Abstract: A method includes issuing a tuned request on a specified active link having an ingress shaper and an egress shaper to a server utilizing a link capacity to an extent in both a forward path and a return path, determining a link capacity for the active link, monitoring the active link and dropping any traffic traveling via the active link when a limit of at least one of the ingress shaper and the egress shaper is exceeded.

Abstract: In one embodiment, a method includes receiving session information at a traffic interceptor in communication with a plurality of service devices, the session information transmitted from one of the service devices and identifying flows associated with a session and the service device associated with the session, storing the session information at the traffic interceptor, and transmitting traffic received at the traffic interceptor to the service device selected based on the session information. An apparatus is also disclosed.

Abstract: A method includes allocating an identifier to each of a plurality of policies each comprising a network-isolation identifier associated with a VXWAN directive and transmitting each of the plurality of policies to one or more devices in a network.

Abstract: A method includes receiving at a branch device an assigned first hub device and an assigned second hub device associated with a data center, establishing a VPN data tunnel to the assigned first and second hub devices, designating the first hub device as a primary device, designating the second hub device as a secondary device and switching traffic destined for the primary device to the secondary device based, at least in part, on a cost of a link.

Abstract: A method includes detecting a data flow and an associated originating interface on a network, determining a first link over which to forward the data flow, transmitting the data flow over the determined link, receiving a return data flow and moving a forward direction of the return data flow to a new path if the return data flow arrived via a link other than the first link, wherein all packets following a first packet on the flow are forwarded on the same path as the first packet.

Abstract: A method includes determining a network requirement for at least one application, dynamically determining a link suitable for data transmission in accordance with a policy based at least in part on a current network condition to meet the network requirement and routing one or more application network data flows associated with the at least one application over the link.

Abstract: A method includes receiving information describing an addition of a first site comprising at least one application to an existing network wherein the information is selected from the group consisting of type of site, planned connectivity to the site and planned policies for the site and estimating an impact on the operation of the at least one application and associated network traffic using statistical analysis of monitored data collected from a second site similar to the first site.

Abstract: A method includes monitoring a plurality of network devices to collect network performance data comprising data flow records of each device on the network and to create a network topology database, accessing the network topology database comprising information on an entry and exit point of each device, the manner in which the devices are connected and a plurality of data flow records on a single data flow from multiple devices on the network and utilizing the network topology database to perform an asymmetric detection algorithm to identify one or more data flows that exited a device via a first path and returned to the device via a different second path.

Abstract: A method includes determining a plurality of network segments comprising a network, determining a manner in which the plurality of segments are connected, determining network segments and how segments are connected, at least in part, without a routing protocol, discovering a plurality of external network segments via a hub device associated with the network and utilizing the plurality of network segments comprising the network, the manner in which the plurality of segments are connected and the plurality of external network segments.

Abstract: A method includes deploying in series a plurality of configurable devices in a network configured to communicate with one another via a protocol for exchanging state information wherein at least one of the plurality of configurable devices is in an active state and at least one of the plurality of devices is in a standby state, detecting, by the at least one of the plurality of configurable devices in a standby state, a failure of a configurable device in an active state via a protocol and switching the at least one configurable device in a standby state to an active state.

Abstract: A method includes executing at a controller a horizontally scalable service Identity Definitions Manager (IDM) Service, mapping active directory (AD) domains to WAN network elements DNS ROLE and LDAP ROLE, instructing a plurality of network elements associated with a tenant to discover a plurality of AD domains and AD servers in an enterprise using the DNS ROLE, receiving from the plurality of network elements running DNS ROLE information indicative of changes to network attributes selected from the group consisting of AD domains, additions and subtractions of AD servers and changes in an IP address of AD servers and transmitting the received AD domains and AD servers to a tenant administrator and requesting credentials to communicate with added AD servers using LDAP.

Abstract: A method includes receiving from a networked spoke device information describing network flows to and from an application, analyzing the information to characterize the application in at least one dimension selected from the group consisting of bi-directional bandwidth usage, network response times, application response times, a number of idle and active application sessions and a maximum number of concurrent application sessions and transmitting the dimensions to at least one networked spoke device as traffic profile information.

Abstract: A method includes issuing a tuned request on a specified active link having an ingress shaper and an egress shaper to a server utilizing a link capacity to an extent in both a forward path and a return path, determining a link capacity for the active link, monitoring the active link and dropping any traffic traveling via the active link when a limit of at least one of the ingress shaper and the egress shaper is exceeded.

Abstract: In one embodiment, a network frame is received at flow aware navigator between a client computer and a server computer. The flow aware navigator is configured to determine whether the network frame should be forwarded to one or more network services for processing before forwarding the network frame to the server computer. If the flow aware navigator determines that the network frame should be forwarded to one or more network services for processing before forwarding the network frame to the server computer, the flow aware navigator forwards the network frame to the one or more network services for processing. In response to receiving the processed network frame from the network services, the flow aware navigator then forwards the processed network frame to the server computer.

Abstract: In one embodiment, a network frame is received at flow aware navigator between a client computer and a server computer. The flow aware navigator is configured to determine whether the network frame should be forwarded to one or more network services for processing before forwarding the network frame to the server computer. If the flow aware navigator determines that the network frame should be forwarded to one or more network services for processing before forwarding the network frame to the server computer, the flow aware navigator forwards the network frame to the one or more network services for processing. In response to receiving the processed network frame from the network services, the flow aware navigator then forwards the processed network frame to the server computer.

Abstract: In one embodiment, a method includes obtaining a flow, identifying an application associated with the flow, and identifying a first unique application identifier (UAID) for the application. The first UAID uniquely identifies the application. The method also includes adding the first UAID to the flow, and routing the flow through a network after adding the first UAID to the flow.

Abstract: In one embodiment, a method includes receiving session information at a traffic interceptor in communication with a plurality of service devices, the session information transmitted from one of the service devices and identifying flows associated with a session and the service device associated with the session, storing the session information at the traffic interceptor, and transmitting traffic received at the traffic interceptor to the service device selected based on the session information. An apparatus is also disclosed.

Abstract: Methods and apparatus for defining an alternate circuit path within a network given nodal diverse or link diverse constraints are disclosed. According to one aspect of the present invention, a device for computing circuit paths between a first node and a second node within a network that has a plurality of elements includes a route generator and a list mechanism. The route generator computes a primary circuit path between the first node and the second node such that the primary circuit path includes a first element. The list mechanism identifies the first element as being inaccessible to an alternate circuit path. Using the list mechanism, the route generator computes an alternate circuit path that does not include the first element identified by the list mechanism. In one embodiment, the first element is a link. In another embodiment, the first element is a node.

Abstract: Methods and apparatus for defining an alternate circuit path within a network are described. According to one aspect of the present invention, a device for computing circuit paths between a first node and a second node within a network that has a plurality of elements includes a route generator and a list mechanism. The route generator computes a primary circuit path between the first node and the second node such that the primary circuit path includes a first element. The list mechanism identifies the first element as being inaccessible to an alternate circuit path. Using the list mechanism, the route generator computes an alternate circuit path that does not include the first element identified by the list mechanism. In one embodiment, the first element is a link. In another embodiment, the first element is a node.

Abstract: Methods and apparatus for creating a primary path such that the ability to create a corresponding alternate path, if one exists, is effectively ensured are disclosed. According to one aspect of the present invention, a method for creating a circuit path includes selecting a first unprotected link, and identifying a first potential unprotected path segment that includes the first unprotected link and is arranged between a first node and a second node. A determination is automatically made regarding whether the first potential unprotected path segment has a corresponding first alternate path segment between the first node and the second node. If it is determined that the first potential unprotected path segment has a corresponding first alternate path segment, the first unprotected link is added to the first potential unprotected path segment. Then, the first potential unprotected path segment is designated as an unprotected path segment of the circuit path.