# US 12,192,057 B2 · Software defined access fabric without subnet restriction to a virtual network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,057 B2 - Document ID: US12192057B2 - Status: Granted - Kind: B2 - Application number: 18/677,720 - Filed: 2024-05-29 - Published: 2024-09-19 - Granted: 2025-01-07 - Earliest claimed: 2019-01-11 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Sanjay Kumar Hooda; Muninder Singh Sambi; Victor Moreno; Prakash C. Jain; Tarunesh Ahuja; Satish Kondalam - Web page: https://patentgrep.com/patent/US12192057B2 ## CPC - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 61/5007: Internet protocol [IP] addresses - H04L 2101/668: Internet protocol [IP] address subnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises. ## Claims ### Claim 1 A method comprising: discovering that a plurality of endpoint hosts have joined an enterprise network, wherein the plurality of endpoint hosts comprise at least a first endpoint host and a second endpoint host; wherein each of the first endpoint host and the second endpoint host are assigned a corresponding address within the enterprise network, and the first and second endpoint hosts are endpoints in the enterprise network; after discovering the first endpoint host, assigning to the first endpoint host a first role from a plurality of roles within the enterprise network; after discovering the second endpoint host, assigning to the second endpoint host a second role from the plurality of roles; accessing a policy configuration defining allowable communications between endpoint hosts based on their respective roles, wherein the allowable communications are defined as being only between hosts having different roles within the enterprise network; generating instructions based on the policy; and providing the instructions to one or more switches causing the one or more switches to permit or deny communication of data packets between the first and second endpoint hosts based on the first role and the second role. ### Claim 2 (depends on 1) The method of claim 1, wherein each of the first endpoint host and the second endpoint host are assigned a corresponding address within a common subnet associated with the enterprise network and wherein the instructions cause the one or more switches to permit or deny communication of data packets using the common subnet between the first and second endpoint hosts based on the first role and the second role. ### Claim 3 (depends on 1) The method of claim 1, wherein the first role is a provider and the second role is a subscriber. ### Claim 4 (depends on 1) The method of claim 1, wherein the first endpoint host is associated with a headquarter site, and wherein the first endpoint host manages other hosts assigned the second role within the enterprise network. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving notification from the switch that the first endpoint host disconnected from the enterprise network; unregistering generated policies related to the first endpoint host that disconnected from the enterprise network; detecting that the first endpoint host rejoined the enterprise network at a subsequent time period; re-assigning the first endpoint host a new address within the enterprise network; and generating a new policy for the first endpoint host at the subsequent time period that the first endpoint host rejoined the enterprise network based on the new address, wherein the generated new policy includes re-assigning to the first endpoint host the first role associated with the enterprise network. ### Claim 6 (depends on 1) The method of claim 1, wherein the first endpoint host is connected to a first site of the enterprise network and the second endpoint host is connected to a second site of the enterprise network. ### Claim 7 (depends on 6) The method of claim 6, wherein the first role is determined based on the first site and the second role is determined based on the second site. ### Claim 8 A system comprising: a processor; and a computer-readable device storing instructions which, when executed by the processor, cause the processor to perform operations comprising: discovering that a plurality of endpoint hosts have joined an enterprise network, wherein the plurality of endpoint hosts comprise at least a first endpoint host and a second endpoint host; wherein each of the first endpoint host and the second endpoint host are assigned a corresponding address within the enterprise network, and the first and second endpoint hosts are endpoints in the enterprise network; after discovering the first endpoint host, assigning to the first endpoint host a first role from a plurality of roles within the enterprise network; after discovering the second endpoint host, assigning to the second endpoint host a second role from the plurality of roles; accessing a policy configuration defining allowable communications between endpoint hosts based on their respective roles, wherein the allowable communications are defined as being only between hosts having different roles within the enterprise network; generating instructions based on the policy; and providing the instructions to one or more switches causing the one or more switches to permit or deny communication of data packets between the first and second endpoint hosts based on the first role and the second role. ### Claim 9 (depends on 8) The system of claim 8, wherein each of the first endpoint host and the second endpoint host are assigned a corresponding address within a common subnet associated with the enterprise network and wherein the instructions cause the one or more switches to permit or deny communication of data packets using the common subnet between the first and second endpoint hosts based on the first role and the second role. ### Claim 10 (depends on 8) The system of claim 8, wherein the first role is a provider and the second role is a subscriber. ### Claim 11 (depends on 8) The system of claim 8, wherein the first endpoint host is associated with a headquarter site, and wherein the first endpoint host manages other hosts assigned the second role within the enterprise network. ### Claim 12 (depends on 8) The system of claim 8, the operations further comprising: receiving notification from the switch that the first endpoint host disconnected from the enterprise network; unregistering generated policies related to the first endpoint host that disconnected from the enterprise network; detecting that the first endpoint host rejoined the enterprise network at a subsequent time period; re-assigning the first endpoint host a new address within the enterprise network; and generating a new policy for the first endpoint host at the subsequent time period that the first endpoint host rejoined the enterprise network based on the new address, wherein the generated new policy includes re-assigning to the first endpoint host the first role associated with the enterprise network. ### Claim 13 (depends on 8) The system of claim 8, wherein the first endpoint host is connected to a first site of the enterprise network and the second endpoint host is connected to a second site of the enterprise network. ### Claim 14 (depends on 13) The system of claim 13, wherein the first role is determined based on the first site and the second role is determined based on the second site. ### Claim 15 A non-transitory computer-readable medium storing instructions which, when executed by a computer device, cause the computer device to perform operations comprising: discovering that a plurality of endpoint hosts have joined an enterprise network, wherein the plurality of endpoint hosts comprise at least a first endpoint host and a second endpoint host; wherein each of the first endpoint host and the second endpoint host are assigned a corresponding address within the enterprise network, and the first and second endpoint hosts are endpoints in the enterprise network; after discovering the first endpoint host, assigning to the first endpoint host a first role from a plurality of roles within the enterprise network; after discovering the second endpoint host, assigning to the second endpoint host a second role from the plurality of roles; accessing a policy configuration defining allowable communications between endpoint hosts based on their respective roles, wherein the allowable communications are defined as being only between hosts having different roles within the enterprise network; generating instructions based on the policy; and providing the instructions to one or more switches causing the one or more switches to permit or deny communication of data packets between the first and second endpoint hosts based on the first role and the second role. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein each of the first endpoint host and the second endpoint host are assigned a corresponding address within a common subnet associated with the enterprise network and wherein the instructions cause the one or more switches to permit or deny communication of data packets using the common subnet between the first and second endpoint hosts based on the first role and the second role. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the first role is a provider and the second role is a subscriber. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the first endpoint host and is associated with a headquarter site, and wherein the first endpoint host manages other hosts assigned the second role within the enterprise network. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, further comprising: receiving notification from the switch that the first endpoint host disconnected from the enterprise network; unregistering generated policies related to the first endpoint host that disconnected from the enterprise network; detecting that the first endpoint host rejoined the enterprise network at a subsequent time period; re-assigning the first endpoint host a new address within the enterprise network; and generating a new policy for the first endpoint host at the subsequent time period that the first endpoint host rejoined the enterprise network based on the new address, wherein the generated new policy includes re-assigning to the first endpoint host the first role or the second role associated with the enterprise network. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the first endpoint host is connected to a first site of the enterprise network and the second endpoint host is connected to a second site of the enterprise network. ### Claim 21 (depends on 20) The non-transitory computer-readable medium of claim 20, wherein the first role is determined based on the first site and the second role is determined based on the second site.