Policy remapping upon network events
The techniques described herein relate to a method including: generating a first network policy and a second network policy at a forwarding device within a network, wherein the first network policy is applied to a first traffic classification and the second network policy is applied to a second traffic classification; obtaining first traffic from an endpoint device; classifying the first traffic with the first traffic classification; applying, at the forwarding device, the first network policy to the first traffic; obtaining, at the forwarding device, an indication of a network event within the network; obtaining second traffic from the endpoint device; classifying the second traffic with the second traffic classification in response to obtaining the indication of the network event; and applying, at the forwarding device, the second network policy to the second traffic.
1 . A method comprising:
generating a first network policy and a second network policy at a forwarding device within a network, wherein the first network policy is pre-programmed to a first traffic classification and the second network policy is pre-programmed to a second traffic classification, wherein the second network policy is a back-up policy of the first network policy;
obtaining first traffic from an endpoint device;
classifying the first traffic with the first traffic classification;
applying, at the forwarding device, the first network policy to the first traffic;
obtaining, at the forwarding device, an indication of a network event within the network;
obtaining second traffic from the endpoint device; and
remapping the second traffic within a predetermined time period by:
classifying the second traffic with the second traffic classification in response to obtaining the indication of the network event; and
applying, at the forwarding device, the second network policy to the second traffic in place of the first network policy in response to the indication of the network event, wherein the second network policy is pre-programmed at the forwarding device prior to the network event.
2 . The method of claim 1 , wherein the network event comprises an interface down event, a network congestion event, a latency change event, a jitter change event, a round trip time change event, an application overload event, a route withdrawal event, a nexthop down event, or a gateway down event.
3 . The method of claim 1 , wherein classifying the first traffic with the first traffic classification comprises classifying the first traffic with a first endpoint group classification, and
wherein classifying the second traffic with the second traffic classification comprises classifying the second traffic with a second endpoint group classification, which is a new endpoint group classification that was not associated with any traffic prior to classifying the second traffic.
4 . The method of claim 3 , wherein classifying the second traffic with the second endpoint group classification comprises:
performing a look-up in a table stored in hardware of the forwarding device based upon the first endpoint group classification and the indication of the network event; and
obtaining an indication of the second endpoint group classification in response to the look-up.
5 . The method of claim 3 , wherein the first endpoint group classification comprises a source classification.
6 . The method of claim 1 , wherein the forwarding device comprises a leaf switch of a fabric network.
7 . The method of claim 1 , wherein obtaining the indication of the network event comprises obtaining a Bidirectional Forwarding Detection protocol message.
8 . The method of claim 1 , wherein obtaining the indication of the network event comprises detecting the network event within the network.
9 . The method of claim 7 , further comprising providing a Bidirectional Forwarding Detection protocol message to another forwarding device within the network indicating the network event.
10 . The method of claim 1 , further comprising determining, from the indication of the network event, that a service level agreement for traffic from the endpoint device may not be met by application of the first network policy due to the network event.
11 . The method of claim 1 , wherein classifying the first traffic with the first traffic classification comprises classifying the first traffic with a first endpoint group classification,
wherein classifying the second traffic with the second traffic classification comprises classifying the second traffic with a second endpoint group classification that is applied to reclassify the second traffic from the first endpoint group classification to the second endpoint group classification in response to the network event, wherein a plurality of endpoint entities within the first endpoint group classification share the first network policy and the second network policy, which are at least one of: network access policies or security policies.
12 . The method of claim 1 , wherein the second traffic is remapped within the predetermined time period regardless of the network event.
13 . An apparatus comprising:
one or more network interfaces configured to send and receive network traffic; and
one or more processors configured to:
generate a first network policy and a second network policy, wherein the first network policy is pre-programmed to a first traffic classification and the second network policy is pre-programmed to a second traffic classification, wherein the second network policy is a back-up policy of the first network policy;
obtain, via the one or more network interfaces, first traffic from an endpoint device;
classify the first traffic with the first traffic classification;
apply the first network policy to the first traffic;
obtain an indication of a network event within a network;
obtain, via the one or more network interfaces, second traffic from the endpoint device; and
remap the second traffic within a predetermined time period by:
classifying the second traffic with the second traffic classification in response to obtaining the indication of the network event; and
applying the second network policy to the second traffic in place of the first network policy in response to the indication of the network event, wherein the one or more processors are configured to pre-program the second network policy prior to the network event.
14 . The apparatus of claim 13 , wherein the network event comprises an interface down event, a network congestion event, a latency change event, a jitter change event, a round trip time change event, an application overload event, a route withdrawal event, a nexthop down event, or a gateway down event.
15 . The apparatus of claim 13 , wherein the one or more processors are further configured to classify the first traffic with the first traffic classification by classifying the first traffic with a first endpoint group classification,
wherein the one or more processors are further configured to classify the second traffic with the second traffic classification by classifying the second traffic with a second endpoint group classification.
16 . The apparatus of claim 15 , wherein the one or more processors are further configured to classify the second traffic with the second endpoint group classification by:
performing a look-up in a table stored in the one or more processors based upon the first endpoint group classification and the indication of the network event; and
obtaining an indication of the second endpoint group classification in response to the look-up.
17 . The apparatus of claim 13 , wherein the one or more processors are further configured to obtain the indication of the network event by obtaining a Bidirectional Forwarding Detection protocol message.
18 . The apparatus of claim 13 , wherein the one or more processors are further configured to obtain the indication of the network event by detecting the network event within the network.
19 . One or more tangible, non-transitory computer readable mediums encoded with instructions, wherein the instructions, when executed by one or more processors, are operable to:
generate a first network policy and a second network policy at a forwarding device within a network, wherein the first network policy is pre-programmed to a first traffic classification and the second network policy is pre-programmed to a second traffic classification, wherein the second network policy is a back-up policy of the first network policy;
obtain first traffic from an endpoint device;
classify the first traffic with the first traffic classification;
apply, at the forwarding device, the first network policy to the first traffic;
obtain, at the forwarding device, an indication of a network event within the network;
obtain second traffic from the endpoint device; and
remap the second traffic within a predetermined time period by:
classifying the second traffic with the second traffic classification in response to obtaining the indication of the network event, and
applying, at the forwarding device, the second network policy to the second traffic in place of the first network policy in response to the indication of the network event, wherein the second network policy is pre-programmed at the forwarding device prior to the network event.
20 . The one or more tangible, non-transitory computer readable mediums of claim 19 , wherein the instructions operable to classify the first traffic with the first traffic classification comprise instruction operable to classify the first traffic with a first endpoint group classification,
wherein the instructions operable to classify the second traffic with the second traffic classification comprise instruction operable to classify the second traffic with a second endpoint group classification.