Abstract: Aspects of the disclosure provide a system and method used for receiving Address Resolution Protocol (ARP) requests from access nodes and returning a designated address to satisfy a service provider' policies. This can include receiving a request from an access node at a provider edge node, and returning a designated Media Access Control (MAC) address in response to a request for a MAC address for a specified destination IP address, the designated MAC address being a MAC address for a node other than the provider edge node. This can effectively route requests to a Policy Enforcement point (PEP), which can be, for example a Broadband Services Router (BSR). A network controller can update ARP tables in the provider edge node to ensure that traffic which require policy enforcement can be routed to the PEP, whereas traffic which does not require policy enforcement can be normally routed towards the traffic's destination.

Abstract: Aspects of the disclosure provide a system and method used for receiving Address Resolution Protocol (ARP) requests from access nodes and returning a designated address to satisfy a service provider' policies. This can include receiving a request from an access node at a provider edge node, and returning a designated Media Access Control (MAC) address in response to a request for a MAC address for a specified destination IP address, the designated MAC address being a MAC address for a node other than the provider edge node. This can effectively route requests to a Policy Enforcement point (PEP), which can be, for example a Broadband Services Router (BSR). A network controller can update ARP tables in the provider edge node to ensure that traffic which require policy enforcement can be routed to the PEP, whereas traffic which does not require policy enforcement can be normally routed towards the traffic's destination.

Abstract: A network component comprising a receiver configured to receive an outgoing frame from a local host, a logic circuit configured to map a destination address (DA) for a target host in the outgoing frame to a DA for a target location of the target host and encapsulate the outgoing frame using the DA for the target location, and a transmitter configured to receive a pre-encapsulated outgoing frame from a local switch, and send the pre-encapsulated outgoing frame to a gateway at a target location, wherein the transmitter does not encapsulate frames received from local switches and decapsulates an incoming frame from a remote gateway destined towards local hosts.

Abstract: An apparatus including a service network and a plurality of Layer 2 sites connected by the service network via a plurality of gateways is provided. The gateways are configured to map a plurality of Internet Protocol (IP) addresses of a plurality of hosts under a plurality of virtual local area networks (VLANs) in a plurality of Layer 2 sites to a plurality of addresses (e.g., MAC or others) of the corresponding other gateways, inform the other gateways in other Layer 2 sites of the IP addresses mapped under each of the VLANs in the local Layer 2 sites, and forward data frames originated from the hosts in the local Layer 2 sites to the other gateways in the other Layer 2 sites when destinations of the data frames are residing in the other Layer 2 sites.

Abstract: A source routing method and apparatus are provided. The method includes receiving a data packet that comprises a destination address, a source address, and a payload, determining a plurality of next-hops along a service chain path between the source address and the destination address, generating a source routed data packet that comprises the destination address, the source address, the plurality of next-hops, and the payload, setting the destination address of the source routed data packet to a first next-hop from the plurality of next-hops along the service chain path, and forwarding the source routed data packet in accordance with the destination address.

Abstract: A service description may be used in network virtualization in order to specify requirements of an application. In order to provide network virtualization for generic networking components, including legacy networking components, the service description is mapped to a logical network implementation and then subsequently mapped to a physical implementation.

Abstract: A method of routing a packet from a source associated with a first VRF function instantiated on a device to a destination associated with a second VRF function instantiated on the device. The method comprises creating a logical link between a first logical interface on the first VRF function and a second logical interface on the second VRF function. The packet is routed from the source along the first VRF function to the first logical interface. The packet is transferred from the first logical interface to the second logical interface along the logical link. The packet is transferred from the second logical interface along the second VRF function to the destination. The first VRF function can be the same as the second VRF function.

Abstract: A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.

Abstract: An address resolution method, comprising obtaining an Internet Protocol (IP) address for a destination network node, computing a Media Access Control (MAC) address for the destination network node using a mapping function and the IP address for the destination network node, and sending data traffic using the MAC address computed for the destination network node.

Abstract: A network component including a receiver configured to receive a plurality of Internet Protocol (IP) addresses for a plurality of hosts in a plurality of external Layer 2 networks located at a plurality of physical locations and interconnected via a service, a logic circuit configured to map the IP addresses of the hosts in the external Layer 2 networks to a plurality of Media Access Control (MAC) addresses of a plurality of corresponding gateways in the same external Layer 2 networks, and a transmitter configured to send to the external Layer 2 networks a plurality of a plurality of IP addresses for a plurality of local hosts in a local Layer 2 network coupled to the external Layer 2 networks via the service.

Abstract: An embodiment method of loop suppression in a layer-two transit network with multiprotocol label switching (MPLS) encapsulation includes receiving a packet at a provider edge (PE) router for the layer-two transit network. The packet is stored in a non-transitory memory on the PE router. The packet is stored according to a packet data structure having an MPLS label field and a layer-two header. A time-to-live (TTL) attribute is then determined for the packet. The TTL attribute is written to the non-transitory memory in the MPLS label field. The packet is then routed according to information in the layer-two header.

Abstract: A source routing method and apparatus are provided. The method includes receiving a data packet that comprises a destination address, a source address, and a payload, determining a plurality of next-hops along a service chain path between the source address and the destination address, generating a source routed data packet that comprises the destination address, the source address, the plurality of next-hops, and the payload, setting the destination address of the source routed data packet to a first next-hop from the plurality of next-hops along the service chain path, and forwarding the source routed data packet in accordance with the destination address.

Abstract: A service chaining method comprising receiving a source routed data packet, wherein the source routed data packet comprises a destination address and identifies a plurality of next-hops along a service chain path, identifying a next-hop for the source routed data packet using the plurality of next-hops, determining whether the next-hop is source routing capable, setting the destination address of the source routed data packet in accordance with the determination, wherein the destination address is set to the next-hop when the next-hop is source routing capable, and wherein the destination address is set to a next downstream network node that is source routing capable when the next-hop is not source routing capable, and forwarding the source routed data packet to the next-hop.

Abstract: Routers using virtual routing and forwarding nodes to implement a service fabric of service chains. The router may configure M+1 virtual routing and forwarding instances, M being an integer representing a number of a plurality of service appliances in a data center network. Each virtual routing and forwarding instance may be associated with a routing table of routing rules to define various service chain routing paths. The routing rules are based on destination addresses in data packets.

Abstract: The devices, systems, and methods test network connectivity, where the physical network is used to provide one or more service chains connecting service appliances, including firewalls, intrusion detection systems, load balancers, network address translators, web servers, and so on. A service chain may involve multiple routing paths. The devices, systems, and methods test network connectivity test network connectivity by injecting customized echo request packets on each routing path and collecting customized echo reply packets in response. The customized echo reply packets are processed and aggregated to isolate network connectivity problems.

Abstract: A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.

Abstract: An embodiment method of loop suppression in a layer-two transit network with multiprotocol label switching (MPLS) encapsulation includes receiving a packet at a provider edge (PE) router for the layer-two transit network. The packet is stored in a non-transitory memory on the PE router. The packet is stored according to a packet data structure having an MPLS label field and a layer-two header. A time-to-live (TTL) attribute is then determined for the packet. The TTL attribute is written to the non-transitory memory in the MPLS label field. The packet is then routed according to information in the layer-two header.

Abstract: An address resolution method, comprising obtaining an Internet Protocol (IP) address for a destination network node, computing a Media Access Control (MAC) address for the destination network node using a mapping function and the IP address for the destination network node, and sending data traffic using the MAC address computed for the destination network node.

Abstract: A service chaining method comprising receiving a source routed data packet, wherein the source routed data packet comprises a destination address and identifies a plurality of next-hops along a service chain path, identifying a next-hop for the source routed data packet using the plurality of next-hops, determining whether the next-hop is source routing capable, setting the destination address of the source routed data packet in accordance with the determination, wherein the destination address is set to the next-hop when the next-hop is source routing capable, and wherein the destination address is set to a next downstream network node that is source routing capable when the next-hop is not source routing capable, and forwarding the source routed data packet to the next-hop.

Abstract: A method implemented by a hypervisor located in a first network device (ND), the method comprising sending to and receiving from a second ND a first type of packet, wherein each packet of the first type of packet comprises media access control (MAC) layer information of a client; and sending to and receiving from a third ND a second type of packet, wherein each packet of the second type of packet contains no client MAC layer information.