Abstract: A disclosed method may include (1) identifying an old version of software that is running on a network device, (2) receiving a new version of the software that is to replace the old version of the software during an in-service software upgrade, and then (3) performing the in-service software upgrade on the network device by making a system call that (A) loads the new version of the software onto the network device as the old version of the software continues to run and (B) transfers control of the network device from the old version of the software to the new version of the software by booting the new version of the software without shutting down the network device. Various other systems and methods are also disclosed.

Abstract: An apparatus includes an aggregation module that is associated with a first network core and that is operatively coupled to a second network core and a third network core. The aggregation module is configured to receive a first copy of an access point license that authorizes access to a network via an access point and the second network core. The aggregation module receives the first copy of the access point license from the second network core in response to an installation and validation of the access point license on the second network core. The aggregation module is configured to send a second copy of the access point license to the third network core that authorizes a device to access the network via the access point and via the third network core in accordance with the access point license and in response to a failure of the second network core.

Abstract: A device may receive a firewall filter entry that includes one or more match conditions associated with filtering network traffic. The device may identify an access control list (ACL) template associated with the firewall filter entry. The ACL template may be associated with a template type. The device may identify one or more rules, for verifying the firewall filter entry, based on the template type associated with the ACL template. The device may verify the firewall filter entry using the one or more rules. The device may determine a hardware resource, for storing the firewall filter entry, based on the template type and based on verifying the firewall filter entry. The device may store the firewall filter entry using the hardware resource of the device.

Abstract: In some embodiments, a method includes defining, by a processor included in a first node, a virtual-extensible-local-area-network (VXLAN) tunnel between the first node included in a first layer-two network, and a second node included in a second layer-two network, the VXLAN tunnel traversing at least one node of a layer-three network. The method includes receiving, at the first node, a layer-two data unit that is sent from a third node included in the first layer-two network, to a fourth node included in the second layer-two network. The method includes encapsulating, at the first node, the layer-two data unit to define an encapsulated data unit that includes a VXLAN header. The method includes sending the encapsulated packet from the first node towards the fourth node via the VXLAN tunnel.

Abstract: A device may receive a firewall filter entry that includes one or more match conditions associated with filtering network traffic. The device may identify an access control list (ACL) template associated with the firewall filter entry. The ACL template may be associated with a template type. The device may identify one or more rules, for verifying the firewall filter entry, based on the template type associated with the ACL template. The device may verify the firewall filter entry using the one or more rules. The device may determine a hardware resource, for storing the firewall filter entry, based on the template type and based on verifying the firewall filter entry. The device may store the firewall filter entry using the hardware resource of the device.

Abstract: A device may receive a firewall filter entry that includes one or more match conditions associated with filtering network traffic. The device may identify an access control list (ACL) template associated with the firewall filter entry. The ACL template may be associated with a template type. The device may identify one or more rules, for verifying the firewall filter entry, based on the template type associated with the ACL template. The device may verify the firewall filter entry using the one or more rules. The device may determine a hardware resource, for storing the firewall filter entry, based on the template type and based on verifying the firewall filter entry. The device may store the firewall filter entry using the hardware resource of the device.

Abstract: A device may receive an indication to perform a reboot associated with a network service provided via a first virtual machine (VM) of the device and a first container of the device. The device may create a second VM with a boot mode enabled and a second container with the boot mode enabled. The boot mode, while enabled on the second VM, may prevent the second VM from communicating with the first container. The boot mode, while enabled on the second container, may prevent the second container from communicating with the first VM. The device may shut down the first container. The device may disable, after shutting down the first container, the boot mode on the second VM. The device may disable the boot mode on the second container. The device may cause the network service to be provided by the second container and the second VM.

Abstract: An apparatus includes an aggregation module that is associated with a first network core and that is operatively coupled to a second network core and a third network core. The aggregation module is configured to receive a first copy of an access point license that authorizes access to a network via an access point and the second network core. The aggregation module receives the first copy of the access point license from the second network core in response to an installation and validation of the access point license on the second network core. The aggregation module is configured to send a second copy of the access point license to the third network core that authorizes a device to access the network via the access point and via the third network core in accordance with the access point license and in response to a failure of the second network core.

Abstract: In some embodiments, a method includes installing at an access point that (1) includes a first software image and (2) is operatively coupled to a network controller via network, a second software image different from the first software image. The method includes defining in response to the installation, a virtual client disposed in the access point. The virtual client is configured to send to the network controller via the network a first validation data unit that causes the network controller to send a second validation data unit to the access point if the first validation data unit is received by the network controller. The method also includes installing at the access point that includes the second software image, the first software image and uninstalling the second software image if the access point does not receive the second validation data unit in response to the first validation data unit.

Abstract: In general, techniques are described for performing a controlled non-stop software upgrade (NSSU) of a network device. In some examples, a method includes receiving, by a first network device included in a virtual network device, a non-stop software upgrade (NSSU) request. The first network device is communicatively coupled to each of a computing device and a second network device. The method includes, in response to receiving the NSSU request, forwarding to the second network device, network packets that are received at the first network device and destined to the computing device. The method also includes sending a message to the computing device that instructs the computing device to stop sending network packets to the first network device. The method includes updating one or more software components within the first network device, after sending the message to the computing device and based at least in part on the NSSU request.

Abstract: Rolling software upgrades may be employed for a network device in a modular chassis and/or virtual chassis. The network device may include memory devices to store a software upgrade package and a group of instructions, and a processor. The processors may install the software upgrade package on a backup routing engine; determine subsets of multiple line cards on which to perform a software upgrade, where ports in each of the multiple line cards are part of a link aggregation group (LAG); initiate a reboot process for each of the subsets of multiple line cards, in sequence, where the reboot process for each of the line cards results in a software upgrade without deactivating any LAG. The processors may also switch the backup routing engine and a master routing engine to create a new master routing engine and a new backup routing engine, and install the upgrade package on the new backup routing engine.

Abstract: Rolling software upgrades may be employed for a network device in a modular chassis and/or virtual chassis. The network device may include memory devices to store a software upgrade package and a group of instructions, and a processor. The processors may install the software upgrade package on a backup routing engine; determine subsets of multiple line cards on which to perform a software upgrade, where ports in each of the multiple line cards are part of a link aggregation group (LAG); initiate a reboot process for each of the subsets of multiple line cards, in sequence, where the reboot process for each of the line cards results in a software upgrade without deactivating any LAG. The processors may also switch the backup routing engine and a master routing engine to create a new master routing engine and a new backup routing engine, and install the upgrade package on the new backup routing engine.