Abstract: A controller device receives, from a plurality of assisted replication network devices, respective utilization information associated with the plurality of assisted replication network devices. The controller device generates, based on the respective utilization information associated with the plurality of assisted replication network devices, load balancing information for a network device associated with two or more assisted replication network devices of the plurality of assisted replication network devices, and sends, to the network device, the load balancing information. The network selects, based on the load balancing information, a particular assisted replication network device of the two or more assisted replication network devices.

Abstract: An example network device includes memory, a communication unit, and processing circuitry coupled to the memory and the communication unit. The processing circuitry is configured to receive first samples of flows from an interface of another network device sampled at a first sampling rate and determine a first parameter based on the first samples. The processing circuitry is configured to receive second samples of flows from the interface sampled at a second sampling rate, wherein the second sampling rate is different than the first sampling rate and determine a second parameter based on the second samples. The processing circuitry is configured to determine a third sampling rate based on the first parameter and the second parameter, control the communication unit to transmit a signal indicative of the third sampling rate to the another network device; and receive third samples of flows from the interface sampled at the third sampling rate.

Abstract: In some implementations, a first network device may transmit data to a second network device based on the data being associated with a media access control (MAC) address that is associated with an access port of the second network device, wherein the first network device and the second network device are included in a plurality of network devices interconnected by first tunnels associated with a forwarding plane and second tunnels associated with a control plane. The first network device may determine that the MAC address is associated with an access port of the first network device and may transmit, via one or more first tunnels, a notification indicating that the MAC address is associated with the first network device. The first network device may transmit, via one or more second tunnels, a notification indicating that the MAC address is associated with the first network device.

Abstract: A method includes receiving, by a network analyzer implemented in circuitry, from a network device of a plurality of network devices, a sensor message for telemetry flow data. The sensor message indicates an interface index for a network interface, a virtual network identifier associated with a virtual network, and an IP address. The method further includes receiving, by the network analyzer, from the network device, a telemetry flow message for the telemetry flow data. The method further includes, in response to determining that the telemetry flow message includes an indication of an interface index that matches the interface index of the sensor message and that the telemetry flow message includes an indication of a virtual network identifier that matches the virtual network identifier of the sensor message, setting, by the network analyzer, the IP address as the source of the telemetry flow data.

Abstract: In some implementations, a provider edge device associated with a link aggregation group (LAG) may maintain, according to a link aggregation control protocol (LACP), a set of links that connect the PE device to a consumer edge device. The provider edge device may determine that the provider edge device and another provider edge device associated with the LAG are not receiving link aggregation control protocol data units (LACPDUs) from the consumer edge device. The provider edge device may cause the set of links to have a maintain LAG status, which causes the provider edge device to keep up the set of links and to cease maintaining the set of links according to the LACP. The provider edge device may route, based on causing the set of links to have the maintain LAG status, one or more packets to or from the consumer edge device via the set of links.

Abstract: A first provider edge device may receive device information from a second provider edge device included in an Ethernet virtual private network (EVPN). The device information may identify a media access control (MAC) address and may indicate that the device is connected to the second provider edge device. The first provider edge device may receive data transmitted by the device and may determine, based on information included in the data, that the device has moved from the second provider edge device to the first provider edge device. The first provider edge device may generate a data packet including mobility information indicating that the device has moved to the first provider edge device. The first provider edge device may transmit, via a data plane of the EVPN, the data packet to the second provider edge device to permit the second provider edge device to update routing information for the device.

Abstract: In some implementations, a provider edge device associated with a link aggregation group (LAG) may maintain, according to a link aggregation control protocol (LACP), a set of links that connect the PE device to a consumer edge device. The provider edge device may determine that the provider edge device and another provider edge device associated with the LAG are not receiving link aggregation control protocol data units (LACPDUs) from the consumer edge device. The provider edge device may cause the set of links to have a maintain LAG status, which causes the provider edge device to keep up the set of links and to cease maintaining the set of links according to the LACP. The provider edge device may route, based on causing the set of links to have the maintain LAG status, one or more packets to or from the consumer edge device via the set of links.

Abstract: Techniques are described for providing fast reroute for traffic in EVPN-VXLAN. For example, a backup PE device of an Ethernet segment is configured with an additional tunnel endpoint address (“reroute tunnel endpoint address”) for a backup path associated with a second split-horizon group that is different than a tunnel endpoint address and first split-horizon group for another path used for normal traffic forwarding. The backup PE device sends the reroute tunnel endpoint address to a primary PE device of the Ethernet segment, which uses the reroute tunnel endpoint address to configure a backup path to the backup PE device over the core network. For example, the primary PE device may install the reroute tunnel endpoint address within its forwarding plane and one or more operations to cause the primary PE device to encapsulate a VXLAN header including the reroute tunnel endpoint address when rerouting the packet along the backup path.

Abstract: Techniques are described for providing fast reroute for traffic in EVPN-VXLAN. For example, a backup PE device of an Ethernet segment is configured with an additional tunnel endpoint address (“reroute tunnel endpoint address”) for a backup path associated with a second split-horizon group that is different than a tunnel endpoint address and first split-horizon group for another path used for normal traffic forwarding. The backup PE device sends the reroute tunnel endpoint address to a primary PE device of the Ethernet segment, which uses the reroute tunnel endpoint address to configure a backup path to the backup PE device over the core network. For example, the primary PE device may install the reroute tunnel endpoint address within its forwarding plane and one or more operations to cause the primary PE device to encapsulate a VXLAN header including the reroute tunnel endpoint address when rerouting the packet along the backup path.

Abstract: A plurality of switches may be arranged according to a spine and leaf topology in which each spine switch is connected to all leaf switches. A leaf switch includes a memory configured to store a plurality of policies, each of the plurality of policies being associated with a respective source identifier value and a respective destination address; a network interface communicatively coupled to one of the spine switches; and a processor implemented in circuitry and configured to: receive a packet from the spine switch via the network interface, the packet being encapsulated with a Virtual Extensible Local Area Network (VXLAN) header; extract a source identifier value from the VXLAN header; determine a destination address for the packet; determine a policy of the plurality of policies to apply to the packet according to the source identifier value and the destination address; and apply the policy to the packet.

Abstract: Techniques are described for providing security extensions to neighbor discovery in Ethernet Virtual Private Network (EVPN). For example, a network device that implements Ethernet Virtual Private Network (EVPN) receives a neighbor discovery response message including a nonce originated by a second network device and not originated by the first network device. The network device processes the neighbor discovery response message including the nonce originated by the second network device and not originated by the first network device.

Abstract: Techniques are described for providing fast reroute for traffic in EVPN-VXLAN. For example, a backup PE device of an Ethernet segment is configured with an additional tunnel endpoint address (“reroute tunnel endpoint address”) for a backup path associated with a second split-horizon group that is different than a tunnel endpoint address and first split-horizon group for another path used for normal traffic forwarding. The backup PE device sends the reroute tunnel endpoint address to a primary PE device of the Ethernet segment, which uses the reroute tunnel endpoint address to configure a backup path to the backup PE device over the core network. For example, the primary PE device may install the reroute tunnel endpoint address within its forwarding plane and one or more operations to cause the primary PE device to encapsulate a VXLAN header including the reroute tunnel endpoint address when rerouting the packet along the backup path.

Abstract: Techniques are described for providing security extensions to neighbor discovery in Ethernet Virtual Private Network (EVPN). For example, a network device that implements Ethernet Virtual Private Network (EVPN) receives a neighbor discovery response message including a nonce originated by a second network device and not originated by the first network device. The network device processes the neighbor discovery response message including the nonce originated by the second network device and not originated by the first network device.

Abstract: An example network device includes memory, a communication unit, and processing circuitry coupled to the memory and the communication unit. The processing circuitry is configured to receive first samples of flows from an interface of another network device sampled at a first sampling rate and determine a first parameter based on the first samples. The processing circuitry is configured to receive second samples of flows from the interface sampled at a second sampling rate, wherein the second sampling rate is different than the first sampling rate and determine a second parameter based on the second samples. The processing circuitry is configured to determine a third sampling rate based on the first parameter and the second parameter, control the communication unit to transmit a signal indicative of the third sampling rate to the another network device; and receive third samples of flows from the interface sampled at the third sampling rate.

Abstract: In some implementations, a provider edge device associated with a link aggregation group (LAG) may maintain, according to a link aggregation control protocol (LACP), a set of links that connect the PE device to a consumer edge device. The provider edge device may determine that the provider edge device and another provider edge device associated with the LAG are not receiving link aggregation control protocol data units (LACPDUs) from the consumer edge device. The provider edge device may cause the set of links to have a maintain LAG status, which causes the provider edge device to keep up the set of links and to cease maintaining the set of links according to the LACP. The provider edge device may route, based on causing the set of links to have the maintain LAG status, one or more packets to or from the consumer edge device via the set of links.

Abstract: Techniques are described for managing a split-brain scenario in a multihomed environment by exchanging isolation information between a leaf device and two or more spine devices to which the leaf device is multihomed via a link aggregation group (LAG). The techniques include selecting one of the spine devices as a primary spine device and determining, based on the isolation information, whether the spine devices are isolated from each other. In the split-brain scenario in which all of the spine devices are isolated from each other, the primary spine device is configured to maintain the LAG with the leaf device while the other spine devices mark the LAG with the leaf device as down. In this way, in the split-brain scenario, the leaf device may continue to send traffic to other leaf devices in the leaf layer using the LAG to the primary spine device.

Abstract: A device may receive, from a provider edge device, a packet to be provided to one or more other provider edge devices. Some of the one or more other provider edge devices may be multi-homed with a same customer edge device as the provider edge device. The device may configure a source IP address of the packet based on a capability of an assisted replicator device after receiving the packet. The capability may relate to whether the assisted replicator device is capable of retaining the source IP address of the packet as received from the provider edge device. The device may provide the packet to at least some provider edge devices, of the one or more other provider edge devices, after configuring the source IP address of the packet.

Abstract: A first provider edge device may receive device information from a second provider edge device included in an Ethernet virtual private network (EVPN). The device information may identify a media access control (MAC) address and may indicate that the device is connected to the second provider edge device. The first provider edge device may receive data transmitted by the device and may determine, based on information included in the data, that the device has moved from the second provider edge device to the first provider edge device. The first provider edge device may generate a data packet including mobility information indicating that the device has moved to the first provider edge device. The first provider edge device may transmit, via a data plane of the EVPN, the data packet to the second provider edge device to permit the second provider edge device to update routing information for the device.

Abstract: The problem of looping at the egress of a transport network with a CE multihomed to a protected egress PE and a backup/protector egress PE can be avoided by (a) enabling the protector egress PE to distinguish between fast reroute (FRR) traffic coming from the protected egress PE and normal known unicast (KU) traffic coming from a PE of the transport network that is not attached to the same multihomed segment; (b) receiving, by the protector egress PE, known unicast data, to be forwarded to the CE; (c) determining, by the protector egress PE, that a link between it and the CE is unavailable; and (d) responsive to determining that the link between the protector egress PE and the CE is unavailable, (1) determining whether the known unicast traffic received was sent from the protected egress PE or from another PE of the transport network that is not attached to the same multihomed segment, and (2) responsive to a determination that the known unicast traffic received was sent from the protected egress PE, discardi

Abstract: The problem of looping at the egress of a transport network with a CE multihomed to a protected egress PE and a backup/protector egress PE can be avoided by (a) enabling the protector egress PE to distinguish between fast reroute (FRR) traffic coming from the protected egress PE and normal known unicast (KU) traffic coming from a PE of the transport network that is not attached to the same multihomed segment; (b) receiving, by the protector egress PE, known unicast data, to be forwarded to the CE; (c) determining, by the protector egress PE, that a link between it and the CE is unavailable; and (d) responsive to determining that the link between the protector egress PE and the CE is unavailable, (1) determining whether the known unicast traffic received was sent from the protected egress PE or from another PE of the transport network that is not attached to the same multihomed segment, and (2) responsive to a determination that the known unicast traffic received was sent from the protected egress PE, discardi