US 12,003,348 B2 · Micro and macro segmentation in enterprise networks without a per segment layer-3 domain

Abstract

Secure network segmentation using logical subnet segments is described. A single network segment or subnet provided by a third party is mapped into multiple layer-3 virtual or logical segments without requiring separate subnets. This mapping is accomplished by using virtual routing functions (VRFs) per logical subnet segment while retaining a single subnet across the segments. The logical subnet segments interact with the single network segment provided by the third party (ISP). The layer-3 VRF instances are created without the need for separate IP subnet pools per layer-3 segment. Each VRF instance for the various logical subnet segments is mapped to an identifier and tag.

Claims20

Dependent claims

A method comprising:

initiating a default external interface for an external network comprising a single default switched virtual interface (SVI) for communication with the external network and corresponding to a virtual local area network (VLAN) provided by the external network;
establishing a logical subnet segment interface from a main subnet segment, where a logical subnet segment and one or more additional logical subnet segments are represented to the external network as a single subnet segment and wherein the logical subnet segment interface does not have an assigned Internet Protocol (IP) address;
and
assigning an identifier to the logical subnet segment interface for the logical subnet segment;
and
mapping at least one tag to the identifier for the logical subnet segment.

3 more elements

A system comprising:

a processor;
and
a memory comprising instructions which, when executed on the processor, performs an operation, the operation comprising:
initiating a default external interface for an external network comprising a single default switched virtual interface (SVI) for communication with the external network and corresponding to a virtual local area network (VLAN) provided by the external network;
establishing a logical subnet segment interface from a main subnet segment, where a logical subnet segment and one or more additional logical subnet segments are represented to the external network as a single subnet segment and wherein the logical subnet segment interface does not have an assigned Internet Protocol (IP) address;
and
assigning an identifier to the logical subnet segment interface for the logical subnet segment;
and
mapping at least one tag to the identifier for the logical subnet segment.

6 more elements

A computer program product, the computer program product comprising:

a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by one or more computer processors to perform an operation, the operation comprising:
initiating a default external interface for an external network comprising a single default switched virtual interface (SVI) for communication with the external network and corresponding to a virtual local area network (VLAN) provided by the external network;
establishing a logical subnet segment interface from a main subnet segment, where a logical subnet segment and one or more additional logical subnet segments are represented to the external network as a single subnet segment and wherein the logical subnet segment interface does not have an assigned Internet Protocol (IP) address;
and
assigning an identifier to the logical subnet segment interface for the logical subnet segment;
and
mapping at least one tag to the identifier for the logical subnet segment.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application

17/649,955Filed 4 Feb 2022 · continuation

Priority

19 Jan 2020

Published

US 2022/0158869 A119 May 2022

Granted

4 Jun 2024

Term ends

Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 12/4679
Dynamic sharing of VLAN information amongst network nodes: arrangements for the registration or de-registration of VLAN attribute values, e.g.…
H04L 12/1868
Comprising mechanisms for improved reliability, e.g. status reports: measures taken after transmission, e.g. acknowledgments
H04L 12/1886
For broadcast or conference , e.g. multicast: with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains
H04L 12/4633
Interconnection of networks: interconnection of networks using encapsulation techniques, e.g. tunneling

Family

Application16/746,903Parent of this continuation · filed 19 Jan 2020

US 2022/0158869 A1Pre-grant publication · published 19 May 2022

US 11,277,282 B2Parent of this continuation

US 2021/0226817 A1Published application

US 12,003,348 B2This patent

From the US filing history. Foreign family members aren’t listed.

Micro and macro segmentation in enterprise networks without a per segment layer-3 domain

Life of this patent

Micro and macro segmentation in enterprise networks without a per segment layer-3 domain

Life of this patent

Abstract

Claims20