Abstract: Disclosed is a network topology visualization system comprising: branch connector instances; branch connectors, wherein each grouping of the branch connector instances has a corresponding grouping of branch microsegment edges and each node of each grouping of the branch connector instances has a corresponding edge of a corresponding grouping of branch connector edges; virtual private cloud (VPC) connectors; and a cloud exchange node. The cloud exchange node includes: a service group; applications coupled to the VPC connectors via VPC segment edges; connector groups, coupled to the branch connectors via branch segment edges, wherein each of the branch segment edges uniquely couples a branch connector to a connector group; and a visualization engine that provides a visualization facilitated by connector construct abstraction of a network topology for a network of a customer.

Abstract: Disclosed is a rapid node provisioning system comprising a cloud resource inventory engine, an orchestration service, a metrics engine, and a node provisioning engine coupled to the orchestration service through a datapath. The metrics engine collects metrics for components of the datapath and provides the metrics to the cloud resource inventory engine, which informs communications to the orchestration service, and the node provisioning engine autoscales components of the datapath.

Abstract: Disclosed is a controller with an application-agnostic customer gateway comprising a dataplane management gateway, a dataplane management engine configured to take care of intent of platform-agnostic customer requests by onboarding on a nearest-to-customer platform and splitting requests into granular tasks to be carried out in a given region, a customer gateway for providing customer access to a customer network, a tenant management engine, a tenant provisioning engine, and a resource management engine.

Abstract: Disclosed is a cloud services exchange platform that provides for multi-tenant orchestration with a flexible underlay facilitating tenant move with minimal disruption. Multi-tenant node engines are adapted to orchestrate the instantiation, hosting, and/or provisioning of services to one or more endpoints on behalf of a customer. Multiple dataplanes are associated with the cloud services exchange platform.

Abstract: A cloud service provider's enterprise edge device and network interface are configured to establish a single tunnel connection with a remote server for delivering data packets to multiple distinct virtual machines on the remote server. The provider's enterprise edge device stores the network address information for each virtual machine and remote server to attach the destination network addresses to the data packet for transmission to the appropriate virtual machine on the remote server. Utilizing a single tunnel to transmit data packets to multiple virtual machines increases scalability at the provider's enterprise edge device and reduces system resources compared to other implementations in which the provider uses a tunnel for each virtual machine on a remote server.

Abstract: A cloud service provider's enterprise edge device and network interface are configured to establish a single tunnel connection with a remote server for delivering data packets to multiple distinct virtual machines on the remote server. The provider's enterprise edge device stores the network address information for each virtual machine and remote server to attach the destination network addresses to the data packet for transmission to the appropriate virtual machine on the remote server. Utilizing a single tunnel to transmit data packets to multiple virtual machines increases scalability at the provider's enterprise edge device and reduces system resources compared to other implementations in which the provider uses a tunnel for each virtual machine on a remote server.

Abstract: An example network device includes a network interface and a control unit that receives a packet having header information. The control unit includes a forwarding structure having a plurality of entries that each refers to one of a plurality of logical interfaces, a forwarding engine configured to access the forwarding structure to select a first logical interface to which to forward the packet based on the header information, wherein the first logical interface comprises a pseudo-device interface (PDI). The control unit also includes a PDI module that tunnels the packet to an external service complex (ESC) by at least applying a set of metadata to the packet, encapsulating the packet with a header, and forwarding the packet to the ESC via the network interface, and wherein the metadata allows the ESC to determine a set of services to be applied to the packet based on the metadata.

Abstract: An example network device includes a network interface and a control unit that receives a packet having header information. The control unit includes a forwarding structure having a plurality of entries that each refers to one of a plurality of logical interfaces, a forwarding engine configured to access the forwarding structure to select a first logical interface to which to forward the packet based on the header information, wherein the first logical interface comprises a pseudo-device interface (PDI). The control unit also includes a PDI module that tunnels the packet to an external service complex (ESC) by at least applying a set of metadata to the packet, encapsulating the packet with a header, and forwarding the packet to the ESC via the network interface, and wherein the metadata allows the ESC to determine a set of services to be applied to the packet based on the metadata.

Abstract: An example network device includes a network interface and a control unit that receives a packet having header information. The control unit includes a forwarding structure having a plurality of entries that each refers to one of a plurality of logical interfaces, a forwarding engine configured to access the forwarding structure to select a first logical interface to which to forward the packet based on the header information, wherein the first logical interface comprises a pseudo-device interface (PDI). The control unit also includes a PDI module that tunnels the packet to an external service complex (ESC) by at least applying a set of metadata to the packet, encapsulating the packet with a header, and forwarding the packet to the ESC via the network interface, and wherein the metadata allows the ESC to determine a set of services to be applied to the packet based on the metadata.

Abstract: An example network system includes network interfaces, a data repository, a forwarding structure, a service element, and a forwarding element. The forwarding element is configured to receive a first packet having header information via a tunnel over the first network with one of the networking interfaces, pass the first packet to the service element, receive a second packet from the service element, and forward the second packet via the network interfaces to the second network, wherein the first packet conforms to the first network-layer protocol, and wherein the second packet conforms to the second network-layer protocol. The service element is configured to transform the first packet from a format conforming with the first network-layer protocol into the second packet having a format conforming with the second network-layer protocol, and direct the second packet to the forwarding element.

Abstract: Systems and methods consistent with the present invention provide a better fragment drop heuristic that determines a per-fragment determined “remainder time” value to trigger potential drops on the whole bundle. A per-bundle drop timeout value is assumed. This value is to be configured based on differential delay considerations of the various links that constitute the bundle. The arrival time of a fragment to a reassembly algorithm triggers a remainder timer. When the reassembly algorithm instance actually processes the fragment, the “remainder time,” which is difference of a bundle drop timeout and time elapsed on the remainder timer, is used to determine whether the fragment and the other fragments of the packet should be dropped.

Abstract: A system and method is described for providing policy-based Network Address Translation (NAT) configurations wherein each user/resource policy within a network protection device may use a different set of address translation mappings.

Abstract: A system and method is described for providing policy-based Network Address Translation (NAT) configurations wherein each user/resource policy within a network protection device may use a different set of address translation mappings.

Abstract: A system and method is described for providing policy-based Network Address Translation (NAT) configurations wherein each user/resource policy within a network protection device may use a different set of address translation mappings.

Abstract: Systems and methods consistent with the present invention provide a better fragment drop heuristic that determines a per-fragment determined “remainder time” value to trigger potential drops on the whole bundle. A per-bundle drop timeout value is assumed. This value is to be configured based on differential delay considerations of the various links that constitute the bundle. The arrival time of a fragment to a reassembly algorithm triggers a remainder timer. When the reassembly algorithm instance actually processes the fragment, the “remainder time,” which is difference of a bundle drop timeout and time elapsed on the remainder timer, is used to determine whether the fragment and the other fragments of the packet should be dropped.

Abstract: A system and method is described for providing policy-based Network Address Translation (NAT) configurations wherein each user/resource policy within a network protection device may use a different set of address translation mappings.