# US 2021/0243116 A1 · Inband group-based network policy using srv6 > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243116 A1 - Document ID: US20210243116A1 - Status: Published application - Kind: A1 - Application number: 16/860,896 - Filed: 2020-04-28 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Clarence Filsfils; Ahmed Mohamed Ahmed Abdelsalam; Francois Clad; Pablo Camarillo Garvia; Kiran Sasidharan Pillai - Web page: https://patentgrep.com/patent/US20210243116A1 ## CPC - H04L 45/50: using label swapping, e.g. multi-protocol label switch [MPLS] - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 45/28: using route fault recovery - H04L 45/36: {Backward learning} - H04L 45/42: Centralised routing - H04L 45/566: {Routing instructions carried by the data packet, e.g. active networks} - H04L 45/74: Address processing for routing - H04L 45/741: Routing in networks with a plurality of addressing schemes, e.g. with both IPv4 and IPv6 - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present technology pertains to a group-based network policy using Segment Routing over an IPv6 dataplane (SRv6). After a source application sends a packet, an ingress node can receive the packet, and if the source node is capable, it can identify an application policy and apply it. The ingress node indicates that the policy has been applied by including policy bits in the packet encapsulation. When the packet is received by the egress node, it can determine whether the policy was already applied, and if so, the packet is forward to the destination application. If the egress node determines that the policy has not be applied the destination application can apply the policy. Both the ingress node and egress nodes can learn of source application groups, destination application groups, and applicable policies through communication with aspects of the segment routing fabric. ## Claims ### Claim 1 A non-transitory computer readable medium comprising instructions stored thereon, the instructions effective to cause at least one processor to: receive a first data packet from an application; identify a source application group for a source application of the first data packet; identify a destination application group for a destination application of the first data packet; apply a set of group-based network policies to the first data packet based on the source application group and the destination application group; and determine whether the first data packet can be forwarded to the destination application. ### Claim 2 (depends on 1) The non-transitory computer readable medium of claim 1, wherein group-based network policies are applied by an ingress node that is connected to the source application, or an egress node that is connected to the destination application. ### Claim 3 (depends on 1) The non-transitory computer readable medium of claim 1, wherein the identification of the source application group for the source application is performed by an ingress node, the non-transitory computer readable medium comprising further instructions effective to cause the at least one processor to: send a request, by the ingress node, for the source application group to which a source application belongs to a map table of a fabric connectivity platform, the map table identifying a plurality of applications as belonging to one of a plurality of application groups. ### Claim 4 (depends on 1) The non-transitory computer readable medium of claim 1, comprising instructions to cause the at least one processor to: set, by an ingress node, a value of policy-bits to indicate that the group-based network policies were applied by the ingress node; and determine, by the ingress node, whether the first data packet can be forwarded to the destination application. ### Claim 5 (depends on 1) The non-transitory computer readable medium of claim 1, comprising further instructions effective to cause the at least one processor to: add, by an ingress node, to the first data packet, a segment routing encapsulation that consists of an outer IPv6 header and an optional segment routing header; encode, by the ingress node, the source application group and policy-bits in a source address field of the outer IPv6 header, an arguments part of a segment routing identifier that identifies the egress node, or in a tag field of the segment routing header of the segment routing encapsulation; and forward, by the ingress node, the first data packet with the segment routing encapsulation that contains the source application group and the policy-bits to a segment routing fabric for routing to an egress node. ### Claim 6 (depends on 1) The non-transitory computer readable medium of claim 1, comprising further instructions effective to cause the at least one processor to: receive, by an egress node, a second data packet, from an ingress node, which includes the source application group and policy bits encoded in a segment routing encapsulation; retrieve, by the egress node, the source application group and the policy-bits from the segment routing encapsulation of the second data packet; remove, by the egress node, the segment routing encapsulation from the second data packet; determine, by the egress node, that the group-based network policies were already applied be the ingress node based on the policy-bits stored in the segment routing encapsulation; and responsive to the determination, forward the first data packet to the destination application. ### Claim 7 (depends on 1) The non-transitory computer readable medium of claim 1, comprising further instructions effective to cause the at least one processor to: send, by an egress node, a request for the destination application group to which a destination application belongs to a map table of a fabric connectivity platform; send, by the egress node, a policy request to a policy table at a fabric connectivity platform, wherein the policy request identifies the source application group and the destination application group; receive, from the policy table, a set of group-based network policies to be applied by the egress node based on the source application group and destination application group pair in the policy table; and determine whether the first data packet can be forwarded to the destination application. ### Claim 8 A fabric connectivity system comprising: at least one non-transitory computer readable medium storing instructions; and at least one processor, the at least one processor effective to execute the instructions to cause the system to: store a group table identifying a plurality of application groups; maintain a map table identifying a plurality of applications as belonging to a respective one of the plurality of application groups; and store a policy table defining a set of network policies to be applied source application group and destination application group pairs. ### Claim 9 (depends on 8) The fabric connectivity system of claim 8 comprising: receive, by the map table, from an ingress node a request for a group to which a source application belongs. ### Claim 10 (depends on 9) The fabric connectivity system of claim 9 comprising: receive, by the map table, from an ingress or egress node a request for a group to which a destination application belongs. ### Claim 11 (depends on 9) The fabric connectivity system of claim 9 comprising: receive, by the policy table, from an ingress or egress node, a policy request, wherein the policy request identifies a source application group and a destination application group; and return, by the policy table, a policy determination based on the source application group and destination application group pair. ### Claim 12 (depends on 10) The fabric connectivity system of claim 10, further comprising: returning, by the map table, the group to which the source application belongs to the ingress node. ### Claim 13 (depends on 11) The fabric connectivity system of claim 11, further comprising: returning, by the map table, the group to which the destination application belongs to the ingress or egress node. ### Claim 14 A method comprising: receiving a first data packet from an application; identifying a source application group for a source application of the first data packet; identifying a destination application group for a destination application of the first data packet; applying a set of group-based network policies to the first data packet based on the source application group and the destination application group; and determining whether the first data packet can be forwarded to the destination application. ### Claim 15 (depends on 14) The method of claim 14, wherein group-based network policies can be applied by an ingress node that is connected to the source application, or an egress node that is connected to the destination application. ### Claim 16 (depends on 14) The method of claim 14, comprising: setting, by an ingress node, a value of policy-bits to indicate that the group-based network policies were applied by the ingress node; and determining, by the ingress node, whether the first data packet can be forwarded to the destination application. ### Claim 18 (depends on 14) The method of claim 14, comprising: adding, by an ingress node, to the first data packet, a segment routing encapsulation that consists of an outer IPv6 header and an optional segment routing header; encoding, by the ingress node, the source application group and policy-bits in a source address field of the outer IPv6 header, an arguments part of a segment routing identifier that identifies the egress node, or in a tag field of the segment routing header of the segment routing encapsulation; and forwarding, by the ingress node, the first data packet with the segment routing encapsulation that contains the source application group and the policy-bits to a segment routing fabric for routing to an egress node. ### Claim 19 (depends on 14) The method of claim 14, further comprising: receiving, by an egress node, a second data packet, sent from an ingress node, which includes the source application group and policy bits encoded in an segment routing encapsulation; retrieving, by the egress node, the source application group and the policy-bits from the segment routing encapsulation of the second data packet; removing, by the egress node, the segment routing encapsulation from the second data packet; determining, by the egress node, that the group-based network policies were already applied be the ingress node based on the policy-bits stored in the segment routing encapsulation; and responsive to the determination, forwarding the first data packet to the destination application. ### Claim 20 (depends on 15) The method of claim 15, comprising: sending, by an egress node, a request for the destination application group to which a destination application belongs to a map table of a fabric connectivity platform; sending, by the egress node, a policy request to a policy table at a fabric connectivity platform, wherein the policy request identifies the source application group and the destination application group; receiving, from the policy table, a set of group-based network policies to be applied by the egress node based on the source application group and destination application group pair in the policy table; and determining whether the first data packet can be forwarded to the destination application.