Granted Patent B1

US 12,598,215 · App. 18/342,261 · Granted Apr 7, 2026

Inventors: Amith Ramanagar Chandrashekar (San Jose, CA); Avinash Kumar Singh (Fremont, CA); Xiaodong Zhu (Fremont, CA)

Assignee: Juniper Networks, Inc.

H04L63/20H04L41/0895

Abstract

Claims (95)

1 . A method, comprising:

detecting, by a device, a first event associated with modifying a policy configuration, associated with a group of virtual network devices of a cloud computing environment, and to generate a modified policy configuration;

retrieving, by the device, the modified policy configuration based on the first event;

establishing, by the device, connections with the group of virtual network devices;

receiving, by the device, the policy configuration from the group of virtual network devices based on establishing the connections with the group of virtual network devices;

identifying, by the device, first policy statements not included in the modified policy configuration and included in the policy configuration;

identifying, by the device, second policy statements included in the modified policy configuration and not included in the policy configuration;

causing the first policy statements to be deleted from the group of virtual network devices; and

causing the second policy statements to be added to the group of virtual network devices, wherein deletion of the first policy statements and addition of the second policy statements causes the group of virtual network devices to be resynchronized with the modified policy configuration.

2 . The method of claim 1 ,

wherein retrieving the modified policy configuration based on the first event comprises:

retrieving the modified policy configuration from a secure object storage service of the device based on the first event.

3 . The method of claim 1 , further comprising:

preventing further modification of the modified policy configuration until the group of virtual network devices are resynchronized with the modified policy configuration.

4 . The method of claim 1 , further comprising:

enabling further modification of the modified policy configuration after the group of virtual network devices are resynchronized with the modified policy configuration.

5 . The method of claim 1 , further comprising:

preventing further modification of the modified policy configuration until the group of virtual network devices are resynchronized with the modified policy configuration; and

enabling further modification of the modified policy configuration after the group of virtual network devices are resynchronized with the modified policy configuration.

6 . The method of claim 1 ,

wherein the device includes a scaling service, a serverless function service, a queue service, and a secure object storage service.

7 . A device, comprising:

one or more memories; and

one or more processors to:

detect a first event associated with modifying a policy configuration, associated with a group of virtual network devices of a cloud computing environment, and to generate a modified policy configuration;

retrieve the modified policy configuration based on the first event;

establish connections with the group of virtual network devices;

receive the policy configuration from the group of virtual network devices based on establishing the connections with the group of virtual network devices;

identify first policy statements not included in the modified policy configuration and included in the policy configuration;

identify second policy statements included in the modified policy configuration and not included in the policy configuration;

cause the first policy statements to be deleted from the group of virtual network devices; and

cause the second policy statements to be added to the group of virtual network devices, wherein deletion of the first policy statements and addition of the second policy statements causes the group of virtual network devices to be resynchronized with the modified policy configuration.

8 . The device of claim 7 ,

wherein the one or more processors are further to:

detect a second event associated with adding a new virtual network device to the group of virtual network devices;

cause, based on the second event, the new virtual network device to be created in the cloud computing environment;

associate the new virtual network device with the group of virtual network devices;

retrieve the policy configuration associated with the group of virtual network devices;

establish a connection with the new virtual network device; and

provide the policy configuration to the new virtual network device based on establishing the connection with the new virtual network device and to cause the virtual network device to install the policy configuration.

9 . The device of claim 8 ,

wherein the one or more processors, to cause the new virtual network device to be created in the cloud computing environment, are to:

utilize a scaling service of the device to cause the new virtual network device to be created in the cloud computing environment.

10 . The device of claim 8 ,

wherein the one or more processors are further to:

provide, to a queue service of the device, a message indicating that the new virtual network device needs the policy configuration; and

receive a trigger to provide the policy configuration to the new virtual network device,

wherein the one or more processors, to retrieve the policy configuration associated with the group of virtual network devices, are configured to:

retrieve the policy configuration associated with the group of virtual network devices based on the trigger.

11 . The device of claim 8 ,

wherein the one or more processors, to retrieve the policy configuration associated with the group of virtual network devices, are to:

retrieve the policy configuration associated with the group of virtual network devices from a secure object storage service of the device.

12 . The device of claim 8 ,

wherein the one or more processors, to detect the second event associated with adding the new virtual network device to the group of virtual network devices, are to:

detect the second event associated with adding the new virtual network device based on a health check failure associated with the group of virtual network devices.

13 . The device of claim 7 ,

wherein the one or more processors are further to:

detect a second event associated with removing a virtual network device from the group of virtual network devices of the cloud computing environment; and

cause, based on the second event, the virtual network device to be removed from the group of virtual network devices.

14 . A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

detect a first event associated with modifying a policy configuration, associated with a group of virtual network devices of a cloud computing environment, and to generate a modified policy configuration;

retrieve the modified policy configuration based on the first event;

establish connections with the group of virtual network devices;

receive the policy configuration from the group of virtual network devices based on establishing the connections with the group of virtual network devices;

identify first policy statements not included in the modified policy configuration and included in the policy configuration;

identify second policy statements included in the modified policy configuration and not included in the policy configuration;

cause the first policy statements to be deleted from the group of virtual network devices; and

cause the second policy statements to be added to the group of virtual network devices,

wherein deletion of the first policy statements and addition of the second policy statements causes the group of virtual network devices to be resynchronized with the modified policy configuration.

15 . The non-transitory computer-readable medium of claim 14 ,

wherein the one or more instructions, that cause the device to retrieve the modified policy configuration based on the first event, cause the device to:

retrieve the modified policy configuration from a secure object storage service of the device based on the first event.

16 . The non-transitory computer-readable medium of claim 14 ,

wherein the one or more instructions further cause the device to:

prevent further modification of the modified policy configuration until the group of virtual network devices are resynchronized with the modified policy configuration.

17 . The non-transitory computer-readable medium of claim 14 ,

wherein the one or more instructions further cause the device to:

enable further modification of the modified policy configuration after the group of virtual network devices are resynchronized with the modified policy configuration.

18 . The non-transitory computer-readable medium of claim 14 ,

wherein the one or more instructions further cause the device to:

prevent further modification of the modified policy configuration until the group of virtual network devices are resynchronized with the modified policy configuration; and

enable further modification of the modified policy configuration after the group of virtual network devices are resynchronized with the modified policy configuration.

19 . The non-transitory computer-readable medium of claim 14 ,

wherein the one or more instructions further cause the device to:

detect a second event associated with adding a new virtual network device to the group of virtual network devices;

cause, based on the second event, the new virtual network device to be created in the cloud computing environment;

associate the new virtual network device with the group of virtual network devices;

retrieve the policy configuration associated with the group of virtual network devices;

establish a connection with the new virtual network device; and

provide the policy configuration to the new virtual network device based on establishing the connection with the new virtual network device and to cause the virtual network device to install the policy configuration.

20 . The non-transitory computer-readable medium of claim 14 ,

wherein the one or more instructions further cause the device to:

detect a second event associated with removing a virtual network device from the group of virtual network devices of the cloud computing environment; and

cause, based on the second event, the virtual network device to be removed from the group of virtual network devices.

Assignments (1)

References Cited (8)