Abstract: Provided are methods, apparatus, and system for policy based wide area network. A network of network appliances is configured with a policy configuration. Each network appliance is configured to validate each wide area network packet against the policy configuration. The validation can include verifying that the packets meet the SD-WAN network segment requirements and security rules including verifying that the source and destination address of the packet meet the firewall zone requirements. Each wide area network packet contains a policy header that is checked by the sending and receiving network appliance against the policy configuration.

Abstract: Provided are methods, apparatus, and system for policy based wide area network. A network of network appliances is configured with a policy configuration. Each network appliance is configured to validate each wide area network packet against the policy configuration. The validation can include verifying that the packets meet the SD-WAN network segment requirements and security rules including verifying that the source and destination address of the packet meet the firewall zone requirements. Each wide area network packet contains a policy header that is checked by the sending and receiving network appliance against the policy configuration.

Abstract: Provided are methods, apparatus, and system for policy based wide area network. A network of network appliances is configured with a policy configuration. Each network appliance is configured to validate each wide area network packet against the policy configuration. The validation can include verifying that the packets meet the SD-WAN network segment requirements and security rules including verifying that the source and destination address of the packet meet the firewall zone requirements. Each wide area network packet contains a policy header that is checked by the sending and receiving network appliance against the policy configuration.

Abstract: Provided are methods, apparatus, and system for policy based wide area network. A network of network appliances is configured with a policy configuration. Each network appliance is configured to validate each wide area network packet against the policy configuration. The validation can include verifying that the packets meet the SD-WAN network segment requirements and security rules including verifying that the source and destination address of the packet meet the firewall zone requirements. Each wide area network packet contains a policy header that is checked by the sending and receiving network appliance against the policy configuration.

Abstract: Techniques are described for extending a two-way active measurement protocol (TWAMP) to enable measurement of service key performance indicators (KPIs) in a software defined network (SDN) and network function virtualization (NFV) architecture. The TWAMP extensions enable control messaging to be handled by a TWAMP control client executed on a centralized controller, and data messaging to be handled by a TWAMP session initiator executed on a separate network device. Techniques are also described for extending TWAMP to enable measurement of any of a plurality of service KPIs for a given service supported at a TWAMP server. The service KPIs may include one or more of keepalive measurements, round trip time measurements, path delay measurements, service latency measurements, or service load measurements. The TWAMP extensions for the service KPIs may be used in both conventional network architectures and in SDN and NFV architectures.

Abstract: Techniques are described for performing session identifier (“SID”) based two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. According to the techniques, a SID assigned to each data session is used to uniquely identify the data session, instead of a source and destination address/port pairs. A TWAMP server may generate a unique number as a SID of a data session during negotiation of the data session. The disclosed techniques include extending TWAMP control messaging to include a communication mode for the SID-based TWAMP data session provisioning. The disclosed techniques further include extending TWAMP data messaging to include the SID of the data session in each test packet for the data session. In this way, a TWAMP session sender and a TWAMP session reflector may associate received test packets with a certain data session based on the SID included in the received test packets.

Abstract: Techniques are described for performing subscriber aware two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. For example, the disclosed techniques include extending TWAMP control messaging to include a communication mode for negotiating subscriber-aware TWAMP data monitoring. If the communication mode is supported by both endpoints, a subscriber identifier is specified when a TWAMP data session is provisioned (negotiated) over the control session. The disclosed techniques further include extending TWAMP data messaging to include the subscriber identifier in each test packet for the data session. In this way, each of the endpoints may identify a subscriber corresponding to one or more received TWAMP test packets based on the subscriber identifier included in the received TWAMP test packets.

Abstract: Techniques are described for performing subscriber aware two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. For example, the disclosed techniques include extending TWAMP control messaging to include a communication mode for negotiating subscriber-aware TWAMP data monitoring. If the communication mode is supported by both endpoints, a subscriber identifier is specified when a TWAMP data session is provisioned (negotiated) over the control session. The disclosed techniques further include extending TWAMP data messaging to include the subscriber identifier in each test packet for the data session. In this way, each of the endpoints may identify a subscriber corresponding to one or more received TWAMP test packets based on the subscriber identifier included in the received TWAMP test packets.

Abstract: Techniques are described for extending a two-way active measurement protocol (TWAMP) to enable measurement of service key performance indicators (KPIs) in a software defined network (SDN) and network function virtualization (NFV) architecture. The TWAMP extensions enable control messaging to be handled by a TWAMP control client executed on a centralized controller, and data messaging to be handled by a TWAMP session initiator executed on a separate network device. Techniques are also described for extending TWAMP to enable measurement of any of a plurality of service KPIs for a given service supported at a TWAMP server. The service KPIs may include one or more of keepalive measurements, round trip time measurements, path delay measurements, service latency measurements, or service load measurements. The TWAMP extensions for the service KPIs may be used in both conventional network architectures and in SDN and NFV architectures.

Abstract: Techniques are described for extending a two-way active measurement protocol (TWAMP) to enable measurement of service key performance indicators (KPIs) in a software defined network (SDN) and network function virtualization (NFV) architecture. The TWAMP extensions enable control messaging to be handled by a TWAMP control client executed on a centralized controller, and data messaging to be handled by a TWAMP session initiator executed on a separate network device. Techniques are also described for extending TWAMP to enable measurement of any of a plurality of service KPIs for a given service supported at a TWAMP server. The service KPIs may include one or more of keepalive measurements, round trip time measurements, path delay measurements, service latency measurements, or service load measurements. The TWAMP extensions for the service KPIs may be used in both conventional network architectures and in SDN and NFV architectures.

Abstract: Techniques are described for performing subscriber aware two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. For example, the disclosed techniques include extending TWAMP control messaging to include a communication mode for negotiating subscriber-aware TWAMP data monitoring. If the communication mode is supported by both endpoints, a subscriber identifier is specified when a TWAMP data session is provisioned (negotiated) over the control session. The disclosed techniques further include extending TWAMP data messaging to include the subscriber identifier in each test packet for the data session. In this way, each of the endpoints may identify a subscriber corresponding to one or more received TWAMP test packets based on the subscriber identifier included in the received TWAMP test packets.

Abstract: Techniques are described for extending a two-way active measurement protocol (TWAMP) to enable measurement of service key performance indicators (KPIs) in a software defined network (SDN) and network function virtualization (NFV) architecture. The TWAMP extensions enable control messaging to be handled by a TWAMP control client executed on a centralized controller, and data messaging to be handled by a TWAMP session initiator executed on a separate network device. Techniques are also described for extending TWAMP to enable measurement of any of a plurality of service KPIs for a given service supported at a TWAMP server. The service KPIs may include one or more of keepalive measurements, round trip time measurements, path delay measurements, service latency measurements, or service load measurements. The TWAMP extensions for the service KPIs may be used in both conventional network architectures and in SDN and NFV architectures.

Abstract: A device may establish a communication session, with a client device, for monitoring a latency of a service. The device may receive, from the client device, a request for a monitored service list. The monitored service list may identify one or more services for which service latency monitoring is supported. The device may provide, to the client device, the monitored service list. The device may receive, from the client device, a service latency monitoring session request that may identify the service to be monitored. The device may establish, with the client device, the service latency monitoring session based on the service latency monitoring session request. The device may cause the service to be performed. The device may generate information for determining the latency of the service. The device may transmit, to the client device and via the service latency monitoring session, the information for determining the latency of the service.

Abstract: Techniques are described for extending a two-way active measurement protocol (TWAMP) to enable measurement of service key performance indicators (KPIs) in a software defined network (SDN) and network function virtualization (NFV) architecture. The TWAMP extensions enable control messaging to be handled by a TWAMP control client executed on a centralized controller, and data messaging to be handled by a TWAMP session initiator executed on a separate network device. Techniques are also described for extending TWAMP to enable measurement of any of a plurality of service KPIs for a given service supported at a TWAMP server. The service KPIs may include one or more of keepalive measurements, round trip time measurements, path delay measurements, service latency measurements, or service load measurements. The TWAMP extensions for the service KPIs may be used in both conventional network architectures and in SDN and NFV architectures.

Abstract: A device may receive rule information, associated with a firewall policy, that includes a set of N rules. The device may add a rule, of the set of N rules, to a detector tree associated with the firewall policy. The device may identify other rules to which the rule is to be compared. The other rules may be included in the set of N rules, and may include a quantity of rules approximately equal to a result of a logarithm to base 2 of N. The device may compare the rule and the other rules, and may detect a rule anomaly based on comparing the rule to the other rules. The rule anomaly may be associated with a conflict between the rule and a particular rule of the other rules. The device may identify the rule anomaly within the detector tree, and may output information regarding the rule anomaly.

Abstract: Techniques are described for extending a two-way active measurement protocol (TWAMP) to enable measurement of service key performance indicators (KPIs) in a software defined network (SDN) and network function virtualization (NFV) architecture. The TWAMP extensions enable control messaging to be handled by a TWAMP control client executed on a centralized controller, and data messaging to be handled by a TWAMP session initiator executed on a separate network device. Techniques are also described for extending TWAMP to enable measurement of any of a plurality of service KPIs for a given service supported at a TWAMP server. The service KPIs may include one or more of keepalive measurements, round trip time measurements, path delay measurements, service latency measurements, or service load measurements. The TWAMP extensions for the service KPIs may be used in both conventional network architectures and in SDN and NFV architectures.

Abstract: Techniques are described for performing subscriber aware two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. For example, the disclosed techniques include extending TWAMP control messaging to include a communication mode for negotiating subscriber-aware TWAMP data monitoring. If the communication mode is supported by both endpoints, a subscriber identifier is specified when a TWAMP data session is provisioned (negotiated) over the control session. The disclosed techniques further include extending TWAMP data messaging to include the subscriber identifier in each test packet for the data session. In this way, each of the endpoints may identify a subscriber corresponding to one or more received TWAMP test packets based on the subscriber identifier included in the received TWAMP test packets.

Abstract: Techniques are described for extending a two-way active measurement protocol (TWAMP) to enable measurement of service key performance indicators (KPIs) in a software defined network (SDN) and network function virtualization (NFV) architecture. The TWAMP extensions enable control messaging to be handled by a TWAMP control client executed on a centralized controller, and data messaging to be handled by a TWAMP session initiator executed on a separate network device. Techniques are also described for extending TWAMP to enable measurement of any of a plurality of service KPIs for a given service supported at a TWAMP server. The service KPIs may include one or more of keepalive measurements, round trip time measurements, path delay measurements, service latency measurements, or service load measurements. The TWAMP extensions for the service KPIs may be used in both conventional network architectures and in SDN and NFV architectures.

Abstract: Techniques are described for performing session identifier (“SID”) based two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. According to the techniques, a SID assigned to each data session is used to uniquely identify the data session, instead of a source and destination address/port pairs. A TWAMP server may generate a unique number as a SID of a data session during negotiation of the data session. The disclosed techniques include extending TWAMP control messaging to include a communication mode for the SID-based TWAMP data session provisioning. The disclosed techniques further include extending TWAMP data messaging to include the SID of the data session in each test packet for the data session. In this way, a TWAMP session sender and a TWAMP session reflector may associate received test packets with a certain data session based on the SID included in the received test packets.

Abstract: Techniques may include mapping, by a service node, a first virtual address for a particular service to private addresses that identify servers, wherein each server provides the particular service, and wherein a URL for the service resolves to the first virtual address. The techniques may include configuring a service load balancer of the service node to load balance network traffic for the first virtual address across the servers and forwarding network traffic for the first virtual address between the servers and subscriber devices. The techniques may include, associating a second virtual address with a subset of the private addresses that excludes the private address for the at least one server, and causing the URL to resolve to the second virtual address. The techniques may include forwarding network traffic for the first virtual address between the servers and the subset of the subscriber devices.