# US 2019/0319916 A1 · Support for optimized microsegmentation of end points using layer 2 isolation and proxy-arp within data center > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319916 A1 - Document ID: US20190319916A1 - Status: Published application - Kind: A1 - Application number: 16/454,493 - Filed: 2019-06-27 - Published: 2019-10-17 - Earliest claimed: 2017-04-28 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Gautam Venkataramanan; Umamaheswararao Karyampudi; Sundher Narayanaswamy - Web page: https://patentgrep.com/patent/US20190319916A1 ## CPC - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 61/5038: for local use, e.g. in LAN or USB networks, or in a controller area network [CAN] - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 61/59: using proxies for addressing - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/131: Protocols for games, networked simulations or virtual reality - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network device resolves a destination address of an endpoint in an endpoint isolation environment. The network device receives a request for a destination address associated with a destination endpoint. The request originates from an isolated source endpoint. The network device determines whether the destination address is stored on the network device in association with the destination endpoint. Responsive to a determination that the destination address is not stored in association with the destination endpoint, the network device generates a proxy request for the destination address, and sends the proxy request to at least one endpoint attached to the network device. The network device receives a proxy response from the destination endpoint that includes the destination address. The network device stores the destination address in association with the destination endpoint. ## Claims ### Claim 1 A method comprising: obtaining at a network device, a first request for a destination address associated with a destination endpoint, the first request originating from a source endpoint in an isolated endpoint group; generating a proxy request for the destination address, the proxy request associated with a network infrastructure address; providing the proxy request to at least one endpoint; obtaining a proxy response from the destination endpoint with the destination address; and storing the destination address in association with the destination endpoint. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining that the destination endpoint is in the isolated endpoint group; generating a second proxy response associating the network infrastructure address with the destination endpoint; and providing the second proxy response to the source endpoint. ### Claim 3 (depends on 2) The method of claim 2, wherein the destination endpoint is determined to be in the isolated endpoint group based on a destination endpoint tag associated with the destination endpoint. ### Claim 4 (depends on 1) The method of claim 1, wherein the source endpoint is determined to be in the isolated endpoint group based on a source endpoint tag associated with the source endpoint. ### Claim 5 (depends on 1) The method of claim 1, wherein the destination address is a destination Media Access Control (MAC) address associated with the destination endpoint ### Claim 6 (depends on 1) The method of claim 1, wherein the first request comprises a glean request that generates an address resolution protocol (ARP) request from the network device as the proxy request. ### Claim 7 (depends on 1) The method of claim 1, wherein the destination endpoint is associated with a destination endpoint tag comprising an indication of an isolated endpoint group, a non-isolated endpoint group, an isolated microsegment, or a non-isolated microsegment. ### Claim 8 An apparatus comprising: a network interface configured to communicate with a plurality of endpoints; a memory configured to store network addresses and endpoint tags associated with each of the plurality of endpoints; and a processor configured to: obtain via the network interface, a first request for a destination address associated with a destination endpoint, the first request originating from a source endpoint in an isolated endpoint group; generate a proxy request for the destination address, the proxy request associated with a network infrastructure address; provide via the network interface, the proxy request to at least one endpoint of the plurality of endpoints; obtain via the network interface, a proxy response from the destination endpoint with the destination address; and store the destination address in the memory in association with the destination endpoint. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein the processor is further configured to: determine that the destination endpoint is in the isolated endpoint group; generate a second proxy response associating the network infrastructure address with the destination endpoint; and provide via the network interface, the second proxy response to the source endpoint. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the processor is configured to determine that the destination endpoint is in the isolated endpoint group based on a destination endpoint tag associated with the destination endpoint. ### Claim 11 (depends on 8) The apparatus of claim 8, wherein the processor is configured to determine that the source endpoint is in the isolated endpoint group based on a source endpoint tag associated with the source endpoint. ### Claim 12 (depends on 8) The apparatus of claim 8, wherein the destination address is a destination Media Access Control (MAC) address associated with the destination endpoint ### Claim 13 (depends on 8) The apparatus of claim 8, wherein the first request comprises a glean request that causes the processor to generate an address resolution protocol (ARP) request from the apparatus as the proxy request. ### Claim 14 (depends on 8) The apparatus of claim 8, wherein the destination endpoint is associated with a destination endpoint tag comprising an indication of an isolated endpoint group, a non-isolated endpoint group, an isolated microsegment, or a non-isolated microsegment. ### Claim 15 One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and, when the software is executed by a processor on a network device, operable to cause the processor to: obtain a first request for a destination address associated with a destination endpoint, the first request originating from a source endpoint in an isolated endpoint group; generate a proxy request for the destination address, the proxy request associated with a network infrastructure address; provide the proxy request to at least one endpoint; obtain a proxy response from the destination endpoint with the destination address; and store the destination address in association with the destination endpoint. ### Claim 16 (depends on 15) The non-transitory computer readable storage media of claim 15, further comprising instructions operable to cause the processor to: determine that the destination endpoint is in the isolated endpoint group; generate a second proxy response associating the network infrastructure address with the destination endpoint; and provide the second proxy response to the source endpoint. ### Claim 17 (depends on 16) The non-transitory computer readable storage media of claim 16, further comprising instructions operable to cause the processor to determine that the destination endpoint is in the isolated endpoint group based on a destination endpoint tag associated with the destination endpoint. ### Claim 18 (depends on 15) The non-transitory computer readable storage media of claim 15, further comprising instructions operable to cause the processor to determine that the source endpoint is in the isolated endpoint group based on a source endpoint tag associated with the source endpoint. ### Claim 19 (depends on 15) The non-transitory computer readable storage media of claim 15, wherein the destination address is a destination Media Access Control (MAC) address associated with the destination endpoint ### Claim 20 (depends on 15) The non-transitory computer readable storage media of claim 15, wherein the first request comprises a glean request that causes the processor to generate an address resolution protocol (ARP) request from the network device as the proxy request.