Abstract: Techniques are described for dynamically establishing and scaling IPSec tunnels to connect hundreds of sites of a network by making use of the user intent of connecting certain applications for applying security policies and translating it dynamically based on the location and needs of the workloads to set up the network on demand. The techniques involve a tight loop between the network controller of a site (e.g., a cloud Application Policy Infrastructure Controller) and the inter-site or multi-cloud inter-connect controller, stitched through services that enable security and network automation at scale. In particular, to control the number of IPSec tunnels, IPSec tunnels are established only when required. Additionally, IPSec tunnels may be eliminated when no longer required. Thus, resources of a network may be used in a measured way that is necessary and sufficient to meet network traffic demand.

Abstract: Systems, methods, and computer-readable media for replicating data in a distributed storage cluster using an underlying network. In some examples, a primary node of a placement group in a network overlay of a distributed storage cluster can receive data for replication in the placement group. The primary node can provide the data to a first slave node of a plurality of slave nodes within the placement group in an underlying network of the distributed storage cluster. The data can subsequently be replicated using the underlying network by providing the data to at least one other slave node of the plurality of slave nodes within the placement group in the underlying network directly from the first slave node in the underlying network.

Abstract: Systems, methods, and computer-readable media for replicating data in a distributed storage cluster using an underlying network. In some examples, a primary node of a placement group in a network overlay of a distributed storage cluster can receive data for replication in the placement group. The primary node can provide the data to a first slave node of a plurality of slave nodes within the placement group in an underlying network of the distributed storage cluster. The data can subsequently be replicated using the underlying network by providing the data to at least one other slave node of the plurality of slave nodes within the placement group in the underlying network directly from the first slave node in the underlying network.

Abstract: Aspects of the disclosed technology relate to ways to determine the optimal storage of data structures across different memory device is associated with physically disparate network nodes. In some aspects, a process of the technology can include steps for receiving a first retrieval request for a first object, searching a local PMEM device for the first object based on the first retrieval request, in response to a failure to find the first object on the local PMEM device, transmitting a second retrieval request to a remote node, wherein the second retrieval request is configured to cause the remote node to retrieve the first object from a remote PMEM device. Systems and machine-readable media are also provided.

Abstract: Aspects of the subject technology relate to ways to determine the optimal storage of data structures in a hierarchy of memory types. In some aspects, a process of the technology can include steps for determining a latency cost for each of a plurality of fields in an object, identifying at least one field having a latency cost that exceeds a predetermined threshold, and determining whether to store the at least one field to a first memory device or a second memory device based on the latency cost. Systems and machine-readable media are also provided.

Abstract: Aspects of the subject technology relate to ways to determine the optimal storage of data structures in a hierarchy of memory types. In some aspects, a process of the technology can include steps for identifying a retrieval cost associated with retrieving a field in an object from data storage, comparing the retrieval cost for the field to a cost threshold for storing data in persistent memory, and selectively storing the field in either a persistent memory device or a non-persistent memory device based on a comparison of the retrieval cost for the field to the cost threshold. Systems and machine-readable media are also provided.

Abstract: Aspects of the disclosed technology relate to ways to determine the optimal storage of data structures across different memory device is associated with physically disparate network nodes. In some aspects, a process of the technology can include steps for receiving a first retrieval request for a first object, searching a local PMEM device for the first object based on the first retrieval request, in response to a failure to find the first object on the local PMEM device, transmitting a second retrieval request to a remote node, wherein the second retrieval request is configured to cause the remote node to retrieve the first object from a remote PMEM device. Systems and machine-readable media are also provided.

Abstract: Systems for high-performance computing. A method operates in a distributed storage cluster platform that has a storage pool and computing nodes that concurrently execute foreground tasks and background tasks. A uses interacts with a user interface to input specifications of background task time windows. Background tasks that run within the time frame of a background task time window are permitted to be scheduled at a relatively higher resource usage rate that consumes relatively higher cluster resources than do background task tasks that run outside of the background task time window. When the background task time window closes, the relatively higher resource usage rate of the running cluster background tasks is reduced to a relatively lower resource usage rate. Background tasks can self-observe the background task time windows and/or can be controlled by messages received from a virtualized controller that is designated to perform cluster-wide observations and to make cluster-wide determinations.

Abstract: Systems, methods, and computer-readable media for replicating data in a distributed storage cluster using an underlying network. In some examples, a primary node of a placement group in a network overlay of a distributed storage cluster can receive data for replication in the placement group. The primary node can provide the data to a first slave node of a plurality of slave nodes within the placement group in an underlying network of the distributed storage cluster. The data can subsequently be replicated using the underlying network by providing the data to at least one other slave node of the plurality of slave nodes within the placement group in the underlying network directly from the first slave node in the underlying network.

Abstract: Aspects of the subject technology relate to ways to determine the optimal storage of data structures in a hierarchy of memory types. In some aspects, a process of the technology can include steps for determining a latency cost for each of a plurality of fields in an object, identifying at least one field having a latency cost that exceeds a predetermined threshold, and determining whether to store the at least one field to a first memory device or a second memory device based on the latency cost. Systems and machine-readable media are also provided.

Abstract: Aspects of the disclosed technology relate to ways to determine the optimal storage of data structures across different memory device is associated with physically disparate network nodes. In some aspects, a process of the technology can include steps for receiving a first retrieval request for a first object, searching a local PMEM device for the first object based on the first retrieval request, in response to a failure to find the first object on the local PMEM device, transmitting a second retrieval request to a remote node, wherein the second retrieval request is configured to cause the remote node to retrieve the first object from a remote PMEM device. Systems and machine-readable media are also provided.

Abstract: A method for priority-based protection includes assigning a priority to each of a plurality of flows associated with a plurality of working paths, wherein each of the plurality of the flows has a unique priority. The method also includes determining that one or more of the working paths has failed, and determining the available bandwidth on a protection path upon the failure of the one or more of the working paths. In addition, the method includes determining the priority of the flows on the one or more failed working paths, and switching two or more flows from the one or more failed working paths to the protection path based on at least the priority of the two or more flows, the bandwidth of the working path and the available bandwidth on the protected path.

Abstract: A switch includes a processor coupled to a memory, one or more forwarding tables residing within the memory, and one or more ports. The ports are associated with a plurality of virtual local area networks and a plurality of bridge domains. Each of the bridge domains is associated with one of the forwarding tables, and each of the forwarding tables is associated with one of the bridge domains. The processor is configured to assign a first tag to a received packet, assign a second tag to the received packet, look up the destination address of the received packet in one of the forwarding tables, and selectively flood the ports of the active bridge domain with a copy of the received packet. The active bridge domain includes one of the plurality of bridge domains. The active bridge domain is associated with the ingress port of the received packet.

Abstract: A method may include, by a first network interface: receiving a packet having a flow via a first port of the first network interface; examining the packet to determine an ingress local forwarding identifier (LFID) associated with the flow of the packet; converting the ingress LFID to a global forwarding identifier (GFID) of the network element; and forwarding the packet to a switching element. The method may also include, by the switching element: determining a second network interface for egress of the packet based on the GFID; and forwarding the packet to the second network interface. The method may further include, by the second network interface: converting the GFID to an egress LFID associated with the flow of the packet; and forwarding the packet to a second port of the second network interface and a flow of the second network interface based on the egress LFID.

Abstract: In accordance with embodiments of the present disclosure, a switch may include a processor and a plurality of line cards, each line card including a table of addresses. The processor may be configured to: (i) read, from a first line card of the plurality of line cards, addresses relating to all flooding domains present on the first line card; (ii) store the addresses read from the first line card on a memory accessible to the processor; (iii) determine a second line card of the plurality of line cards, the second line card having the presence of at least one flooding domain not present on the first line card; (iv) read, from the second line card, addresses relating to all flooding domains present on the second line card; and (v) store the addresses read from the second line card on the memory.

Abstract: A method for reducing memory entries in a ternary content-addressable memory may include determining if a first entry and a second entry are associated with the same data value. The method may also include determining if the first entry can be masked such that searching the memory with the content value of either of the first entry or the second entry returns the same data value. The method may further include, in response to determining that the first entry and a second entry are associated with the same data value and determining that the first entry can be masked such that addressing the memory with the content value of either of the first entry or the second entry returns the same data value: (i) masking the first entry such that addressing the memory with the content value of either of the first entry or the second entry returns the same data value; and (ii) deleting the second entry.

Abstract: In accordance with embodiments of the present disclosure, a switch may include a processor and a plurality of line cards, each line card including a table of addresses. The processor may be configured to: (i) read, from a first line card of the plurality of line cards, addresses relating to all flooding domains present on the first line card; (ii) store the addresses read from the first line card on a memory accessible to the processor; (iii) determine a second line card of the plurality of line cards, the second line card having the presence of at least one flooding domain not present on the first line card; (iv) read, from the second line card, addresses relating to all flooding domains present on the second line card; and (v) store the addresses read from the second line card on the memory.

Abstract: A method and system for priority based (1:1)n Ethernet protection. The method and system includes assigning a priority to each of the flows associated with a working path. Upon fail of one or more of the working paths checking available bandwidth and priority of the flows. Once the request is complete, switching one or more flows to the protection path based on at least the priority of the flow, the bandwidth of the working path and the available bandwidth on the protection path. If a newly failed working path has a higher priority flow then dropping a flow from the protection path to a pending state. Once a working path has recovered, reverting the flow back to the working path and possibly admitting pending data to the protection path if the bandwidth and prioritization requirements are met.

Abstract: A method for networked communications includes receiving, on an inbound port, a frame to be forwarded, mapping the received frame to a flooding domain, determining an inbound port through which a frame is received, wherein the plurality of ports includes the inbound port, determining a destination address of the received frame, and determining one or more of the plurality of ports through which the received frame is to be forwarded. If the line card contains a port that is part of the flooding domain, the method includes populating a forwarding table associated with the line card with information regarding the received frame and information regarding the flooding domain. If the line card contains no ports that are part of the flooding domain, the method includes populating no forwarding tables associated with the line card with information regarding the received frame and information regarding the flooding domain.

Abstract: A method for reducing memory entries in a ternary content-addressable memory may include determining if a first entry and a second entry are associated with the same data value. The method may also include determining if the first entry can be masked such that searching the memory with the content value of either of the first entry or the second entry returns the same data value. The method may further include, in response to determining that the first entry and a second entry are associated with the same data value and determining that the first entry can be masked such that addressing the memory with the content value of either of the first entry or the second entry returns the same data value: (i) masking the first entry such that addressing the memory with the content value of either of the first entry or the second entry returns the same data value; and (ii) deleting the second entry.