Abstract: Security policy analysis is disclosed. Configuration information, including at least one existing policy, is received. The received configuration information is used to build a model, including by normalizing the policy. The model is used to analyze the existing policy. A result of the policy analysis is provided as output.

Abstract: Security policy analysis is disclosed. Configuration information, including at least one policy, is received. The received configuration information is used to build a model, including by normalizing the policy. The policy is used to perform a policy analysis, including by performing a pre-change analysis associated with a proposed policy change. A result of the policy analysis is provided as output.

Abstract: The present disclosure is directed to a system and method for applying unique routing rules to encrypted data packets being transmitted via a tunneling protocol. Because encrypted data packets are unintelligible at intermediary points along a secured link or “tunnel,” a multi-path router located between the tunnel endpoints is typically unable to apply unique routing rules. To enable unique routing, the disclosed method relies on a unique identifier that is associated with the secured link established between an initiator and a receiver (i.e., the tunnel endpoints). The unique identifier is transmitted with one or more encrypted data packets and is used at intermediary points to differentiate the encrypted data packets so that unique routing rules can be applied.

Abstract: A method for bridging traffic over a network includes receiving, at stations that are coupled to the network, forwarding information for remote devices that are coupled to the network via the stations. The forwarding information associates a remote address of each remote device with an address of one of the stations. Each station that receives the forwarding information stores the forwarding information in a forwarding database. The method also includes receiving traffic at a first station from a first remote device that is coupled to the first station. The traffic includes a destination address that is a remote address of a second remote device that is coupled to a second station of the network. Furthermore, the method includes identifying an address of the second station that is associated with the remote address of the second remote device in the forwarding database. The method also includes communicating the traffic directly to the second station using the identified address.

Abstract: Provisioning a network element of a ring network includes accessing connection data of the network element. The network element includes components, and the connection data includes entries for connections between components. A connection initiation event initiating a change of the connection data is established to have occurred. A first connection is automatically deleted in response to establishing that the connection initiation event has occurred, where the first connection is deleted by deleting a first entry recording the first connection. A second connection is automatically created by creating a second entry recording the second connection.

Abstract: A method for bridging traffic over a network includes receiving, at stations that are coupled to the network, forwarding information for remote devices that are coupled to the network via the stations. The forwarding information associates a remote address of each remote device with an address of one of the stations. Each station that receives the forwarding information stores the forwarding information in a forwarding database. The method also includes receiving traffic at a first station from a first remote device that is coupled to the first station. The traffic includes a destination address that is a remote address of a second remote device that is coupled to a second station of the network. Furthermore, the method includes identifying an address of the second station that is associated with the remote address of the second remote device in the forwarding database. The method also includes communicating the traffic directly to the second station using the identified address.