Abstract: In an example, there is disclosed a computing system, including: a processor; a memory; a configuration interface to a logic configuration unit; and a system compiler including: a first block compiler to compile logic for a first logical block in a first language, the first language being a domain-specific language (DSL) and the first logical block being switching logic for a network switch; a second block compiler to compile logic for a second logical block in a second language, the second language being a non-DSL and providing an external accelerator method not supported by the first language; and an interface compiler to define input/output channels for encapsulated data interchange between the first logical block and the second logical block, wherein the encapsulated data interchange is to target a resident instance of the external accelerator method.

Abstract: In one implementation, an original physical profile file and a configuration baseline are stored for a virtual machine. The physical profile file includes physical characteristics of a physical device running the virtual machine. The configuration baseline includes configuration settings or attributes of the instance of the virtual machine. A network device detects current value for at least one physical characteristic and compares the current value to the original physical profile file. When the current values deviate enough from the original physical profile file to exceed a threshold amount of deviation that is permissible, the network device determines that the virtual machine has been moved to another physical device. In response, the network device monitors current configuration settings or attributes with respect to the configuration baseline in order to detect an unauthorized usage of the virtual machine.

Abstract: In an example, there is disclosed a computing system, including: a processor; a memory; a configuration interface to a logic configuration unit; and a system compiler including: a first block compiler to compile logic for a first logical block in a first language, the first language being a domain-specific language (DSL) and the first logical block being switching logic for a network switch; a second block compiler to compile logic for a second logical block in a second language, the second language being a non-DSL and providing an external accelerator method not supported by the first language; and an interface compiler to define input/output channels for encapsulated data interchange between the first logical block and the second logical block, wherein the encapsulated data interchange is to target a resident instance of the external accelerator method.

Abstract: A method and apparatus for providing information in a network by way of a Pseudowire switching TLV is presented. A second device in the network receives a first message having information relating to a first device in the network. The second device appends information relating to the second device (by way of a Pseudowire switching TLV) to the first message, resulting in a second message. The second message is then forwarded to a third device in the network.

Abstract: A method and apparatus for providing information in a network by way of a Pseudowire switching TLV is presented. A second device in the network receives a first message having information relating to a first device in the network. The second device appends information relating to the second device (by way of a Pseudowire switching TLV) to the first message, resulting in a second message. The second message is then forwarded to a third device in the network.

Abstract: A method and apparatus for providing information in a network by way of a Pseudowire switching TLV is presented. A second device in the network receives a first message having information relating to a first device in the network. The second device appends information relating to the second device (by way of a Pseudowire switching TLV) to the first message, resulting in a second message. The second message is then forwarded to a third device in the network.

Abstract: In one implementation, an original physical profile file and a configuration baseline are stored for a virtual machine. The physical profile file includes physical characteristics of a physical device running the virtual machine. The configuration baseline includes configuration settings or attributes of the instance of the virtual machine. A network device detects current value for at least one physical characteristic and compares the current value to the original physical profile file. When the current values deviate enough from the original physical profile file to exceed a threshold amount of deviation that is permissible, the network device determines that the virtual machine has been moved to another physical device. In response, the network device monitors current configuration settings or attributes with respect to the configuration baseline in order to detect an unauthorized usage of the virtual machine.

Abstract: In an example embodiment, a method is provided to receive a request message. A client that transmitted the request message then is identified. Here, the client is associated with a client identifier. The client identifier is inserted into a response message, and this response message includes a redirect to a portal. The response message then is transmitted.

Abstract: Techniques for operating a network interface include automatically determining whether communications are terminated over a particular attachment circuit on a network interface on an intermediate network node at an edge of a provider network, whereby a sign of death (SOD) on the particular attachment circuit is indicated. The attachment circuit is switched with a particular virtual private network that is a link layer virtual private network (VPN) encapsulated in a higher layer protocol. The provider network is a packet-switched network. The network interface is for a direct communication link to a customer network node outside the provider network. If it is determined that there is an indication of the SOD, then a new network action is initiated in response to the SOD on the particular attachment circuit. These techniques allow for automatic logging of usage, billing, and fault detection, as well as for over-subscription of network resources for multiple VPNs.

Abstract: In one embodiment, software code in a respective computer system such as one or more data communication devices establishes multiple layer 2 network links between a first data communication device and a second data communication device. The first data communication device and the second data communication device include corresponding layer 3 interfaces enabling layer 3 network communications over each of the multiple layer 2 network links. The first and second data communication devices route traffic over one (e.g., a primary layer 2 link) of the multiple layer 2 network links using the layer 3 network communications. The private links are media independent. Upon detection of a failure associated with the primary layer 2 link, the data communication devices can automatically switch to sending traffic over a backup link of the multiple layer 2 network links without disrupting publicly advertised routing topology information.

Abstract: Techniques for configuring a particular network interface on a particular node at an edge of a provider network to support a particular virtual private network include receiving customer input data. The provider network is a packet-switched network and the particular virtual private network is a link layer virtual private network. The customer input data indicates a topology for customer equipment devices outside the provider network on the particular virtual private network, and may include properties for corresponding interfaces that connect the customer equipment devices to the edge nodes. Based on the customer input data, configuration data is determined for configuring the particular interface at the particular node. The particular node is caused to configure the particular interface based on the configuration data without human intervention. Among other effects, these techniques support zero-touch provisioning of virtual private networks.

Abstract: Conventional network packet traffic loss/drop monitoring mechanisms, such as that employed for pseudowire, IP flow and tunnel traffic monitoring, do not process or diagnose the aggregate counts from both endpoints of a particular pseudowire. A packet loss and detection mechanism periodically exchanges traffic packet counts to maintain an accurate diagnosis of the pseudowire health from either endpoint. Further, the raw packet counts are analyzed to identify misrouted and lost packets, as both should be considered to assess network health and congestion. The pseudowire statistics are maintained for each pseudowire emanating from a particular edge router, providing a complete view of pseudowire traffic affecting a particular edge router. Such statistics are beneficial for problem detection, diagnosis, and for verification of throughput criteria such as those expressed in Quality of Service (QOS) terms and/or SLAs (service level agreements).

Abstract: A method and apparatus for processing a signal on an intermediate network node at an edge of a provider packet-switched network to support a link-layer virtual private network includes receiving a signal on a particular interface. The particular interface is for a direct communication link to a customer network node outside the provider network. It is determined whether the signal indicates that the particular interface is changing from an inactive state to an active state, whereby the signal is called first sign of life (FSOL). If it is determined that the signal is FSOL, then configuration data is determined for configuring the particular interface for the particular virtual private network. The signal is processed based on the configuration data. These techniques allow a dynamic response to new signals on a customer interface without human intervention by the provider.

Abstract: A method and apparatus for performing Layer 2 (L2) interworking is presented. A L2 Protocol Data Unit (PDU) is received at an L2 Switching Entity (SE). The L2 PDU is converted to a normalized Pseudowire (PW) PDU. The normalized PW PDU is then forwarded to a Layer 3 (L3) Routing Entity (RE). The normalized PDU may be in the form of a predetermined L2 protocol or a L2 agnostic protocol.

Abstract: A method, apparatus and computer program product for routing data within a packet-switched network using a PW wherein the PW is terminated directly on the layer-3 routing device such that certain services and applications can be utilized is presented. The method, apparatus and computer program product receives an encapsulated layer-2 Protocol Data Unit (PDU) from a pseudowire emulating a service. The encapsulation is removed from the encapsulated layer-2 PDU and a layer-2 circuit associated with the pseudowire is terminated. The circuit is treated as an interface and the PDU is forwarded based on upper layer protocol information within the PDU.

Abstract: In an example embodiment, a method is provided to receive a request message. A client that transmitted the request message then is identified. Here, the client is associated with a client identifier. The client identifier is inserted into a response message, and this response message includes a redirect to a portal. The response message then is transmitted.

Abstract: A method and apparatus for configuring a network interface to support a virtual private network includes storing configuration data at a server on a host computer on the provider network. It is determined whether conditions are satisfied for sending the configuration data to a particular node at an edge of the provider network. If it is determined that conditions are satisfied, then the configuration data is sent to the particular node to cause the particular node to configure a particular interface for supporting a virtual private network over the provider network based on the configuration data without human intervention. The provider network is a packet-switched network and the particular virtual private network is a link layer virtual private network. The particular node is different from the host. The particular interface is for a direct communication link to a customer network node outside the provider network.

Abstract: A method, apparatus and computer program product for routing data within a packet-switched network using a PW wherein the PW is terminated directly on the layer-3 routing device such that certain services and applications can be utilized is presented. The method, apparatus and computer program product receives an encapsulated layer-2 Protocol Data Unit (PDU) from a pseudowire emulating a service. The encapsulation is removed from the encapsulated layer-2 PDU and a layer-2 circuit associated with the pseudowire is terminated. The circuit is treated as an interface and the PDU is forwarded based on upper layer protocol information within the PDU.

Abstract: A method and apparatus for configuring a network interface to support a virtual private network includes storing configuration data at a server on a host computer on the provider network. It is determined without human intervention whether conditions are satisfied for sending the configuration data to a particular node at an edge of the provider network without receiving a request message from the particular node. If it is determined that conditions are satisfied, then the configuration data is sent to the particular node to cause the particular node to configure a particular interface for supporting a virtual private network over the provider network based on the configuration data. The particular node is different from the host. These techniques allow changes in configuration data to be pushed to provider edge nodes without human intervention.

Abstract: A method and system for verifying the availability of a back-up virtual private network IP security (IPSec) tunnel between two network elements by originating a plurality of connection tests between the network elements. The first network element transmits a backup tunnel verification test message to the second network element over the back-up secure tunnel upon receipt of a backup tunnel verification test command. The back-up secure tunnel includes two unidirectional tunnels. The second network element receives the back-up tunnel verification test message over the first back-up unidirectional secure tunnel and transmits a response back to the first network element over the second back-up unidirectional secure tunnel.