Abstract: Example method includes: receiving a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule and an action to be performed by a network function on a network packet in response to the rule being matched; identifying a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions; creating an atomic address object representing the identified set of header address spaces; and verifying the plurality of intent-based network policies using the atomic address object.

Abstract: Described herein are methods, network devices, systems, and computer-readable media that provide a technical solution for runtime monitoring and visualization of intent-based network policies in a manner that bridges the gap between high-level insights from runtime and low-level network device configurations. A network topology and a plurality of network configurations can be received in an intent-based network and a number of monitoring spots available within the network topology for runtime monitoring of an intent-based network policy among a plurality of intent-based policies can be determined. A plurality of runtime constraints including one or more of time, resource capacity, and bandwidth demand can then be determined based on the network topology and the plurality of network configurations.

Abstract: An example method including identifying an intent-based stateful network having a first endpoint, a second endpoint, and one or more devices performing stateful network functions between the first endpoint and the second endpoint. Further, constructing a causality graph of the network, the causality graph having a plurality of nodes for each of the one or more devices performing stateful network functions, wherein the connecting comprises connecting the first endpoint, the second endpoint, and the one or more devices performing stateful network functions to show causal relationships between the first endpoint and the second endpoint and the one or more devices performing stateful network functions. Also, determining whether the connections between the first endpoint, the second endpoint, and the one or more devices performing stateful network functions provide a path from the first endpoint and the second endpoint, and updating, incrementally, the causality graph as a change to the network occurs.

Abstract: Example method includes: receiving a network topology and a plurality of network configurations in an intent-based network; determining a number of spots available for runtime monitoring of an intent-based network policy among a plurality of intent-based policy in the intent-based network; determining a plurality of runtime constraints comprising one or more of time, resource capacity, and bandwidth demand based on the network topology and the plurality of network configurations; based on the plurality of runtime constraints, generating a runtime monitoring schedule that comprises at least a flow, a spot assigned for runtime monitoring of the flow, and a runtime monitoring rule to be applied at the assigned spot; and monitoring the flow based on the runtime monitoring schedule at the assigned spot.

Abstract: Example method includes: receiving a plurality of intent-based network policies in a network, wherein each intent-based policy comprises at least a rule and an action to be performed by a network function on a network packet in response to the rule being matched; identifying a set of header address spaces comprising a plurality of addresses that match to a same set of rules and actions; creating an atomic address object representing the identified set of header address spaces; and verifying the plurality of intent-based network policies using the atomic address object.

Abstract: Example method includes: identifying three relationships about a network function in an intent-based stateful network—(1) the network function forwarding a network packet implies that at least one previous network packet was received by the network function in the same direction prior to the network packet is forwarded, (2) an established state in the network function implies that at least one previous network packet was received at the network function, (3) the network function receiving the network packet as a downward network function implies the network packet was previously sent by a second network function acting as an upward network function; encoding the network function using a combination of at least one of the three identified relationships; and verifying a plurality of network intents in the intent-based stateful network based at least in part on the encoding of the network function.

Abstract: An example method including identifying an intent-based stateful network having a first endpoint, a second endpoint, and one or more devices performing stateful network functions between the first endpoint and the second endpoint. Further, constructing a causality graph of the network, the causality graph having a plurality of nodes for each of the one or more devices performing stateful network functions, wherein the connecting comprises connecting the first endpoint, the second endpoint, and the one or more devices performing stateful network functions to show causal relationships between the first endpoint and the second endpoint and the one or more devices performing stateful network functions. Also, determining whether the connections between the first endpoint, the second endpoint, and the one or more devices performing stateful network functions provide a path from the first endpoint and the second endpoint, and updating, incrementally, the causality graph as a change to the network occurs.

Abstract: Example method includes: identifying three relationships about a network function in an intent-based stateful network—(1) the network function forwarding a network packet implies that at least one previous network packet was received by the network function in the same direction prior to the network packet is forwarded, (2) an established state in the network function implies that at least one previous network packet was received at the network function, (3) the network function receiving the network packet as a downward network function implies the network packet was previously sent by a second network function acting as an upward network function; encoding the network function using a combination of at least one of the three identified relationships; and verifying a plurality of network intents in the intent-based stateful network based at least in part on the encoding of the network function.

Abstract: A method for verifying network intents may include decomposing at least one network intent into a plurality of sub-verification tasks, generating a set of normalized configurations for a plurality of network devices in a target network based on a set of current configurations for the plurality of network devices and generating a network graph based on the set of normalized configurations and a topology of the target network. The method may further include analyzing the plurality of sub-verification tasks and the network graph to determine if the set of current configurations for the plurality of network devices satisfies the at least one network intent. If the at least one network intent is not satisfied, a report may be generated indicating that the target network is not in compliance. If the at least one network intent is satisfied, information may be provided indicating that target network is in compliance.