Patents by Inventor Ronak K. Desai
Ronak K. Desai has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 11553006Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and assigns a range of endpoints to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for traffic belonging to a corresponding assigned range of endpoints. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoints. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint to a first policy proxy network element based on a destination of the packet.Type: GrantFiled: January 31, 2022Date of Patent: January 10, 2023Assignee: CISCO TECHNOLOGY, INC.Inventors: Murukanandam Kamalam Panchalingam, Umamaheswararao Karyampudi, Junyun Li, Muralidhar Annabatula, Ronak K. Desai, Thomas J. Edsall
-
Patent number: 11405427Abstract: The present technology pertains to a system, method, and non-transitory computer-readable medium for orchestrating policies across multiple networking domains. The technology can receive, at a provider domain from a consumer domain, a data request; receive, at the provider domain from the consumer domain, at least one access policy for the consumer domain; translate, at the provider domain, the at least one access policy for the consumer domain into at least one translated access policy understood by the provider domain; apply, at the provider domain, the at least one translated access policy understood by the provider domain to the data request; and send, at the provider domain to the consumer domain, a response to the data request.Type: GrantFiled: January 23, 2020Date of Patent: August 2, 2022Inventors: Ronak K. Desai, Rajagopalan Janakiraman, Mohammed Javed Asghar, Azeem Suleman, Patel Amitkumar Valjibhai, Sanjay Kumar Hooda, Victor Manuel Moreno
-
Publication number: 20220159042Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and assigns a range of endpoints to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for traffic belonging to a corresponding assigned range of endpoints. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoints. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint to a first policy proxy network element based on a destination of the packet.Type: ApplicationFiled: January 31, 2022Publication date: May 19, 2022Inventors: Murukanandam Kamalam Panchalingam, Umamaheswararao Karyampudi, Junyun Li, Muralidhar Annabatula, Ronak K. Desai, Thomas J. Edsall
-
Patent number: 11277447Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and selects a group of policy proxy network elements. The network controller assigns an exclusive range of endpoint groups to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for its assigned range of endpoint groups. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoint groups. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint group to a first policy proxy network element based on a destination of the packet.Type: GrantFiled: July 17, 2020Date of Patent: March 15, 2022Assignee: CISCO TECHNOLOGY, INC.Inventors: Murukanandam Kamalam Panchalingam, Umamaheswararao Karyampudi, Junyun Li, Muralidhar Annabatula, Ronak K. Desai, Thomas J. Edsall
-
Publication number: 20220021707Abstract: A distributed policy proxy system offloads network policy processing from an overloaded network element to policy proxy network elements. A network controller detects that policy resources are overloaded at a network element, and selects a group of policy proxy network elements. The network controller assigns an exclusive range of endpoint groups to each policy proxy network element. Each policy proxy network element is assigned to handle policy processing for its assigned range of endpoint groups. The network controller provides instructions to the policy proxy network elements to enable each policy proxy network element to apply the network policy for its assigned range of endpoint groups. The network controller also provides instructions to the overloaded network element to redirect a packet from the first endpoint group to a first policy proxy network element based on a destination of the packet.Type: ApplicationFiled: July 17, 2020Publication date: January 20, 2022Inventors: Murukanandam Kamalam Panchalingam, Umamaheswararao Karyampudi, Junyun Li, Muralidhar Annabatula, Ronak K. Desai, Thomas J. Edsall
-
Patent number: 11165828Abstract: Systems, methods, and computer-readable media for policy splitting in multi-cloud fabrics. In some examples, a method can include discovering a path from a first endpoint in a first cloud to a second endpoint in a second cloud; determining runtime policy table capacities associated with nodes in the path; determining policy distribution and enforcement for traffic from the first endpoint to the second endpoint based on the runtime policy table capacities; based on the policy distribution and enforcement, installing a set of policies for traffic from the first endpoint to the second endpoint across a set of nodes in the path; and applying the set of policies to traffic from the first endpoint in the first cloud to the second endpoint in the second cloud.Type: GrantFiled: February 28, 2019Date of Patent: November 2, 2021Assignee: CISCO TECHNOLOGY, INC.Inventors: Rajagopalan Janakiraman, Ronak K. Desai, Sivakumar Ganapathy, Mohammed Javed Asghar, Azeem Suleman, Patel Amitkumar Valjibhai
-
Publication number: 20210234898Abstract: The present technology pertains to a system, method, and non-transitory computer-readable medium for orchestrating policies across multiple networking domains. The technology can receive, at a provider domain from a consumer domain, a data request; receive, at the provider domain from the consumer domain, at least one access policy for the consumer domain; translate, at the provider domain, the at least one access policy for the consumer domain into at least one translated access policy understood by the provider domain; apply, at the provider domain, the at least one translated access policy understood by the provider domain to the data request; and send, at the provider domain to the consumer domain, a response to the data request.Type: ApplicationFiled: January 23, 2020Publication date: July 29, 2021Inventors: Ronak K. Desai, Rajagopalan Janakiraman, Mohammed Javed Asghar, Azeem Suleman, Patel Amitkumar Valjibhai, Sanjay Kumar Hooda, Victor Manuel Moreno
-
Patent number: 11057350Abstract: Technologies for extending a subnet across on-premises and cloud-based deployments are provided. An example method may include creating a VPC in a cloud for hosting an endpoint being moved from an on-premises site. For the endpoint to retain its IP address, a subnet range assigned to the VPC, based on the smallest subnet mask allowed by the cloud, is selected to include the IP address of the endpoint. The IP addresses from the assigned subnet range corresponding to on-premises endpoints are configured as secondary IP addresses on a Layer 2 (L2) proxy router instantiated in the VPC. The L2 proxy router establishes a tunnel to a cloud overlay router and directs traffic destined to on-premises endpoints, with IP addresses in the VPC subnet range thereto for outbound transmission. The cloud overly router updates the secondary IP addresses on the L2 proxy router based on reachability information for the on-premises site.Type: GrantFiled: May 30, 2019Date of Patent: July 6, 2021Assignee: CISCO TECHNOLOGY, INC.Inventors: Rajagopalan Janakiraman, Sivakumar Ganapathy, Azeem Suleman, Mohammed Javed Asghar, Patel Amitkumar Valjibhai, Ronak K. Desai
-
Patent number: 10891147Abstract: Aspects of the embodiments are directed to forming a virtual machine management (VMM) domain in a heterogeneous datacenter. Aspects can include mapping an endpoint group to multiple VMM domains, each VMM domain associated with one or more virtual machine management systems of a single type that each share one or more management system characteristics; instantiating a virtual switch instance, the virtual switch instance associated with a the VMM domain; and instantiating the endpoint group mapped to the VMM domain as a network component associated with the virtual switch instance.Type: GrantFiled: December 12, 2016Date of Patent: January 12, 2021Assignee: Cisco Technology, Inc.Inventors: Vijayan Ramakrishnan, Saurabh Jain, Vijay Chander, Ronak K. Desai, Praveen Jain, Munish Mehta, Yibin Yang
-
Publication number: 20200382471Abstract: Technologies for extending a subnet across on-premises and cloud-based deployments are provided. An example method may include creating a VPC in a cloud for hosting an endpoint being moved from an on-premises site. For the endpoint to retain its IP address, a subnet range assigned to the VPC, based on the smallest subnet mask allowed by the cloud, is selected to include the IP address of the endpoint. The IP addresses from the assigned subnet range corresponding to on-premises endpoints are configured as secondary IP addresses on a Layer 2 (L2) proxy router instantiated in the VPC. The L2 proxy router establishes a tunnel to a cloud overlay router and directs traffic destined to on-premises endpoints, with IP addresses in the VPC subnet range thereto for outbound transmission. The cloud overly router updates the secondary IP addresses on the L2 proxy router based on reachability information for the on-premises site.Type: ApplicationFiled: May 30, 2019Publication date: December 3, 2020Inventors: Rajagopalan Janakiraman, Sivakumar Ganapathy, Azeem Suleman, Mohammed Javed Asghar, Patel Amitkumar Valjibhai, Ronak K. Desai
-
Publication number: 20200280587Abstract: Systems, methods, and computer-readable media for policy splitting in multi-cloud fabrics. In some examples, a method can include discovering a path from a first endpoint in a first cloud to a second endpoint in a second cloud; determining runtime policy table capacities associated with nodes in the path; determining policy distribution and enforcement for traffic from the first endpoint to the second endpoint based on the runtime policy table capacities; based on the policy distribution and enforcement, installing a set of policies for traffic from the first endpoint to the second endpoint across a set of nodes in the path; and applying the set of policies to traffic from the first endpoint in the first cloud to the second endpoint in the second cloud.Type: ApplicationFiled: February 28, 2019Publication date: September 3, 2020Inventors: Rajagopalan Janakiraman, Ronak K. Desai, Sivakumar Ganapathy, Mohammed Javed Asghar, Azeem Suleman, Patel Amitkumar Valjibhai
-
Patent number: 10581744Abstract: Presented herein are traffic pruning techniques that define the pruning at the group level. A software defined network (SDN) controller determines first and second endpoint groups (EPGs) of an SDN associated with the SDN controller. The SDN runs on a plurality of networking devices that interconnect a plurality of endpoints that are each attached to one or more host devices. The SDN controller determines a host-EPG mapping for the SDN, as well as a networking device-host mapping for the SDN. The SDN controller then uses the host-EPG mapping, the networking device-host mapping, and one or more group-based policies associated with traffic sent from the first EPG to the second EPG to compute hardware pruning policies defining how to prune multi-destination traffic sent from the first EPG to the second EPG. The hardware pruning policies are then installed in one or more of the networking devices or the host devices.Type: GrantFiled: December 2, 2016Date of Patent: March 3, 2020Assignee: Cisco Technology, Inc.Inventors: Munish Mehta, Saurabh Jain, Praveen Jain, Ronak K. Desai, Yibin Yang
-
Patent number: 10469402Abstract: The techniques presented herein use dynamic endpoint group (EPG) binding changes to facilitate cross-tenant resource sharing. A first node of a multi-tenant software defined network determines that an application on a first endpoint has initiated operation and needs temporary access to resources located at a second endpoint. The first and second endpoints are associated with first and second tenants, respectively, that are logically segregated from one another by the software defined network. The first node dynamically changes an initial EPG binding associated with the first endpoint to a second EPG binding that enables the first endpoint to temporarily directly access the resources at the second endpoint. The first node subsequently determines that the application on the first endpoint no longer needs access to the resources located at a second endpoint and, as such, changes the second EPG binding associated with the first endpoint back to the initial EPG binding.Type: GrantFiled: November 16, 2016Date of Patent: November 5, 2019Assignee: Cisco Technology, Inc.Inventors: Saurabh Jain, Vijay K. Chander, Vijayan Ramakrishnan, Ronak K. Desai, Praveen Jain, Munish Mehta, Yibin Yang
-
Publication number: 20180159781Abstract: Presented herein are traffic pruning techniques that define the pruning at the group level. A software defined network (SDN) controller determines first and second endpoint groups (EPGs) of an SDN associated with the SDN controller. The SDN runs on a plurality of networking devices that interconnect a plurality of endpoints that are each attached to one or more host devices. The SDN controller determines a host-EPG mapping for the SDN, as well as a networking device-host mapping for the SDN. The SDN controller then uses the host-EPG mapping, the networking device-host mapping, and one or more group-based policies associated with traffic sent from the first EPG to the second EPG to compute hardware pruning policies defining how to prune multi-destination traffic sent from the first EPG to the second EPG. The hardware pruning policies are then installed in one or more of the networking devices or the host devices.Type: ApplicationFiled: December 2, 2016Publication date: June 7, 2018Inventors: Munish Mehta, Saurabh Jain, Praveen Jain, Ronak K. Desai, Yibin Yang
-
Publication number: 20180139150Abstract: The techniques presented herein use dynamic endpoint group (EPG) binding changes to facilitate cross-tenant resource sharing. A first node of a multi-tenant software defined network determines that an application on a first endpoint has initiated operation and needs temporary access to resources located at a second endpoint. The first and second endpoints are associated with first and second tenants, respectively, that are logically segregated from one another by the software defined network. The first node dynamically changes an initial EPG binding associated with the first endpoint to a second EPG binding that enables the first endpoint to temporarily directly access the resources at the second endpoint. The first node subsequently determines that the application on the first endpoint no longer needs access to the resources located at a second endpoint and, as such, changes the second EPG binding associated with the first endpoint back to the initial EPG binding.Type: ApplicationFiled: November 16, 2016Publication date: May 17, 2018Inventors: Saurabh Jain, Vijay K. Chander, Vijayan Ramakrishnan, Ronak K. Desai, Praveen Jain, Munish Mehta, Yibin Yang