Abstract: Systems, methods, and non-transitory computer-readable storage media for dynamic host configuration protocol (DHCP) relay functionality in overlay networks. A system on a overlay network fabric can first receive a DHCP request from a host device, the system including a tunnel endpoint (TEP) configured to connect the host device to the overlay network fabric via a tunnel. The system then enables a relay agent information option for relaying the DHCP request with sub-options inserted into the DHCP request, and inserts information into to the sub-options in the DHCP request to yield a modified DHCP request. Here, the information can include an address of the system and an interface of a circuit associated with the system, etc. Next, the system forwards the modified DHCP request to a destination DHCP server based on an address of the destination DHCP server associated with the DHCP request.

Abstract: Systems, methods, and non-transitory computer-readable storage media for dynamic addressing of virtual port channels is described. In some implementations, a virtual IP address can be dynamically generated based on which links in a virtual port channel are active. If the numbers of active links in the virtual port channel changes, the virtual IP address can be dynamically changed. The virtual IP address can be dynamically adjusted by changing the values of individual bits in the virtual IP address that correspond to links in the virtual port channel. The virtual IP address can be used as a tunnel end point address in a VXLAN environment.

Abstract: Systems, methods, and non-transitory computer-readable storage media for a miscabling detection protocol. One or more switches can periodically send miscabling protocol (MCP) packets on non-fabric ports on all configured EPG VLANs. A first switch located at a network fabric receives a miscabling protocol (MCP) packet indicating an identity of an originating switch and a port number of an originating port of the MCP packet via a receiving port on the first switch, wherein the MCP packet is received from an external network connected to the receiving port, and wherein the originating switch and originating port are also located at the network fabric and connected to the external network. Based on the MCP packet, the first switch then detects a loop between the receiving port, the originating port, and the external network. Next, the first switch blocks the receiving port or the originating port in response to detecting the loop.

Abstract: Systems, methods and transitory computer-readable storage media for constructing a loop free multicast tree. The methods include observing a network topology transition affecting a first path from the particular node to a root node, calculating a second path from the particular node to the root node and sending a message to an upstream node requesting that the upstream node be a root port in the calculated second path. If the upstream node agrees to be the root port in the calculated second path, the method further includes creating a new FTAG tree topology view that includes the upstream node as the root port in the second path.

Abstract: Systems, methods and transitory computer-readable storage media for running a link state routing protocol in a network that includes spine and leaf nodes. The methods include, receiving at a node in a network, one or more LSPs and re-forwarding the LSPs to other nodes. A spine node generates copies of the received LSPs and forwards the copies of the LSP to the leaf nodes in the network at a rate that is faster than the rate that the leaf nodes re-route the LSPs to the spine nodes using a hardware flooding mechanism in order to reduce the amount of processing that occurs at each spine node. In order to synchronize the LSP databases, the spine nodes send triggered CSNPs, using hardware flooding, to all leaf nodes in the network.

Abstract: Systems, methods, and non-transitory computer-readable storage media for stage upgrades in a network. The system generates graph-data structured based representations of devices in the network, wherein respective attributes of the representations is selected based on respective services provided by the devices to tenants in the network and identities of respective tenants serviced by the devices. Next, the system generates a graph showing a distribution of the devices in the network according to the representations, wherein the representations are interconnected in the graph based on service roles of associated devices with respect to tenants in the network and other devices associated with the tenants. The system then schedules an upgrade of devices based on the graph, the upgrade being scheduled in stages, each stage including devices selected for upgrade in that stage, wherein the devices for each stage are selected by identifying devices having respective representations assigned to that specific stage.

Abstract: Systems, methods and non-transitory computer-readable storage media for determining interconnectivity in dense networks. The method includes generating, at a first network device in a data network, a traceroute packet that includes source and destination address information. The packet is encapsulated in an outer packet, and the encapsulated packet is forwarded to a second network device and to one or more intermediate network devices in the data network. A response packet is received from the second network device and each of the intermediate network devices that received the traceroute packet. The first network device determines, based on the responsive packets, an end-to-end path taken by the traceroute packet through the data network.

Abstract: A multi-stage network may include a first stage having a first plurality of switches, a second stage having a second plurality of switches, and a number of links between the first and second stages. A controller in communication with the first plurality of switches and the second plurality of switches may determine a priority path to be utilized by each switch in sending information and a fallback path. If the priority path includes a failed link, the controller implements in one or more of the switches the fallback path for sending the information. The fallback path may, for example, cause the information to be transmitted through a peer router.

Abstract: A computer network testing process to determine whether, given a network node that is unreachable by communication attempts from a controller on a control-plane network, the network node is still functioning to forward data packets on a data-plane network, or if the network node is fully non-functional on both the control-plane network and data-plane network. In order to make this determination, the testing process identifies a network node that is still reachable by the controller on the control-plane network, identifies a route between the controller and unreachable node, passing through the reachable node, and constructs an encapsulated test packet that is sent along this route. In response to sending the encapsulated test packet, the controller may, upon receipt of a confirmation packet, determine that the unreachable node is still functional on the data-plane network, or if no confirmation packet is received, mark the unreachable node as fully non-functional.

Abstract: Systems and methods utilize the data plane of an access switch to aid in providing control plane proxy services when the access switch is undergoing a software upgrade on its control plane. In one aspect, a method includes providing a peer switch with current state information of the host computer, encapsulating a control plane query packet sent from the host computer using a first hardware circuit of the access switch, forwarding the encapsulated control plane query packet to the peer switch using the first hardware circuit. The method further includes receiving a response to the control plane query packet from the peer switch using the first hardware circuit and directing the response to the host computer.

Abstract: A logically centralized controller provides a stateful firewall service provider on a network. The logically centralized controller routes a plurality of packets associated with a traffic flow to a firewall, and blocks, allows, or further monitors the traffic flow based on the inspection of the plurality of packets by the firewall. The logically centralized controller thereby prevents unauthorized network activity while allowing network traffic to bypass the bottleneck created by the firewall.

Abstract: Systems and methods are disclosed herein for anchoring a data session to a line card. The system includes a networking device that includes multiple line cards, which receive incoming packets from a link aggregation device. The line cards are communicatively coupled by a backplane to a routing control processor, which receives from the link aggregation device process information indicative of a process by which the link aggregation device determines to which line card data packets associated with a data session are forwarded. The routing control processor also receives a control packet requesting initiation of a new data session. Then, the routing control processor determines to which line card the link aggregation device will be forwarding data packets associated with the new data session based on the received process information and anchors the new data session based on the determined line card.

Abstract: An OpenFlow controller is provided to control network devices provided in a network to transmit a multicast data packet. The OpenFlow controller may intercept and examine an IGMP report packet send by one or more hosts to determine the hosts that are interested in receiving data sent by the host. The OpenFlow controller may send the IGMP report packet directly to a multicast-enabled WAN-edge router. Other network devices such as switches, access routers and intermediary routers that may be present in the network architecture do not perform any multicast control plane activity and hence, do not have to be multicast-enabled. According to various embodiments, the WAN-edge router is the only multicast enabled element of the network. The remaining elements are not required to be multicast-enabled because their responsibilities are performed by the OpenFlow controller.