US 12,603,841 B2Granted

Grouping endpoints of a network for NAT to organize IP address space for policy applications

AssigneeCisco Technology, Inc.

InventorsVictor Manuel Moreno, Shyamsundar N. Maniyar, Sanjay Kumar Hooda, Prakash C. Jain, Vinay Saini

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques and architecture are described that utilize network address translation (NAT) based on a group tag such that legacy and third-party devices may utilize and apply “subnet” based policies, thereby allowing the subnet based policies to be as effective as “group” based policies. In particular, a subnet may be applied to a group tag where the group tag is not understandable outside an access network such as, for example, a fabric network. Thus, when a packet originates from a fabric network utilizing group tags representing source groups of endpoints and is destined for a legacy or a third-party device-based network that does not utilize and/or understand group tags, then the group is converted into a subnet. Since that subnet is different from the source host within the fabric network, network address translation (NAT) is utilized.

Claims20

Dependent claims

A method comprising:

receiving, at a first node of a first network, a first packet from a first host within the first network destined for a second host within a second network, wherein the first host is part of an endpoint group, and wherein the first packet includes an Internet protocol (IP) address for the first host;
determining, by the first node, destination routing information for the first packet to a second node within the second network;
based at least in part on the endpoint group, determining, by the first node from a table, an external source IP address associated with the endpoint group, wherein the external source IP address is one of a plurality of external source IP addresses assigned to the endpoint group for replacing IP addresses within the endpoint group, and wherein the plurality of external source IP addresses comprises a range of IP addresses assigned to the endpoint group based on the grouping of endpoints;
replacing, by the first node, the IP address for the first host in the first packet with the external source IP address;
and
sending, by the first node, the first packet to the second node.

3 more elements

A system comprising:

one or more processors;
and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising:
receiving, at a first node of a first network, a first packet from a first host within the first network destined for a second host within a second network, wherein the first host is part of an endpoint group, and wherein the first packet includes an Internet protocol (IP) address for the first host;
determining, by the first node, destination routing information for the first packet to a second node within the second network;
based at least in part on the endpoint group, determining, by the first node from a table, an external source IP address associated with the endpoint group, wherein the external source IP address is one of a plurality of external source IP addresses assigned to the endpoint group for replacing IP addresses of hosts within the endpoint group, and wherein the plurality of external source IP addresses comprises a range of IP addresses assigned to the endpoint group based on the grouping of endpoints;
replacing, by the first node, the IP address for the first host in the first packet with the external source IP address;
and
sending, by the first node, the first packet to the second node.

6 more elements

A method comprising:

receiving, at an edge of an access network, a first packet from a first host within the access network destined for a second host within a second network, wherein the first host is part of an endpoint group based at least in part on a security group tag (SGT), and wherein the first packet includes an Internet protocol (IP) address for the first host;
determining, by the edge, destination routing information for the first packet to a node associated with a network;
based at least in part on the SGT, determining, by the edge from a table, an external source IP address associated with the endpoint group, wherein the external source IP address is one of a plurality of external source IP addresses assigned to the endpoint group for replacing IP addresses of hosts within the endpoint group, and wherein the plurality of external source IP addresses comprises a range of IP addresses assigned to the endpoint group based on the grouping of endpoints;
replacing, by the edge, the IP address for the first host in the first packet with the external source IP address;
sending, by the edge, the first packet to the node;
receiving, by the edge, a second packet from the node, wherein the second packet includes the external source IP address;
based at least in part on the external source IP address, determining, by the edge from the table, the IP address for the first host;
replacing, by the edge, the external source IP address in the first packet with the IP address for the first host;
and
sending, by the edge, the second packet to the first host.

7 more elements

Dependencies are inferred from the claim text.