# US 2016/0366019 A1 · Policy Verification in a Network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366019 A1 - Document ID: US20160366019A1 - Status: Published application - Kind: A1 - Application number: 14/736,523 - Filed: 2015-06-11 - Published: 2016-12-15 - Earliest claimed: 2015-06-11 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Ayaskant Pani; Ravi Raju; Jalajadevi Ganapathy; Aubin Sanyal; Krishna Doddapaneni; Sanjay Thyamagundalu; Igino C. Cafiero - Web page: https://patentgrep.com/patent/US20160366019A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/0894: Policy-based network configuration management - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A determination is made at a network connected device that a network policy is to be verified. The network policy is applied to network packets sent to an endpoint within a network, and the application of the policy to network traffic can result in at least two outcomes. Another determination is made at the network connected device that a switch is provisionable to host the endpoint. The network connected device provisions a simulated endpoint version of the endpoint at the switch to host the policy. At least one packet is sent to the simulated endpoint via the network connected device for each of the at least two outcomes of the policy. At least one response is received by the network connected device from the simulated endpoint indicating how the policy was applied to each of the packets. ## Claims ### Claim 1 A method comprising: determining, at a network connected device, a network policy to be verified, wherein the network policy is applied to network packets sent to an endpoint within a network, wherein application of the policy to network traffic can result in at least two outcomes; determining, at the network connected device, a switch that is provisionable to host the endpoint; provisioning, via the network connected device, a simulated endpoint version of the endpoint at the switch; sending, over the network via the network connected device, at least one packet for each of the at least two outcomes of the policy to the simulated endpoint; and receiving, via the network at the network connected device, at least one response from the simulated endpoint indicating how the policy was applied to each of the packets. ### Claim 2 (depends on 1) The method according to claim 1, wherein the network connected device comprises a network controller. ### Claim 3 (depends on 2) The method of claim 2, wherein the network controller comprises a fabric controller. ### Claim 4 (depends on 1) The method of claim 1, further comprising pre-reserving a plurality of switches for policy verification, and wherein determining the switch that is provisionable to host the endpoint comprises selecting at least one of the plurality of switches. ### Claim 5 (depends on 1) The method of claim 1, wherein sending the at least one packet for each of the at least two outcomes of the policy comprises a sending a traceroute packet for each of the at least two outcomes, and wherein receiving the at least one response comprises receiving at least one response for each of the traceroute packets. ### Claim 6 (depends on 1) The method of claim 1, wherein sending at least one packet for each of the at least two outcomes of the policy comprises configuring a five-tuple header of at least one packet to induce application of the policy to the packet. ### Claim 7 (depends on 1) The method of claim 1, wherein provisioning the simulated endpoint comprises hosting the simulated endpoint on a switch control plane of the switch. ### Claim 8 (depends on 7) The method of claim 7, wherein hosting the simulated endpoint on the switch control plane comprises hosting the simulated endpoint on a switch central processing unit. ### Claim 9 (depends on 1) The method of claim 1, wherein provisioning the simulated endpoint comprises hosting the simulated endpoint on an application specific integrated circuit of a front panel port of the switch. ### Claim 10 (depends on 1) The method of claim 1, wherein receiving the at least one message comprises receiving Access Control List logging messages. ### Claim 11 (depends on 1) The method of claim 1, wherein the network comprises a production environment network. ### Claim 12 (depends on 1) The method of claim 1, wherein the policy is applied to traffic sent to endpoints of an endpoint group. ### Claim 13 An apparatus comprising: a network interface configured to send network packets over a network; and a processor, wherein the processor is configured to: determine a network policy to be verified, wherein the network policy is applied to network packets sent to an endpoint within the network, wherein application of the policy to network traffic can result in at least two outcomes; determine a switch that is provisionable to host the endpoint; provision a simulated endpoint version of the endpoint at the switch; send, via the network interface, at least one packet for each of the at least two outcomes of the policy to the simulated endpoint; and receive, via network interface, at least one response from the simulated endpoint indicating how the policy was applied to each of the packets. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the processor is configured to send the at least one packet for each of the at least two outcomes of the policy by sending a traceroute packet for each of the at least two outcomes. ### Claim 15 (depends on 13) The apparatus of claim 13, wherein the processor is configured to send the at least one packet for each of the at least two outcomes of the policy by configuring a five-tuple header of at least one packet to induce application of the policy to the packet. ### Claim 16 (depends on 13) The apparatus of claim 13, wherein the processor is configured to provision the simulated endpoint by provisioning the switch to host the simulated endpoint on a switch control plane of the switch. ### Claim 17 A non-transitory computer readable storage media encoded with instructions, wherein the instructions, when executed by a processor, cause the processor to: determine a network policy to be verified, wherein the network policy is applied to network packets sent to an endpoint within a network, wherein application of the policy to network traffic can result in at least two outcomes; determine a switch that is provisionable to host the endpoint; provision a simulated endpoint version of the endpoint at the switch; send, via the network, at least one packet for each of the at least two outcomes of the policy to the simulated endpoint; and receive, via network, at least one response from the simulated endpoint indicating how the policy was applied to each of the packets. ### Claim 18 (depends on 17) The non-transitory computer readable storage media of claim 17, wherein the instructions cause the processor to send the at least one packet for each of the at least two outcomes of the policy by sending a traceroute packet for each of the at least two outcomes. ### Claim 19 (depends on 17) The non-transitory computer readable storage of claim 17, wherein the instructions cause the processor to send the at least one packet for each of the at least two outcomes of the policy by configuring a five-tuple header of at least one packet to induce application of the policy to the packet. ### Claim 20 (depends on 17) The non-transitory computer readable storage of claim 17, wherein the instructions cause the processor to provision the simulated endpoint by provisioning the switch to host the simulated endpoint on a switch control plane of the switch.