Abstract: Techniques for automatically claiming switches of a tenant computer network by a remote, cloud-based network controller. A first seed switch is manually claimed by a user by implementing the remote, cloud-based network controller. After claiming the seed switch a set of switches immediately connected with the seed switch are identified by Device Connector logic in the seed switch and immediately connected switches. Switches directly connected to those switches are then identified using Device Connector logic of the switches. This process is performed iteratively by identifying immediately connected switches until all of the switches are identified. All or a subset of the identified switches can then be claimed by the remote, cloud-based controller based on a response from the tenant network user.

Abstract: Methods to secure against IP address thefts by rogue devices in a virtualized datacenter are provided. Rogue devices are detected and distinguished from a migration of an endpoint in a virtualized datacenter. A first hop network element in a one or more network fabrics intercepts a request that includes an identity of an endpoint and performs a local lookup for the endpoint entity identifier. Based on the lookup not finding the endpoint entity identifier, the first hop network element broadcasts a message such as a remote media access address (MAC) query to other network elements in the one or more network fabrics. Based on the received response, which may include an IP address associated with the MAC address, the first hop network element performs a theft validation process to determine whether the request originated from a migrated endpoint or a rogue device.

Abstract: Methods to secure against IP address thefts by rogue devices in a virtualized datacenter are provided. Rogue devices are detected and distinguished from a migration of an endpoint in a virtualized datacenter. A first hop network element in a one or more network fabrics intercepts a request that includes an identity of an endpoint and performs a local lookup for the endpoint entity identifier. Based on the lookup not finding the endpoint entity identifier, the first hop network element broadcasts a message such as a remote media access address (MAC) query to other network elements in the one or more network fabrics. Based on the received response, which may include an IP address associated with the MAC address, the first hop network element performs a theft validation process to determine whether the request originated from a migrated endpoint or a rogue device.

Abstract: Methods to secure against IP address thefts by rogue devices in a virtualized datacenter are provided. Rogue devices are detected and distinguished from a migration of an endpoint in a virtualized datacenter. A first hop network element in a one or more network fabrics intercepts a request that includes an identity of an endpoint and performs a local lookup for the endpoint entity identifier. Based on the lookup not finding the endpoint entity identifier, the first hop network element broadcasts a message such as a remote media access address (MAC) query to other network elements in the one or more network fabrics. Based on the received response, which may include an IP address associated with the MAC address, the first hop network element performs a theft validation process to determine whether the request originated from a migrated endpoint or a rogue device.

Abstract: A method and apparatus for providing tenant specific encryption is described herein. According to an embodiment, a transmission site receives a data packet for transmission or forwarding. The transmission site determines, based on information in a header of the data packet, that the data packet is to be encrypted before transmission or forwarding. Using the information in the header, the transmission site identifies an encryption key for the data packet. The transmission site generates, for the data packet, an additional header and populates the additional header with a destination port number based on a destination port header value of the data packet. The transmission site overwrites the destination port header value of the packet with data indicating that the data packet is encrypted and then encrypts an encapsulated packet within the data packet using the encryption key prior to transmitting or forwarding the data packet.

Abstract: A method and apparatus for providing tenant specific encryption is described herein. According to an embodiment, a transmission site receives a data packet for transmission or forwarding. The transmission site determines, based on information in a header of the data packet, that the data packet is to be encrypted before transmission or forwarding. Using the information in the header, the transmission site identifies an encryption key for the data packet. The transmission site generates, for the data packet, an additional header and populates the additional header with a destination port number based on a destination port header value of the data packet. The transmission site overwrites the destination port header value of the packet with data indicating that the data packet is encrypted and then encrypts an encapsulated packet within the data packet using the encryption key prior to transmitting or forwarding the data packet.

Abstract: A method and apparatus for creating management information specifications in a schema by a user. According to various embodiments of the method, a first file is defined by using a metaschema. The metaschema is represented in a schema definition format. Subsequently, a second file corresponding to the first file is defined. The second file includes directives for depicting various elements of a metaschema. The user is then prompted to fill various fields that correspond to the various elements of the metaschema. As a result, the management information specifications are included in a document corresponding to the metaschema. The management information specifications in the document are then converted to form the management information specifications into a metaschema document. The metaschema document represents a schema. The schema includes the management information specifications.

Abstract: A method and apparatus for creating management information specifications in a schema by a user. According to various embodiments of the method, a first file is defined by using a metaschema. The metaschema is represented in a schema definition format. Subsequently, a second file corresponding to the first file is defined. The second file includes directives for depicting various elements of a metaschema. The user is then prompted to fill various fields that correspond to the various elements of the metaschema. As a result, the management information specifications are included in a document corresponding to the metaschema. The management information specifications in the document are then converted to form the management information specifications into a metaschema document. The metaschema document represents a schema. The schema includes the management information specifications.