Abstract: Techniques for using more-specific routing to perform scalable Layer-2 (L2) stretching of subnets across hybrid-cloud environments. Routing tables in a public cloud may allow for routes that are more specific than the default local route, and the more-specific routes may be used to send all traffic to a dedicated, cloud router. The more-specific routes are set up for a VPC where a subnet resides such that the more specific-routes cover at least a portion of subnet range. The next hop for the more-specific routes point to the cloud router which is capable of doing host routing and segmentation extension. Thus, traffic originating from endpoints in a VPC is routed to the cloud router, and the cloud router determines whether the traffic is to be re-routed back to a destination endpoint in the VPC (or another cloud location), or sent to a destination endpoint residing in the on-premises site.

Abstract: Methods and apparatus for intelligent sharing and tighter integration between a service engine (SE) for network communication and a high-speed forwarding device, such that certain network flows may be offloaded from the SE to benefit from the high-speed forwarding capacity of such a device are provided. To accomplish the integration, an application binary interface (ABI) may be employed as an in-band high-priority communication protocol between the data planes of the SE and the high-speed forwarding device, and an application programming interface (API) may be utilized to leverage the ABI and any in-band or out-of-band channel to allow the master SE to control the high-speed slave device. Such integration techniques are not limited to a few specialized hardware components, but may also be applied to other types of hardware resources, such as flow tables, quality of service (QoS) tables, access control list (ACL) tables for security, forwarding and adjacency tables, etc.

Abstract: Automatic filter generation and maintenance comprises detecting, from network packets, an IP address and a first MAC address; the IP address and the first MAC address are used to determine that the IP address and another MAC address that are detected in second network packets is an illegal binding and the other MAC address is different from the first MAC address; causing a network element to create, in an ARP filter, based on the IP address and the first MAC address, rules that cause the network element to prevent an address resolution protocol table from including a binding that includes only one of the IP address and the first MAC address; in response to detecting the IP address and said another MAC address in the second network packets, preventing the address resolution protocol table from including the illegal binding that includes the IP address and the other MAC address.

Abstract: A method and system for rerouting data over a local area network is provided. The method comprises defining at least one port group associated with a bridging device, each port group including interfaces linked to the bridging device. A plurality of statuses for each port group is defined, the status being dependent on the individual statuses of the interfaces linked to the bridging device. At least one target port associated with each port group, each target port relating to a path for data. The method further comprises defining an action for each status of a port group and monitoring the status of the interfaces forming part of each port group. In response to determining the status of a port group, triggering the predefined action associated with the port group status at one of the port group's target ports.

Abstract: Automatic filter generation and maintenance comprises detecting, from network packets, an IP address and a first MAC address; the IP address and the first MAC address are used to determine that the IP address and another MAC address that are detected in second network packets is an illegal binding and the other MAC address is different from the first MAC address; causing a network element to create, in an ARP filter, based on the IP address and the first MAC address, rules that cause the network element to prevent an address resolution protocol table from including a binding that includes only one of the IP address and the first MAC address; in response to detecting the IP address and said another MAC address in the second network packets, preventing the address resolution protocol table from including the illegal binding that includes the IP address and the other MAC address.

Abstract: A method is disclosed for automatic filter generation and maintenance. From information transmitted on a network, a first device identifier and a second device identifier are detected. Based on the first and second device identifiers, a filter is automatically configured to deny network-transmitted information that attempts to establish an association between the first device identifier and a device identifier other than the second device identifier.

Abstract: Methods and apparatus for intelligent sharing and tighter integration between a service engine (SE) for network communication and a high-speed forwarding device, such that certain network flows may be offloaded from the SE to benefit from the high-speed forwarding capacity of such a device are provided. To accomplish the integration, an application binary interface (ABI) may be employed as an in-band high-priority communication protocol between the data planes of the SE and the high-speed forwarding device, and an application programming interface (API) may be utilized to leverage the ABI and any in-band or out-of-band channel to allow the master SE to control the high-speed slave device. Such integration techniques are not limited to a few specialized hardware components, but may also be applied to other types of hardware resources, such as flow tables, quality of service (QoS) tables, access control list (ACL) tables for security, forwarding and adjacency tables, etc.

Abstract: A method is disclosed for automatic filter generation and maintenance. From information transmitted on a network, a first device identifier and a second device identifier are detected. Based on the first and second device identifiers, a filter is automatically configured to deny network-transmitted information that attempts to establish an association between the first device identifier and a device identifier other than the second device identifier.

Abstract: A method is disclosed for automatic filter generation and maintenance. From information transmitted on a network, a first device identifier and a second device identifier are detected. Based on the first and second device identifiers, a filter is automatically configured to deny network-transmitted information that attempts to establish an association between the first device identifier and a device identifier other than the second device identifier.

Abstract: A method and system for rerouting data over a local area network is provided. The method comprises defining at least one port group associated with a bridging device, each port group including interfaces linked to the bridging device. A plurality of statuses for each port group is defined, the status being dependent on the individual statuses of the interfaces linked to the bridging device. At least one target port associated with each port group, each target port relating to a path for data. The method further comprises defining an action for each status of a port group and monitoring the status of the interfaces forming part of each port group. In response to determining the status of a port group, triggering the predefined action associated with the port group status at one of the port group's target ports.