Abstract: A method is implemented by a first Provider Edge (PE) network device in a network to configure a pseudo-wire (PW) between the first PE network device and a second PE network device in the network using an Interior Gateway Protocol (IGP). The method includes receiving a first advertisement message flooded in the network by the second PE network device via the IGP, where the first advertisement messge advertises the PW. The method further includes configuring a local forwarding information base with a local PW label associated with the PW such that the first PE network device forwards traffic encapsulated with the local PW label to an Attachment Circuit associated with the PW and flooding a second advertisement message in the network via the IGP that includes an indication that the first PE network device is ready to receive traffic from the second PE network device over the PW.

Abstract: A mechanism is disclosed for implementing conditional commands carried by network data packets. A data flow including a data packet is received. The data packet includes a conditional command. A condition and a command are obtained from the conditional command. The mechanism determines that the condition is satisfied. Based on the determination that the condition is satisfied, the command is executed to alter handling of the data flow, alter handling of the data packet, or alter a context for the data flow.

Abstract: A method is implemented by a first Provider Edge (PE) network device in a network to configure a pseudo-wire (PW) between the first PE network device and a second PE network device in the network using Intermediate System to Intermediate System (IS-IS). The method includes receiving a first LSP update flooded in the network by the second PE network device via IS-IS, where the first LSP update advertises the PW. The method further includes configuring a local forwarding information base with a local PW label associated with the PW such that the first PE network device forwards traffic encapsulated with the local PW label to an Attachment Circuit associated with the PW and flooding a second LSP update in the network via IS-IS that includes an indication that the first PE network device is ready to receive traffic from the second PE network device over the PW.

Abstract: A router operates in both a Segment Routing (SR) network portion and a Multiprotocol Label Switching (MPLS) network portion of a network that utilizes Open Shortest Path First (OSPF). The router receives an OSPF advertisement message originated by a mapping server that includes a sub-Type-length-value (sub-TLV) element that identifies a preferred type of path across the MPLS network portion for an identifiable set of traffic that is to be received by the router from the SR network portion. The router identifies, based at least in part upon the sub-TLV element, one path of a plurality of available paths across the MPLS network portion for the identifiable set of traffic, and configures its forwarding plane to utilize the identified one path accordingly for the identifiable set of traffic. The OSPF advertisement message can be an OSPF LSA, and can carry an Extended Prefix Range TLV including the sub-TLV element.

Abstract: A method implemented by a sending host entity comprises sending, by the sending host entity, a data packet to a receiving host entity, a source identifier field of the data packet comprising an anonymized identifier of the sending host entity, the anonymized identifier being a temporary identifier of the sending host entity, and sending, by the sending host entity to a distributed mapping system, a request for the distributed mapping system to send information identifying the sending host entity to the receiving host entity.

Abstract: A computer-implemented method of transmitting encrypted data comprises accessing, by one or more processors of an origination endpoint, first data to be transmitted to a destination having a corresponding identifier; generating, by the one or more processors, an identifier security header; generating, by the one or more processors, second data from the first data and the identifier security header; encrypting, by the one or more processors, the second data; generating, by the one or more processors, authentication data based on the encrypted second data; generating, by the one or more processors, third data from the encrypted second data and the authentication data; generating, by the one or more processors, fourth data from the identifier corresponding to the destination and the third data; and sending, by the one or more processors, the fourth data to the destination.

Abstract: A method implemented by a receiving host entity comprises transmitting, by a transmitter of the receiving host entity, a message comprising an anonymization policy of the receiving host entity, the message comprising an anonymized identifier of the receiving host entity, the anonymized identifier being an ephemeral identifier of the receiving host entity, and receiving, by a receiver of the receiving host entity, a data packet from a sending host entity, a destination identifier field of the data packet including the anonymized identifier

Abstract: An apparatus in an IP network, the apparatus comprises: a receiver configured to: obtain an identity of a first entity, the identity is a unique identification of the first entity at a given time, obtain a first identifier of the identity, and obtain a second identifier of the identity, the first identifier and the second identifier are identifications of the identity; and a processor coupled to the receiver and configured to: create an association of the first identifier and the second identifier with the identity, and instruct storage of the association in a database.

Abstract: A method for providing mobility for Transmission Control Protocol (TCP) transport with session continuity. In one embodiment, the method establishes a communication session between a first communication device and a second communication device using a TCP seamless mobility option (TCP-SMO) connection identifier for identifying the communication session between the first communication device and the second communication device. The method exchanges data between the communication device and the second communication device during the communication session. The method maintains the communication session between the communication device and the second communication device in response to a mobility event using the TCP-SMO connection identifier.

Abstract: A method implemented by a firewall device in a network, comprising storing, by a memory, a firewall policy comprising information indicating whether to forward a data packet from a sending host entity to a receiving host entity, receiving, by a receiver, a data packet from a sending host entity, wherein the data packet includes an identifier of the receiving host entity, and determining, by a processor coupled to the memory and the receiver, whether to forward the data packet to the receiving host entity based on the firewall policy and the identifier of the receiving host entity.

Abstract: A computer-implemented method of extending generic resilient identity services (GRIDS) is provided that comprises: receiving, by a mapping server, a resolve request from an originator endpoint for a locator of a destination endpoint; sending, by the mapping server, a request for authorization to provide the requested locator, the request for authorization indicating an identifier of the originator endpoint; receiving, by a policy server, the request for authorization; accessing, by the policy server, from a database, a set of policies for the destination endpoint; based on the identifier of the originator endpoint and the set of policies for the destination endpoint, sending, by the policy server, an authorization response to the mapping server; and based on the authorization response, sending, by the mapping server, a response to the resolve request to the originator endpoint.

Abstract: A provider edge (PE) router and methods for establishing a pseudowire using open shortest path first (OSPF) link state advertisement (LSA) messages. The pseudowire links the PE router with a remote PE router through a packet switched network (PSN), and emulates other communications protocols to provide customer edge (CE) equipment connected to the PE routers the appearance of a dedicated private circuit.

Abstract: A method of a network device identifies multi-homed prefixes in an intermediate system-intermediate system (IS-IS) area or IS-IS domain during shortest path first (SPF) computation for use in a loop free alternate (LFA) computation. The method and network device select a next node in a shortest path tree (SPT) and determine a set of prefixes associated with the selected node in the SPT. A next prefix from the set of prefixes of the selected node is selected and a check is made whether the selected prefix exists in the local RIB associated with another node of a same level, then the selected prefix is marked as a multi-homed prefix in the local RIB. A check is made whether all prefixes associated with the selected node are processed and whether all nodes in the SPT have been processed, before downloading the local RIB to a global RIB.

Abstract: A method and system implemented by a network device, where the network device is in a network having a plurality of nodes. The method computes a loop free alternative (LFA) next hop as a backup for a primary path next hop for intermediate system-intermediate system (IS-IS). The method improves LFA computation efficiency by minimizing expansion of prefixes. The method includes expanding all prefixes of the next LFA shortest path first (SPF) destination node and inheriting a next candidate next hop as a current LFA next hop where the next candidate next hop provides link or node protection and better protection than the current LFA next hop.

Abstract: An automated key transition method is executed by a node in a network. The network includes a set of nodes utilizing a current key identifier. A key identifier specifies an authentication protocol and an authentication key for use in the authentication of intermediate-system to intermediate-system (IS-IS) protocol data units. The method includes a set of steps including receiving a message at the node, where, the message includes a most recent key identifier to replace the current key identifier, verifying whether all reachable nodes in the set of nodes have advertised the most recent key identifier, continuing authentication using the current key identifier until all reachable nodes in the set of nodes have been verified to advertise the most recent key identifier, and switching authentication at the node to use the most recent key identifier upon verification that all reachable nodes in the set of nodes have advertised the most recent key identifier.

Abstract: A method is executed by a network device to a calculate loop free alternative (LFA) for each node in an intermediate system-intermediate system (IS-IS) area or IS-IS domain where the network device is connected with other nodes via multiple parallel links. The method includes a shortest path first (SPF) computation of the primary paths for the network device that tracks directly connected links from each node in the IS-IS area or IS-IS domain to the network device which is a source node for the SPF. These tracked links can then be utilized in subsequent LFA computations to avoid unnecessary calculations.

Abstract: A method and system are provided to install a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables testing of the LFA next hop to ensure proper handling of data forwarding on the LFA. The method includes receiving a trigger message from an administrative module indicating a switch to the LFA next hop the message including a prefix and an interface. A check is made whether a set of primary path next hops of the prefix have been exhausted. A next primary path next hop is selected from the set of primary path next hops of the prefix. A check is made whether the next primary path next hop matches the interface. The next primary path next hop is replaced by installing the LFA next hop into a global routing information base.

Abstract: A method and implementing system calculates a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables consideration of the LFA next hop where a link to the next hop has a reverse cost that has a maximum value. The method includes selecting a next candidate next hop from a set of candidate next hops in the network, checking whether a link to the next candidate next hop is an administratively allowable link, and checking whether the link has a maximum forward cost. The method further checks whether the link is bi-directional and computes the LFA using the next candidate next hop where the link is administratively allowable link, where the link does not have a maximum forward cost and where the link is bi-directional without consideration of reverse cost of the link.

Abstract: A method is executed by a network device to determine a loop free alternate (LFA) for a multi-homed prefix in an IS-IS area or IS-IS domain. The method includes selecting a next node from the IS-IS area or the IS-IS domain and selecting a next prefix for the selected node. A check is made whether the selected prefix is a multi-homed prefix (MHP). A check is made whether a shortest path first (SPF) cost of the selected node and cost to the selected prefix is equal to an SPF cost of the selected prefix, whether a next hop of selected prefix is same as next hop of selected node, and whether a LFA next hop of the selected node is better protection than a current next hop protection of the selected prefix and the LFA next hop of the selected node is then inherited for the selected prefix.

Abstract: The method and system to computes an LFA next hop as a backup for a primary path next hop that enables an administrator to control LFA selection for a given destination node using a tag and a weight. The method includes checking whether an interface of a next candidate node has a tag with a tag value matching a tag value of a primary SPF path for the destination node. The method further includes checking whether the destination node has any LFA, checking whether a stored tag differs from the tag value of the primary SPF path, and checking whether the interface of the next candidate node is preferred based on a comparison of a weight values, and replacing a stored LFA for the destination node with the next candidate node. Where conditions are met a stored LFA is replaced with the next candidate node.