# US 10,320,687 B2 · Policy enforcement for upstream flood traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,687 B2 - Document ID: US10320687B2 - Status: Granted - Kind: B2 - Application number: 15/792,650 - Filed: 2017-10-24 - Published: 2018-03-01 - Granted: 2019-06-11 - Earliest claimed: 2015-05-08 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Joji Thomas Mekkattuparamban; Vijay Chander - Web page: https://patentgrep.com/patent/US10320687B2 ## CPC - H04L 47/20: Traffic policing - H04L 12/185: {with management of multicast group membership} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 45/32: {Flooding (denial of service attacks H04L63/1458)} - H04L 45/58: Association of routers - H04L 49/70: {Virtual switches} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and computer-readable media are provided for enforcing policy for upstream (e.g., traffic from an endpoint to the physical network layer or hardware fabric of a data center) flood traffic (e.g., broadcast, unknown unicast, or multicast traffic) originating from a virtual endpoint via a network fabric. In one embodiment, upstream flood traffic can be transmitted using a special multicast group to which only elements of the data center fabric (e.g., physical switches, routers) are subscribed. That is, upstream flood traffic is assigned to the special multicast group, resulting in unintended endpoints not receiving the flood traffic. However, the hardware fabric receives the flood traffic and will then enforce applicable policies to route the packets to intended endpoints. ## Claims ### Claim 1 A method comprising: obtaining network traffic from a source virtual endpoint to be forwarded to one or more destination endpoints; determining the network traffic corresponds to flood traffic, the flood traffic including all broadcast traffic, unknown unicast traffic, and multicast traffic, any packet of the network traffic including routing information for an unknown destination endpoint not corresponding to routing table information is processed as the unknown unicast traffic; generating encapsulated flood traffic including the flood traffic and destination information corresponding to a multicast group to which one or more elements of a physical network are subscribed; and forwarding the encapsulated flood traffic to be received by the one or more elements of the physical network prior to being received by the one or more destination endpoints based at least in part on encapsulation of the flood traffic with the destination information. ### Claim 2 (depends on 1) The method of claim 1, wherein the physical network comprises a data center fabric and a multicast destination address is associated with the multicast group, the multicast group comprising nodes subscribed to the multicast group, the nodes subscribed to the multicast group comprise only nodes in the data center fabric. ### Claim 3 (depends on 1) The method of claim 1, further comprising: applying one or more policies via at least one of the one or more elements in the physical network associated with a multicast destination address. ### Claim 4 (depends on 3) The method of claim 3, wherein the one or more policies correspond to an allow, deny, redirect, change quality of service (QoS), encrypt, drop, or copy action. ### Claim 5 (depends on 1) The method of claim 1, further comprising: mapping the source virtual endpoint to a first endpoint group and the one or more destination endpoints to a respective second endpoint group; and determining one or more policies between the first endpoint group and the respective second endpoint group. ### Claim 6 (depends on 1) The method of claim 1, wherein the network traffic is received from a virtual switch associated with the source virtual endpoint, and wherein the source virtual endpoint and the virtual switch are downstream from the physical network. ### Claim 7 (depends on 6) The method of claim 6, wherein the virtual switch is a virtual tunnel endpoint. ### Claim 8 (depends on 1) The method of claim 1, wherein the physical network comprises a data center having one or more spine and leaf switches. ### Claim 9 A system comprising: at least one processor; and at least one non-transitory computer-readable storage medium having stored therein instructions that, upon being executed by the at least one processor, cause the at least one processor to: receive traffic originating from a source virtual endpoint, the traffic being designated for one or more destination endpoints; determine the traffic includes encapsulated flood traffic with destination information corresponding to a multicast group to which one or more elements of a physical network are subscribed, the encapsulated flood traffic including all broadcast traffic, unknown unicast traffic, and multicast traffic, any packet of the traffic including routing information for an unknown destination endpoint not corresponding to routing table information is processed as the unknown unicast traffic; and forward the encapsulated flood traffic to be received by the one or more elements of the physical network prior to being received by the one or more destination endpoints based at least in part on the destination information. ### Claim 10 (depends on 9) The system of claim 9, wherein the instructions upon being executed further cause the at least one processor to: perform a lookup for one or more policies based on at least a first endpoint group. ### Claim 11 (depends on 9) The system of claim 9, the instructions upon being executed further cause the at least one processor to: configure the multicast group such that no endpoints in one or more logical networks can subscribe to the multicast group. ### Claim 12 (depends on 9) The system of claim 9, wherein the traffic is received at least one of a virtual switch or a virtual tunnel endpoint. ### Claim 13 (depends on 9) The system of claim 9, wherein the physical network comprises a Clos or spine-leaf network. ### Claim 14 (depends on 9) The system of claim 9, wherein the source virtual endpoint is downstream from the physical network, the physical network comprising a network fabric. ### Claim 15 A non-transitory computer-readable storage medium having stored therein instructions that, upon being executed by at least one processor, cause the at least one processor to: obtain network traffic associated with a source virtual endpoint, the network traffic to be forwarded to one or more destination endpoints; determine the network traffic includes encapsulated flood traffic with destination information corresponding to a multicast group to which one or more elements of a physical network are subscribed, the encapsulated flood traffic including all broadcast traffic, unknown unicast traffic, and multicast traffic, any packet of the network traffic including routing information for an unknown destination endpoint not corresponding to routing table information is processed as the unknown unicast traffic; and forward the encapsulated flood traffic to be received by the one or more elements of the physical network prior to being received by the one or more destination endpoints based at least in part on the destination information. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instructions upon being executed further cause the at least one processor to: encapsulate the flood traffic with a network address to yield the encapsulated flood traffic; and forward the encapsulated flood traffic based on the network address in the encapsulated flood traffic. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instructions upon being executed further cause the at least one processor to: apply one or more policies via at least one of the one or more elements in the physical network associated with a multicast destination address. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the one or more policies correspond to an allow, deny, redirect, change quality of service (QoS), encrypt, drop, or copy action. ### Claim 19 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the physical network comprises one or more spine switches and leaf switches, wherein one or more leaf switches and spine switches are interconnected.