Back to results
US 12,657,049 B2Granted
System and method for network policy simulation
AssigneeCisco Technology, Inc.
InventorsSunil Kumar Gupta, Navindra Yadav, Michael Standish Watts, Ali Parandehgheibi, Shashidhar Gandham, Ashutosh Kulshreshtha, Khawar Deen
Life of this patent
Estimating the term…
Abstract
This disclosure generally relate to a method and system for network policy simulation in a distributed computing system. The present technology relates techniques that enable simulation of a new network policy with regard to its effects on the network data flow. By enabling a simulation data flow that is parallel and independent from the regular data flow, the present technology can provide optimized network security management with improved efficiency.
Claims20
A method comprising:
- determining, by one or more processors, first network flow data by enforcing one or more network policies of a network on network traffic traveling from a first endpoint group (EPG) of the network to a second endpoint group of the network, wherein the first EPG includes a first plurality of endpoints associated with a first EPG membership and wherein the second EPG includes a second plurality of endpoints associated with a second EPG membership;
- receiving, by the one or more processors through the network, a request to simulate enforcement of an EPG membership change associated with one or more of the first EPG and the second EPG;
- determining, by the one or more processors, second network flow data between the first EPG and an experimental set of endpoints included in the second EPG based on applying the EPG membership change and simulating enforcement of the one or more network policies with respect to the second network flow data while using the EPG membership change, wherein the experimental set of endpoints included in the second EPG represent a change from the second plurality of endpoints associated with the second EPG membership;
- and
- providing, by the one or more processors, an indication whether to enforce the EPG membership change based at least in part on the second network flow data.
2 more elements
A system comprising:
- one or more processors;
- and
- memory including instructions that, upon being executed by the one or more processors, cause the system to:
- determine first network flow data by enforcing one or more network policies of a network on network traffic traveling from a first endpoint group (EPG) of the network to a second endpoint group of the network, wherein the first EPG includes a first plurality of endpoints associated with a first EPG membership and wherein the second EPG includes a second plurality of endpoints associated with a second EPG membership;
- receive, through the network, a request to simulate enforcement of an EPG membership change associated with one or more of the first EPG and the second EPG;
- determine second network flow data between the first EPG and an experimental set of endpoints included in the second EPG based on applying the EPG membership change and simulating enforcement of the one or more network policies with respect to the second network flow data while using the EPG membership change, wherein the experimental set of endpoints included in the second EPG represent a change from the second plurality of endpoints associated with the second EPG membership;
- and
- provide an indication whether to enforce the EPG membership change based at least in part on the second network flow data.
5 more elements
At least one non-transitory computer-readable medium including instructions that, upon being executed by one or more processors, cause the one or more processors to:
- determine first network flow data by enforcing one or more network policies of a network on network traffic traveling from a first endpoint group (EPG) of the network to a second endpoint group of the network, wherein the first EPG includes a first plurality of endpoints associated with a first EPG membership and wherein the second EPG includes a second plurality of endpoints associated with a second EPG membership;
- receive, through the network, a request to simulate enforcement of an EPG membership change associated with one or more of the first EPG and the second EPG;
- determine second network flow data between the first EPG and an experimental set of endpoints included in the second EPG based on applying the EPG membership change and simulating enforcement of the one or more network policies with respect to the second network flow data while using the EPG membership change, wherein the experimental set of endpoints included in the second EPG represent a change from the second plurality of endpoints associated with the second EPG membership;
- and
- provide an indication whether to enforce the EPG membership change based at least in part on the second network flow data.
2 more elements
Dependencies are inferred from the claim text.