is also disclosed.

Abstract: In one embodiment, a method includes identifying at a network device, characteristics of a distributed virtual switch comprising a control plane component and a plurality of data plane components, grouping the data plane components, and adapting operation of the distributed virtual switch for one or more groups of the data plane components based on the characteristics. An apparatus and logic are also disclosed herein.

Abstract: A method is provided in one example embodiment that includes detecting a migration of a virtual machine from an origination host to a destination host and comparing a first root bridge to a second root bridge to verify data link layer continuity of the virtual network on the destination host. The virtual machine is connected to a virtual network, the first root bridge is associated with the virtual network on the origination host and the second root bridge is associated with the virtual network on the destination host. The method may further include blocking the migration if the first root bridge and the second root bridge are not the same.

Abstract: An example method is provided and may include multicasting a discovery packet in an overlay network, which includes a Layer 2 scheme over a Layer 3 network; and identifying endpoints based on their respective responses to the discovery packet, where the endpoints are coupled across a multicast backbone. In more specific embodiments, the method may include identifying disconnected endpoints in the overlay network based on a lack of responses from the disconnected endpoints.

Abstract: In one embodiment, a method includes identifying common access control list (ACL) parameters and variable ACL parameters among a plurality of tenants in a network, mapping parameter values for the variable ACL parameters to the tenants, generating a multi-tenant access control list for the tenants, storing the multi-tenant access control list and mapping at a network device, and applying the multi-tenant access control list to ports at the network device. The multi-tenant access control list includes the common ACL parameters and variable ACL parameters.

Abstract: A network appliance that is part of a distributed virtual switch collects network flow information for network flows passing through the network appliance. The network flow information is encapsulated into packets as a data record for transport. Network flow exporter type information is added to the network flow records configured to indicate that the packets are from a distributed exporter. An option template is sent to the network flow data collectors that includes a device identifier that is configured to uniquely identify the network appliance. The packets are exported to the network flow data collector. The network flow data collector uses the network flow exporter type information and the device identifier to associate the network flow information with the distributed virtual switch.

Abstract: In one embodiment, a method includes identifying at a network device, characteristics of a distributed virtual switch comprising a control plane component and a plurality of data plane components, grouping the data plane components, and adapting operation of the distributed virtual switch for one or more groups of the data plane components based on the characteristics. An apparatus and logic are also disclosed herein.

Abstract: In one embodiment, a method includes identifying common access control list (ACL) parameters and variable ACL parameters among a plurality of tenants in a network, mapping parameter values for the variable ACL parameters to the tenants, generating a multi-tenant access control list for the tenants, storing the multi-tenant access control list and mapping at a network device, and applying the multi-tenant access control list to ports at the network device. The multi-tenant access control list includes the common ACL parameters and variable ACL parameters.

Abstract: A method is provided in one example embodiment that includes detecting a migration of a virtual machine from an origination host to a destination host and comparing a first root bridge to a second root bridge to verify data link layer continuity of the virtual network on the destination host. The virtual machine is connected to a virtual network, the first root bridge is associated with the virtual network on the origination host and the second root bridge is associated with the virtual network on the destination host. The method may further include blocking the migration if the first root bridge and the second root bridge are not the same.

Abstract: An example method is provided and may include multicasting a discovery packet in an overlay network, which includes a Layer 2 scheme over a Layer 3 network; and identifying endpoints based on their respective responses to the discovery packet, where the endpoints are coupled across a multicast backbone. In more specific embodiments, the method may include identifying disconnected endpoints in the overlay network based on a lack of responses from the disconnected endpoints.

Abstract: In one embodiment, a method includes receiving static profiles each comprising one or more properties of an operating environment, receiving a dynamic profile for identifying a configuration of an interface based on the static profile associated with said dynamic profile, associating the dynamic profile with one of the static profiles based on the operating environment of the interface, and automatically updating the association upon identifying a change in the operating environment. An apparatus is also disclosed.

Abstract: A network appliance that is part of a distributed virtual switch collects network flow information for network flows passing through the network appliance. The network flow information is encapsulated into packets as a data record for transport. Network flow exporter type information is added to the network flow records configured to indicate that the packets are from a distributed exporter. An option template is sent to the network flow data collectors that includes a device identifier that is configured to uniquely identify the network appliance. The packets are exported to the network flow data collector. The network flow data collector uses the network flow exporter type information and the device identifier to associate the network flow information with the distributed virtual switch.

Abstract: In one embodiment a method includes selectively controlling a virtual network switch to control a quality of service (QoS) for a flow associated with a virtual machine (VM). Controlling the QoS may include controlling the virtual switch to provide classification, congestion management, congestion avoidance, bandwidth limiting, traffic shaping, and/or priority manipulation. The method may also include migrating a policy associated with a virtual interface between the VM and the virtual switch from a first server to a second server when the VM is to be migrated from the first server to the second server. The migration may also include moving statistics associated with the policy. The method may include selectively adapting the policy or an existing policy on the receiving server when a discrepancy is detected between the policies. The method may include reserving resources to provide guaranteed minimum bandwidth, even without control of an ingress and egress queue.

Abstract: In one embodiment, a method includes receiving at a network device operating as a relay agent, a Dynamic Host Configuration Protocol (DHCP) request from an end host, inserting a group identifier into the DHCP request and forwarding the DHCP request to a DHCP server, the end host associated with a group identified by the group identifier, receiving a response from the DHCP server, and forwarding the response to the end host. The response includes configuration information for the end host, at least some of the configuration information selected based on the group identifier. An apparatus is also disclosed.

Abstract: In one embodiment, a method includes obtaining addresses of end hosts at a switch, the switch configured with a primary virtual local area network and a secondary virtual local area network, creating a private virtual local area network access list comprising the addresses of end hosts permitted to communicate on the secondary virtual local area network, and applying the private virtual local area network access list to interfaces connected to the end hosts permitted to communicate on the secondary virtual local area network. An apparatus is also disclosed.

Abstract: In one embodiment a method includes selectively controlling a virtual network switch to control a quality of service (QoS) for a flow associated with a virtual machine (VM). Controlling the QoS may include controlling the virtual switch to provide classification, congestion management, congestion avoidance, bandwidth limiting, traffic shaping, and/or priority manipulation. The method may also include migrating a policy associated with a virtual interface between the VM and the virtual switch from a first server to a second server when the VM is to be migrated from the first server to the second server. The migration may also include moving statistics associated with the policy. The method may include selectively adapting the policy or an existing policy on the receiving server when a discrepancy is detected between the policies. The method may include reserving resources to provide guaranteed minimum bandwidth, even without control of an ingress and egress queue.