Abstract: In one implementation, an original physical profile file and a configuration baseline are stored for a virtual machine. The physical profile file includes physical characteristics of a physical device running the virtual machine. The configuration baseline includes configuration settings or attributes of the instance of the virtual machine. A network device detects current value for at least one physical characteristic and compares the current value to the original physical profile file. When the current values deviate enough from the original physical profile file to exceed a threshold amount of deviation that is permissible, the network device determines that the virtual machine has been moved to another physical device. In response, the network device monitors current configuration settings or attributes with respect to the configuration baseline in order to detect an unauthorized usage of the virtual machine.

Abstract: In one implementation, an original physical profile file and a configuration baseline are stored for a virtual machine. The physical profile file includes physical characteristics of a physical device running the virtual machine. The configuration baseline includes configuration settings or attributes of the instance of the virtual machine. A network device detects current value for at least one physical characteristic and compares the current value to the original physical profile file. When the current values deviate enough from the original physical profile file to exceed a threshold amount of deviation that is permissible, the network device determines that the virtual machine has been moved to another physical device. In response, the network device monitors current configuration settings or attributes with respect to the configuration baseline in order to detect an unauthorized usage of the virtual machine.

Abstract: A mechanism for synchronizing states of components in a first routing engine to corresponding components in a second routing engine is provided. In order to reduce the amount of data required to synchronize the state of the components and the time and resources required to perform the synchronization, the state-related information transmitted from the first routing engine to the second routing engine is limited to information used to build states of a subset of the components associated with the first routing engine. That subset of components is limited to those components that receive stimuli (e.g., data streams or data packets) from sources external to the routing engine. Other components on the second routing engine synchronize state by receiving information from those components on the second routing engine that received the external stimuli information.

Abstract: A mechanism for synchronizing states of components in a first routing engine to corresponding components in a second routing engine is provided. In order to reduce the amount of data required to synchronize the state of the components and the time and resources required to perform the synchronization, the state-related information transmitted from the first routing engine to the second routing engine is limited to information used to build states of a subset of the components associated with the first routing engine. That subset of components is limited to those components that receive stimuli (e.g., data streams or data packets) from sources external to the routing engine. Other components on the second routing engine synchronize state by receiving information from those components on the second routing engine that received the external stimuli information.

Abstract: A mechanism for synchronizing states of components in a first routing engine to corresponding components in a second routing engine is provided. In order to reduce the amount of data required to synchronize the state of the components and the time and resources required to perform the synchronization, the state-related information transmitted from the first routing engine to the second routing engine is limited to information used to build states of a subset of the components associated with the first routing engine. That subset of components is limited to those components that receive stimuli (e.g., data streams or data packets) from sources external to the routing engine. Other components on the second routing engine synchronize state by receiving information from those components on the second routing engine that received the external stimuli information.

Abstract: A service gateway maintains forwarding components operative to forward data packets within corresponding VPNs, and also maintains subscriber sessions for subscribers via respective subscriber interfaces. The association between the subscribers and the forwarding components is independent of the subscriber interfaces, such that the subscribers reachable via a given interface are associable with any forwarding component. Upon detecting an appropriate event, such as a service selection action, the service gateway modifies the forwarding components of first and second VPNs to reflect that the subscriber session is active in the second VPN and is not active in the first VPN. The service gateway also effects a change of a network address that identifies the corresponding subscriber from a first network address defined in the first VPN to a second network address defined in the second VPN. Mechanisms for effecting such a change of network address include DHCP, IPCP, RADIUS, and NAT.

Abstract: A mechanism for synchronizing states of components in a first routing engine to corresponding components in a second routing engine is provided. In order to reduce the amount of data required to synchronize the state of the components and the time and resources required to perform the synchronization, the state-related information transmitted from the first routing engine to the second routing engine is limited to information used to build states of a subset of the components associated with the first routing engine. That subset of components is limited to those components that receive stimuli (e.g., data streams or data packets) from sources external to the routing engine. Other components on the second routing engine synchronize state by receiving information from those components on the second routing engine that received the external stimuli information.