# US 12,603,841 B2 · Grouping endpoints of a network for NAT to organize IP address space for policy applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,841 B2 - Document ID: US12603841B2 - Status: Granted - Kind: B2 - Application number: 17/665,868 - Filed: 2022-02-07 - Published: 2023-08-10 - Granted: 2026-04-14 - Earliest claimed: 2022-02-07 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Victor Manuel Moreno; Shyamsundar N. Maniyar; Sanjay Kumar Hooda; Prakash C. Jain; Vinay Saini - Web page: https://patentgrep.com/patent/US12603841B2 ## CPC - H04L 45/745: Address table lookup; Address filtering - H04L 45/74: Address processing for routing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques and architecture are described that utilize network address translation (NAT) based on a group tag such that legacy and third-party devices may utilize and apply “subnet” based policies, thereby allowing the subnet based policies to be as effective as “group” based policies. In particular, a subnet may be applied to a group tag where the group tag is not understandable outside an access network such as, for example, a fabric network. Thus, when a packet originates from a fabric network utilizing group tags representing source groups of endpoints and is destined for a legacy or a third-party device-based network that does not utilize and/or understand group tags, then the group is converted into a subnet. Since that subnet is different from the source host within the fabric network, network address translation (NAT) is utilized. ## Claims ### Claim 1 A method comprising: receiving, at a first node of a first network, a first packet from a first host within the first network destined for a second host within a second network, wherein the first host is part of an endpoint group, and wherein the first packet includes an Internet protocol (IP) address for the first host; determining, by the first node, destination routing information for the first packet to a second node within the second network; based at least in part on the endpoint group, determining, by the first node from a table, an external source IP address associated with the endpoint group, wherein the external source IP address is one of a plurality of external source IP addresses assigned to the endpoint group for replacing IP addresses within the endpoint group, and wherein the plurality of external source IP addresses comprises a range of IP addresses assigned to the endpoint group based on the grouping of endpoints; replacing, by the first node, the IP address for the first host in the first packet with the external source IP address; and sending, by the first node, the first packet to the second node. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving, by the first node, a second packet from the second node, wherein the second packet includes the external source IP address; based at least in part on the external source IP address, determining, by the first node from the table, the IP address for the first host; replacing, by the first node, the external source IP address in the first packet with the IP address for the first host; and sending, by the first node, the second packet to the first host. ### Claim 3 (depends on 1) The method of claim 1, wherein the endpoint group is based at least in part on a security group tag. ### Claim 4 (depends on 1) The method of claim 1, wherein the endpoint group is based at least in part on one or more of a security group tag, user credentials, a device type, a flow identification (ID), or other non-security related attributes. ### Claim 5 (depends on 1) The method of claim 1, further comprising: registering, by the first node, the first host with a control plane of the first network; based at least in part on the endpoint group of the first host, assigning, by the control plane, the external source IP address to the first host; forwarding the external source IP address to the first node; and storing, by the first node, the external source IP address with the IP address for the first host. ### Claim 6 (depends on 1) The method of claim 1, wherein the plurality of external source IP addresses comprises a sequential range of source IP addresses. ### Claim 7 (depends on 6) The method of claim 6, wherein the external source IP address is selected based at least in part on a next available external source IP address within the sequential range of external source IP addresses. ### Claim 8 (depends on 6) The method of claim 6, wherein the external source IP address is selected randomly from available external source IP addresses within the sequential range of external source IP addresses. ### Claim 9 A system comprising: one or more processors; and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising: receiving, at a first node of a first network, a first packet from a first host within the first network destined for a second host within a second network, wherein the first host is part of an endpoint group, and wherein the first packet includes an Internet protocol (IP) address for the first host; determining, by the first node, destination routing information for the first packet to a second node within the second network; based at least in part on the endpoint group, determining, by the first node from a table, an external source IP address associated with the endpoint group, wherein the external source IP address is one of a plurality of external source IP addresses assigned to the endpoint group for replacing IP addresses of hosts within the endpoint group, and wherein the plurality of external source IP addresses comprises a range of IP addresses assigned to the endpoint group based on the grouping of endpoints; replacing, by the first node, the IP address for the first host in the first packet with the external source IP address; and sending, by the first node, the first packet to the second node. ### Claim 10 (depends on 9) The system of claim 9, wherein the actions further comprise: receiving, by the first node, a second packet from the second node, wherein the second packet includes the external source IP address; based at least in part on the external source IP address, determining, by the first node from the table, the IP address for the first host; replacing, by the first node, the external source IP address in the first packet with the IP address for the first host; and sending, by the first node, the second packet to the first host. ### Claim 11 (depends on 9) The system of claim 9, wherein the endpoint group is based at least in part on a security group tag. ### Claim 12 (depends on 9) The system of claim 9, wherein the endpoint group is based at least in part on one or more of a security group tag, user credentials, a device type, a flow identification (ID), or other non-security related attributes. ### Claim 13 (depends on 9) The system of claim 9, wherein the actions further comprise: registering, by the first node, the first host with a control plane of the first network; based at least in part on the endpoint group of the first host, assigning, by the control plane, the external source IP address to the first host; forwarding the external source IP address to the first node; and storing, by the first node, the external source IP address with the IP address for the first host. ### Claim 14 (depends on 9) The system of claim 9, wherein the plurality of external source IP addresses comprises a sequential range of external source IP addresses. ### Claim 15 (depends on 14) The system of claim 14, wherein the external source IP address is selected based at least in part on a next available external source IP address within the sequential range of external source IP addresses. ### Claim 16 (depends on 14) The system of claim 14, wherein the external source IP address is selected randomly from available external source IP addresses within the sequential range of external source IP addresses. ### Claim 17 A method comprising: receiving, at an edge of an access network, a first packet from a first host within the access network destined for a second host within a second network, wherein the first host is part of an endpoint group based at least in part on a security group tag (SGT), and wherein the first packet includes an Internet protocol (IP) address for the first host; determining, by the edge, destination routing information for the first packet to a node associated with a network; based at least in part on the SGT, determining, by the edge from a table, an external source IP address associated with the endpoint group, wherein the external source IP address is one of a plurality of external source IP addresses assigned to the endpoint group for replacing IP addresses of hosts within the endpoint group, and wherein the plurality of external source IP addresses comprises a range of IP addresses assigned to the endpoint group based on the grouping of endpoints; replacing, by the edge, the IP address for the first host in the first packet with the external source IP address; sending, by the edge, the first packet to the node; receiving, by the edge, a second packet from the node, wherein the second packet includes the external source IP address; based at least in part on the external source IP address, determining, by the edge from the table, the IP address for the first host; replacing, by the edge, the external source IP address in the first packet with the IP address for the first host; and sending, by the edge, the second packet to the first host. ### Claim 18 (depends on 17) The method of claim 17, further comprising: registering, by the edge, the first host with a control plane of the access network; based at least in part on the endpoint group of the first host, assigning, by the control plane, the external source IP address to the first host; forwarding the source IP address to the edge; and storing, by the edge, the external source IP address with the IP address for the first host. ### Claim 19 (depends on 18) The method of claim 18, wherein: the plurality of external source IP addresses comprises a sequential range of source IP addresses; and the external source IP address is selected based at least in part on a next available external source IP address within the sequential range of external source IP addresses. ### Claim 20 (depends on 18) The method of claim 18, wherein: the plurality of external source IP addresses comprises a sequential range of source IP addresses; and the external source IP address is selected randomly from available external source IP addresses within the sequential range of external source IP addresses.