# US 11,909,819 B1 · Synchronization of client IP binding database across extended networks leveraging BGP control plane > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,819 B1 - Document ID: US11909819B1 - Status: Granted - Kind: B1 - Application number: 18/070,209 - Filed: 2022-11-28 - Granted: 2024-02-20 - Earliest claimed: 2022-11-28 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Saumya Dikshit; Thimma Reddy Gadekal - Web page: https://patentgrep.com/patent/US11909819B1 ## CPC - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and system are provided which facilitate synchronization of client IP binding databases across an extended network by leveraging the BGP control plane. During operation, a switch configures a first synchronization identifier indicating validated Internet Protocol (IP) binding information of an associated client. The switch receives a Border Gateway Protocol (BGP) update message associated with a first client, wherein the BGP update message includes a second synchronization identifier. Responsive to determining that the second synchronization identifier matches the first synchronization identifier, the switch: extracts from the BGP update message reachability information, which includes media access control (MAC) and IP information associated with the first client; validates the MAC and IP information based on security policies; and adds the MAC and IP information to a local IP binding database, thereby allowing synchronization of the validated IP binding information of the first client between the switch and other switches. ## Claims ### Claim 1 A computer-implemented method, comprising: configuring, by a switch, a first synchronization identifier to indicate validated Internet Protocol (IP) binding information; receiving a Border Gateway Protocol (BGP) update message associated with a first client, wherein the BGP update message includes a second synchronization identifier; and responsive to determining that the second synchronization identifier matches the first synchronization identifier: extracting from the BGP update message reachability information, which includes media access control (MAC) and IP information associated with the first client; validating, based on security policies, the MAC and IP information associated with the first client; and adding the validated MAC and IP information associated with the first client to a local IP binding database, thereby allowing synchronization of the validated MAC and IP information associated with the first client between the switch and other switches. ### Claim 2 (depends on 1) The method of claim 1, further comprising: validating locally learned IP bindings of associated clients; and updating the local IP binding database with the validated IP bindings of the associated clients. ### Claim 3 (depends on 1) The method of claim 1, wherein the first synchronization identifier is configured on all switches in the extended network. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining whether the switch supports processing based on the second synchronization identifier included in the BGP update message; responsive to determining that the switch does not support processing based on the second synchronization identifier, refraining from determining whether the second synchronization identifier matches the first synchronization identifier and further refraining from the extracting, the validating, and the adding; and responsive to determining that the switch supports processing based on the second synchronization identifier, determining whether the second synchronization identifier matches the first synchronization identifier. ### Claim 5 (depends on 1) The method of claim 1, wherein the switch and the other switches belong to an extended network provisioned by BGP, wherein the BGP update message is transmitted by another switch in the extended network, wherein the reachability information extracted from the BGP update message comprises Network Layer Reachability Information, wherein the BGP update message is a Route-Type-2 message, wherein the BGP update message includes a path attribute of an extended communities, wherein the extended communities path attribute indicates the second synchronization identifier, and wherein the method further comprises extracting the second synchronization identifier from the extended communities path attribute of the BGP update message. ### Claim 6 (depends on 1) The method of claim 1, further comprising: responsive to determining that the second synchronization identifier does not match the first synchronization identifier: refraining from adding the MAC and IP information associated with the first client to the local IP binding database. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving a BGP withdraw message which indicates an invalidity of the MAC and IP information associated with the first client and extracted from the BGP update message; and responsive to receiving the BGP withdraw message, determining the invalidity of the previously added MAC and IP information associated with the first client in the local IP binding database. ### Claim 8 (depends on 1) The method of claim 1, wherein a configuration scope of the first synchronization identifier comprises at least one of: a global configuration scope which applies to all BGP updates; and a specific configuration scope which applies to one or more groups of switches for which corresponding MAC and IP information is to be published as indicated in the BGP update message. ### Claim 9 (depends on 1) The method of claim 1, wherein a respective switch comprises a virtual tunnel endpoint (VTEP), and wherein a respective group of switches comprises a virtual local area network (VLAN). ### Claim 10 (depends on 1) The method of claim 1, wherein the switch comprises an access switch; wherein the extended network is an overlay network which comprises at least one of: an Ethernet virtual private network (EVPN); a virtual private local area network (LAN) service (VPLS); a virtual private wire service (VPWS); and a Layer 3 virtual private network (L3-VPN); and wherein a fabric for the overlay network comprises at least one of: a virtual extensible local area network (VxLAN); a multi-protocol label switching (MPLS) technique; a network virtualization using generic routing encapsulation (NV-GRE); and a general protocol extension (GPE) technique. ### Claim 11 A non-transitory computer-readable storage medium comprising instructions that when executed by a computing system cause the computing system to: configure, by a switch, a first synchronization identifier to indicate validated Internet Protocol (IP) binding information; receive a Border Gateway Protocol (BGP) update message associated with a first client, wherein the BGP update message includes a second synchronization identifier; and responsive to determining that the second synchronization identifier matches the first synchronization identifier: extract from the BGP update message reachability information, which includes media access control (MAC) and IP information associated with the first client; validate, based on security policies, the MAC and IP information associated with the first client; and add the validated MAC and IP information associated with the first client to a local IP binding database, thereby allowing synchronization of the validated MAC and IP information associated with the first client between the switch and other switches. ### Claim 12 (depends on 11) The non-transitory computer-readable storage medium of claim 11, further comprising instructions to: validate locally learned IP bindings of associated clients; and update the local IP binding database with the validated IP bindings of the associated clients. ### Claim 13 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein a configuration scope of the first synchronization identifier comprises at least one of: a global configuration scope which applies to all BGP updates, wherein the first synchronization identifier is configured on all switches in the extended network; and a specific configuration scope which applies to one or more groups of switches for which corresponding MAC and IP information is to be published as indicated in the BGP update message. ### Claim 14 (depends on 11) The non-transitory computer-readable storage medium of claim 11, further comprising instructions to: determine whether the switch supports processing based on the second synchronization identifier included in the BGP update message; responsive to determining that the switch does not support processing based on the second synchronization identifier, refrain from determining whether the second synchronization identifier matches the first synchronization identifier and further refrain from the extracting, the validating, and the adding; and responsive to determining that the switch supports processing based on the second synchronization identifier, determine whether the second synchronization identifier matches the first synchronization identifier. ### Claim 15 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the switch and the other switches belong to an extended network provisioned by BGP, wherein the BGP update message is transmitted by another switch in the extended network, wherein the reachability information extracted from the BGP update message comprises Network Layer Reachability Information, wherein the BGP update message is a Route-Type-2 message, wherein the BGP update message includes a path attribute of an extended communities, wherein the extended communities path attribute indicates the second synchronization identifier, and wherein the method further comprises extracting the second synchronization identifier from the extended communities path attribute of the BGP update message. ### Claim 16 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the method further comprises: responsive to determining that the second synchronization identifier does not match the first synchronization identifier: refraining from adding the MAC and IP information to the local IP binding database. ### Claim 17 (depends on 11) The non-transitory computer-readable storage medium of claim 11, further comprising instructions to: receive a BGP withdraw message which indicates an invalidity of the MAC and IP information associated with the first client and extracted from the BGP update message; and responsive to receiving the BGP withdraw message, determine the invalidity of the previously added MAC and IP information associated with the first client and in the local IP binding database. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the BGP update message and the BGP withdraw message are further received by at least one of a first internal BGP (iBGP)-peer entity and one or more external BGP (eBGP)-peer entities and processed in a similar manner as by the switch. ### Claim 19 (depends on 11) The non-transitory computer-readable storage medium of claim 11, wherein the switch comprises an access switch; wherein the extended network is an overlay network which comprises at least one of: an Ethernet virtual private network (EVPN); a virtual private local area network (LAN) service (VPLS); a virtual private wire service (VPWS); and a Layer 3 virtual private network (L3-VPN); and wherein a fabric for the overlay network comprises at least one of: a virtual extensible local area network (VxLAN); a multi-protocol label switching (MPLS) technique; a network virtualization using generic routing encapsulation (NV-GRE); and a general protocol extension (GPE) technique. ### Claim 20 An computer system, comprising: processing circuitry; forwarding hardware; a logic block comprising: a synchronization identifier-configuring block to configure, by a switch, a first synchronization identifier to indicate validated Internet Protocol (IP) binding information; a first validating block to validate locally learned IP bindings of associated clients of the switch; a BGP update message-managing block to receive a Border Gateway Protocol (BGP) update message associated with a first client, wherein the BGP update message includes a second synchronization identifier; an extended communities path attribute-processing block to determine whether and that the switch supports processing based on the second synchronization identifier included in the BGP message; a synchronization identifier-matching block to determine that the second synchronization identifier matches the first synchronization identifier; a network layer reachability information-obtaining block to extract from the BGP update message reachability information, which includes media access control (MAC) and IP information associated with the first client; a second validating block to validate, based on security policies, the MAC and IP information associated with the first client; and a database managing block to add the validated MAC and IP information associated with the first client to a local IP binding database, thereby allowing synchronization of the validated MAC and IP information associated with the first client between the switch and other switches.