Granted Patent B2

US 12,657,049 · App. 18/949,393 · Granted Jun 16, 2026

Inventors: Sunil Kumar Gupta (Milpitas, CA); Navindra Yadav (Cupertino, CA); Michael Standish Watts (Mill Valley, CA); Ali Parandehgheibi (Sunnyvale, CA); Shashidhar Gandham (Fremont, CA); Ashutosh Kulshreshtha (Fremont, CA); Khawar Deen (Sunnyvale, CA)

Assignee: Cisco Technology, Inc.

G06F9/45558G06F3/0482G06F3/04842G06F3/04847G06F16/122G06F16/137G06F16/162G06F16/17G06F16/173G06F16/174G06F16/1744G06F16/1748G06F16/2322G06F16/235G06F16/2365G06F16/24578G06F16/248G06F16/285G06F16/288G06F16/29G06F16/9535G06F21/53G06F21/552G06F21/556G06F21/566G06N20/00G06N99/00G06T11/26H04J3/0661H04J3/14H04L1/242H04L7/10H04L9/0866H04L9/3239H04L9/3242H04L41/046H04L41/0668H04L41/0803H04L41/0806H04L41/0816H04L41/0893H04L41/0894H04L41/12H04L41/16H04L41/22H04L41/40H04L43/02H04L43/026H04L43/04H04L43/045H04L43/062H04L43/08H04L43/0805H04L43/0811H04L43/0829H04L43/0841H04L43/0858H04L43/0864H04L43/0876H04L43/0882H04L43/0888H04L43/10H04L43/106H04L43/12H04L43/16H04L43/20H04L45/306H04L45/38H04L45/46H04L45/507H04L45/66H04L45/74H04L47/11H04L47/20H04L47/2441H04L47/2483H04L47/28H04L47/31H04L47/32H04L61/5007H04L63/0227H04L63/0263H04L63/06H04L63/0876H04L63/1408H04L63/1416H04L63/1425H04L63/1433H04L63/1441H04L63/145H04L63/1458H04L63/1466H04L63/16H04L63/20H04L67/01H04L67/10H04L67/1001H04L67/12H04L67/51H04L67/75H04L69/16H04L69/22H04W72/54H04W84/18G06F2009/4557G06F2009/45587G06F2009/45591G06F2009/45595G06F2221/033G06F2221/2101G06F2221/2105G06F2221/2111G06F2221/2115G06F2221/2145H04L67/535

Abstract

Claims (50)

1 . A method comprising:

determining, by one or more processors, first network flow data by enforcing one or more network policies of a network on network traffic traveling from a first endpoint group (EPG) of the network to a second endpoint group of the network, wherein the first EPG includes a first plurality of endpoints associated with a first EPG membership and wherein the second EPG includes a second plurality of endpoints associated with a second EPG membership;

receiving, by the one or more processors through the network, a request to simulate enforcement of an EPG membership change associated with one or more of the first EPG and the second EPG;

determining, by the one or more processors, second network flow data between the first EPG and an experimental set of endpoints included in the second EPG based on applying the EPG membership change and simulating enforcement of the one or more network policies with respect to the second network flow data while using the EPG membership change, wherein the experimental set of endpoints included in the second EPG represent a change from the second plurality of endpoints associated with the second EPG membership; and

providing, by the one or more processors, an indication whether to enforce the EPG membership change based at least in part on the second network flow data.

2 . The method of claim 1 , wherein the indication is based at least in part on the first network flow data.

3 . The method of claim 1 , further comprising:

receiving aggregate network flow data from a plurality of sensors of the network, the plurality of sensors including at least a first sensor of a physical switch of the network, a second sensor of a hypervisor associated with the physical switch, a third sensor of a virtual machine associated with the hypervisor;

determining, based at least in part on the aggregate network flow data, a dependency map of an application executing in the network, the dependency map indicating a pattern of network traffic associated with the application;

determining, based at least in part on the dependency map, at least one network policy for the network; and

storing the at least one network policy in a policy table.

4 . The method of claim 3 , wherein the at least one network policy comprises a whitelist rule.

5 . The method of claim 3 , wherein the at least one network policy comprises a blacklist rule, and the method further comprises:

converting, based at least in part on the dependency map, the blacklist rule to a whitelist rule.

6 . The method of claim 3 , further comprising:

simulating removal of at least one network policy from the policy table; and determining third network flow data without the at least one network policy in effect.

7 . The method of claim 1 , wherein the EPG membership change comprises addition of at least one endpoint to the first endpoint group or the second endpoint group.

8 . The method of claim 1 , wherein the EPG membership change comprises removal of at least one endpoint from the first endpoint group or the second endpoint group.

9 . The method of claim 1 , further comprising:

simulating membership of at least one endpoint in the first endpoint group to the second endpoint group; and

determining third network flow data associated with the at least one endpoint.

10 . A system comprising:

one or more processors; and

memory including instructions that, upon being executed by the one or more processors, cause the system to:

determine first network flow data by enforcing one or more network policies of a network on network traffic traveling from a first endpoint group (EPG) of the network to a second endpoint group of the network, wherein the first EPG includes a first plurality of endpoints associated with a first EPG membership and wherein the second EPG includes a second plurality of endpoints associated with a second EPG membership;

receive, through the network, a request to simulate enforcement of an EPG membership change associated with one or more of the first EPG and the second EPG;

determine second network flow data between the first EPG and an experimental set of endpoints included in the second EPG based on applying the EPG membership change and simulating enforcement of the one or more network policies with respect to the second network flow data while using the EPG membership change, wherein the experimental set of endpoints included in the second EPG represent a change from the second plurality of endpoints associated with the second EPG membership; and

provide an indication whether to enforce the EPG membership change based at least in part on the second network flow data.

11 . The system of claim 10 , wherein the indication is based at least in part on the first network flow data.

12 . The system of claim 10 , wherein the instructions upon being executed further cause the system to:

receive aggregate network flow data from a plurality of sensors of the network, the plurality of sensors including at least a first sensor of a physical switch of the network, a second sensor of a hypervisor associated with the physical switch, a third sensor of a virtual machine associated with the hypervisor;

determine, based at least in part on the aggregate network flow data, a dependency map of an application executing in the network, the dependency map indicating a pattern of network traffic associated with the application;

determine, based at least in part on the dependency map, at least one network policy for the network; and

store the at least one network policy in a policy table.

13 . The system of claim 12 , wherein the at least one network policy comprises a whitelist rule.

14 . The system of claim 12 , wherein the at least one network policy comprises a blacklist rule, and wherein the instructions upon being executed further cause the system to:

convert, based at least in part on the dependency map, the blacklist rule to a whitelist rule.

15 . The system of claim 12 , wherein the instructions upon being executed further cause the system to:

simulating removal of at least one network policy from the policy table; and determining third network flow data without the at least one network policy in effect.

16 . The system of claim 10 , wherein the EPG membership change comprises addition of at least one endpoint to the first endpoint group or the second endpoint group.

17 . The system of claim 10 , wherein the EPG membership change comprises removal of at least one endpoint from the first endpoint group or the second endpoint group.

18 . The system of claim 10 , wherein the instructions upon being executed further cause the system to:

simulating membership of at least one endpoint in the first endpoint group to the second endpoint group; and

determining third network flow data associated with the at least one endpoint.

19 . At least one non-transitory computer-readable medium including instructions that, upon being executed by one or more processors, cause the one or more processors to:

determine first network flow data by enforcing one or more network policies of a network on network traffic traveling from a first endpoint group (EPG) of the network to a second endpoint group of the network, wherein the first EPG includes a first plurality of endpoints associated with a first EPG membership and wherein the second EPG includes a second plurality of endpoints associated with a second EPG membership;

receive, through the network, a request to simulate enforcement of an EPG membership change associated with one or more of the first EPG and the second EPG;

determine second network flow data between the first EPG and an experimental set of endpoints included in the second EPG based on applying the EPG membership change and simulating enforcement of the one or more network policies with respect to the second network flow data while using the EPG membership change, wherein the experimental set of endpoints included in the second EPG represent a change from the second plurality of endpoints associated with the second EPG membership; and

provide an indication whether to enforce the EPG membership change based at least in part on the second network flow data.

20 . The at least one non-transitory computer-readable medium of claim 19 , wherein the indication is based at least in part on the first network flow data.

Assignments (1)

Continuity (4)

References Cited (400)