Abstract: A method for controlling access to a Cloud, comprising receiving traffic from an Enterprise user at a gateway, wherein the traffic carries a first key specific to the Enterprise user for use internal to the gateway, replacing the first key with a second key, wherein the second key is a Cloud-negotiated key generic to a plurality of Enterprise users which permits access to the Cloud, and sending traffic to the Cloud

Abstract: A software defined network service (SDNS) node for altering a logical flow of data packets in a network to accommodate predetermined ordered service chains, comprising a receiver configured to receive an encapsulated data packet comprising a tag via a encapsulated tunnel from another SDNS node, wherein the tag identifies an ordered service chain or a next hop in the ordered service chain, a processor coupled to the receiver and configured to decapsulate the encapsulated data packet, and a transmitter coupled to the processor and configured to forward the decapsulated data packet to a service device attached to the SDNS node when the processor determines, based on the tag, that a service on the service device should be applied to the data packet.

Abstract: Apparatus, methods, and other embodiments associated with providing service insertion architecture (SIA) differentiated services in a virtual private network (VPN) environment are described. Embodiments may provision an authentication, authorization, and accounting (AAA) server with user-to-SIA service-context mapping information. With the AAA server provisioned, embodiments may acquire, in an IPSec VPN hub, during IPSec tunnel user authentication, from the AAA server, the user-to-SIA service-context mapping information. With the mapping information available, embodiments may dynamically map an SIA service to an IPSec VPN tunnel user based on the service information acquired from the Service Broker or Pseudo-Service Broker.

Abstract: Method and system for providing dynamic configuration of link redundancy in data network based on detection of dynamic changes in the network topology including the steps of detecting data network topology, determining a number of data paths from a node in the data network topology to each of a respective pair of peer nodes coupled to the node by a corresponding interface, determining a data path in the data network topology between the peer nodes, calculating a set of nodes reachable via each interface coupled to the node and the respective peer node in the data network topology, and comparing the set of calculated nodes is provided.

Abstract: Method and system for providing dynamic network data traffic monitoring including monitoring a data network, detecting a change in the data network, initiating a span session based on the detected change in the data network, and dynamically modifying network configuration based on the detected change in the data network is disclosed.

Abstract: Techniques are provided for securely storing data files in, or retrieving data files from, cloud storage. A data file transmitted to cloud storage from a client in an enterprise computing environment is intercepted by at least one network device. Using security information received from a management server, the data file is converted into an encrypted object configured to remain encrypted while at rest in the cloud storage.

Abstract: In an example embodiment, packets for a selected flow are replicated and sent over one or more diverse paths, such as a primary path and at least one secondary path, to a destination switching device. At the destination switching device, one copy of the replicated packets is selected for delivery to the destination, and the remaining copies are discarded. In the event that packets are not received at the destination switching device due to loss of connection on the primary path or packets are not timely delivered due to congestion on the primary path, a different path may be selected as the primary path.

Abstract: A method and system provides dynamic configuration of network elements using hierarchical inheritance. The method includes monitoring a data network, detecting a change associated with a configuration of the data network, identifying one or more member groups affected by the detected change, and modifying the network configuration for the one or more member groups in the data network.

Abstract: Apparatus, methods, and other embodiments associated with providing service insertion architecture (SIA) differentiated services in a virtual private network (VPN) environment are described. Embodiments may provision an authentication, authorization, and accounting (AAA) server with user-to-SIA service-context mapping information. With the AAA server provisioned, embodiments may acquire, in an IPSec VPN hub, during IPSec tunnel user authentication, from the AAA server, the user-to-SIA service-context mapping information. With the mapping information available, embodiments may dynamically map an SIA service to an IPSec VPN tunnel user based on the service information acquired from the Service Broker or Pseudo-Service Broker.

Abstract: Method and system for providing dynamic network data traffic monitoring including monitoring a data network, detecting a change in the data network, initiating a span session based on the detected change in the data network, and dynamically modifying network configuration based on the detected change in the data network is disclosed.

Abstract: Systems, methods, and other embodiments associated with interworking a VPN and an SIA are described. One example apparatus includes a mapping data store to store a mapping between two logical groups of network devices having separate forwarding planes that are at least partially incompatible. The apparatus includes an instantiation logic to establish the mapping based on unique identifiers associated with the logical groups. The apparatus also includes an encoding logic to implicitly encode information to identify the first logical group in a packet received from the first logical group, provided to the second logical group, and then provided back to the first logical group. The implicitly encoded information is configured to be used without modification by the forwarding plane associated with the second logical group and is configured to facilitate a member of the second logical group resolving the mapping.

Abstract: Method and system for providing dynamic network data traffic monitoring including monitoring a data network, detecting a change in the data network, initiating a span session based on the detected change in the data network, and dynamically modifying network configuration based on the detected change in the data network is disclosed.

Abstract: In an example embodiment, packets for a selected flow are replicated and sent over one or more diverse paths, such as a primary path and at least one secondary path, to a destination switching device. At the destination switching device, one copy of the replicated packets is selected for delivery to the destination, and the remaining copies are discarded. In the event that packets are not received at the destination switching device due to loss of connection on the primary path or packets are not timely delivered due to congestion on the primary path, a different path may be selected as the primary path.

Abstract: Method and system for providing a dynamic network configuration and management based on defining and applying high level administrative intents including retrieving one or more attributes associated with one or more logical groups in a network, determining one or more network policies based on the one or more retrieved attributes, associating the one or more logical groups to a respective network group identifier, and generating a network group list associated with the one or more network group identifiers, is disclosed.

Abstract: In one embodiment, detecting a host device on a port of a forwarder switch in a network, detecting a movement of the host device from a first forwarder switch to a second forwarder switch, and multicast broadcasting an updated device information for the host device to a convergence group switches and a proximity group switches, where the convergence group switches includes switches in the network that are not configured as forwarder switches, and the proximity group switches include forwarder switches grouped together based on radio proximity is provided.

Abstract: A method for populating location wiremap databases. In particular implementations, a method includes establishing a link layer connection with a client on a switch port, where the switch port is associated with a port identifier and is mapped to a location; identifying one or more connection attributes of the connection, where the connection attributes comprise a network layer address of the client; and transmitting the port identifier and the network layer address of the client to a location server.

Abstract: Method and system for providing a dynamic network configuration and management based on defining and applying high level administrative intents including retrieving one or more attributes associated with one or more logical groups in a network, determining one or more network policies based on the one or more retrieved attributes, associating the one or more logical groups to a respective network group identifier, and generating a network group list associated with the one or more network group identifiers, is disclosed.

Abstract: Method and system for providing dynamic configuration of network elements using hierarchical inheritance including monitoring a data network, detecting a change associated with a configuration of the data network, identifying one or more member groups affected by the detected change, and modifying the network configuration for the one or more member groups in the data network, is disclosed.

Abstract: Method and system for providing dynamic network data traffic monitoring including monitoring a data network, detecting a change in the data network, initiating a span session based on the detected change in the data network, and dynamically modifying network configuration based on the detected change in the data network is disclosed.

Abstract: Method and system for providing dynamic configuration of link redundancy in data network based on detection of dynamic changes in the network topology including the steps of detecting data network topology, determining a number of data paths from a node in the data network topology to each of a respective pair of peer nodes coupled to the node by a corresponding interface, determining a data path in the data network topology between the peer nodes, calculating a set of nodes reachable via each interface coupled to the node and the respective peer node in the data network topology, and comparing the set of calculated nodes is provided.