# US 11,444,975 B2 · Deploying secure neighbor discovery in EVPN > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,975 B2 - Document ID: US11444975B2 - Status: Granted - Kind: B2 - Application number: 16/860,828 - Filed: 2020-04-28 - Published: 2021-04-22 - Granted: 2022-09-13 - Earliest claimed: 2019-10-18 - Assignees: Juniper Networks, Inc. - Applicants: Juniper Networks, Inc. - Inventors: Reji Thomas; SelvaKumar Sivaraj - Web page: https://patentgrep.com/patent/US11444975B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 41/12: Discovery or management of network topologies - H04L 45/24: Multipath - H04L 45/26: {Route discovery packet} - H04L 45/64: using an overlay routing layer - H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's} - H04L 61/6022 - H04L 63/0272: {Virtual private networks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are described for providing security extensions to neighbor discovery in Ethernet Virtual Private Network (EVPN). For example, a network device that implements Ethernet Virtual Private Network (EVPN) receives a neighbor discovery response message including a nonce originated by a second network device and not originated by the first network device. The network device processes the neighbor discovery response message including the nonce originated by the second network device and not originated by the first network device. ## Claims ### Claim 1 A method comprising: receiving, by a first network device that implements Ethernet Virtual Private Network (EVPN), a neighbor discovery response message including a nonce originated by a second network device, wherein the first network device and second network device are coupled to a host device by a multi-homed intermediate network device by an Ethernet segment; determining, by the first network device, whether the nonce of the neighbor discovery response message matches a nonce stored in the first network device; and in response to determining that the nonce of the neighbor discovery response message does not match a nonce stored in the first network device, determining, by the first network device, whether the neighbor discovery response message was received on an Ethernet segment identifier (ESI) interface of the Ethernet segment; and in response to determining that the neighbor discovery response message was received on the ESI interface of the Ethernet segment, dropping the nonce from the neighbor discovery response message to learn a link layer address from the neighbor discovery response message. ### Claim 2 (depends on 1) The method of claim 1, wherein the first network device and the second network device operate as both a layer 2 gateway and a layer 3 gateway. ### Claim 3 (depends on 1) The method of claim 1, wherein the neighbor discovery response message comprises a neighbor advertisement message configured using a Neighbor Discovery Protocol (NDP). ### Claim 4 (depends on 3) The method of claim 3, wherein the Neighbor Discovery Protocol is extended to include security extensions including SEcure Neighbor Discovery (SEND). ### Claim 5 (depends on 1) The method of claim 1, wherein the neighbor discovery response message comprises a first neighbor discovery response message including a first nonce originated by the second network device, further comprising: receiving, by the first network device, a second neighbor discovery response message including a second nonce originated by the second network device, determining, by the first network device, whether the second nonce of the second neighbor discovery response message matches a nonce stored in the first network device; in response to a determining that the second nonce of the second neighbor discovery message does not match the nonce stored in the first network device, determining that a destination address of the second neighbor discovery response message is a physical IP address of the second network device; and in response to determining that the destination address of the second neighbor discovery response message is the physical IP address of the second network device, sending, by the first network device, the second neighbor discovery response message to the second network device via an overlay network. ### Claim 6 A first network device that implements Ethernet Virtual Private Network (EVPN), comprising: one or more processors coupled to a memory, wherein the one or more processors are configured to: receive a neighbor discovery response message including a nonce originated by a second network device, wherein the first network device and the second network device are coupled to a host device by a multi-homed intermediate network device by an Ethernet segment; determine whether the nonce of the neighbor discovery response message matches a nonce stored in the first network device; and in response to a determination that the nonce of the neighbor discovery message does not match a nonce stored in the first network device, determining that a destination address of the neighbor discovery response message is a physical IP address of the second network device; and in response to determining that the destination address of the neighbor discovery response message is the physical IP address of the second network device, sending, by the first network device, the neighbor discovery response message to the second network device via an overlay network. ### Claim 7 (depends on 6) The first network device of claim 6, wherein the neighbor discovery response message comprises a neighbor advertisement message configured using a Neighbor Discovery Protocol (NDP). ### Claim 8 (depends on 6) The first network device of claim 6, wherein the Neighbor Discovery Protocol is extended to include security extensions including SEcure Neighbor Discovery (SEND). ### Claim 9 (depends on 6) The first network device of claim 6, wherein the first network device and the second network device operate as a layer 2 gateway. ### Claim 10 A non-transitory computer-readable storage medium comprising instructions for causing one or more programmable processors of a first network device to: intercept, from a local host device coupled to the first network device, a first neighbor discovery response message including a nonce, wherein the first neighbor discovery response message is generated by the local host device in response to a first neighbor discovery request message, wherein the first neighbor discovery response message is destined for a remote host device; determine whether the nonce of the neighbor discovery response message matches a nonce stored in the first network device; and in response to a determination that the nonce of the neighbor discovery response message does not match a nonce stored in the first network device, store the nonce; drop the first neighbor discovery response message; send a second neighbor discovery request message to the local host device, wherein the second neighbor discovery request message includes the nonce; receive, from the local host device, a second neighbor discovery response message including the nonce; and in response to determining that the nonce is stored in the first network device, store one or more link layer addresses learned from the second neighbor discovery response message. ### Claim 11 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein the instructions further cause one or more programmable processors of the first network device to: receive a third neighbor discovery request message from a second local host device and destined for the remote host device; and send, by the first network device and using the one or more link layer addresses stored in the first network device, a third neighbor discovery response message rather than sending the third neighbor discovery request message over an EVPN core. ### Claim 12 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein the first neighbor discovery response message comprises a neighbor advertisement message configured using a Neighbor Discovery Protocol (NDP). ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the Neighbor Discovery Protocol is extended to include security extensions including SEcure Neighbor Discovery (SEND).