INTEGRATING SECURITY SERVER POLICIES WITH OPTIMIZED ROUTING CONTROL

• US 20100054241A1
• Filed: 08/27/2008
• Published: 03/04/2010
• Est. Priority Date: 08/27/2008
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Patel, Rahul G., Shah, Pritam, Lynn, Kerry E.
• Granted Patent: US 8,023,504 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/30 Routing of multiclass traffic
• CPC Class Codes: H04L 45/42 Centralised routing
• CPC Class Codes: H04L 45/70 Routing based on monitoring results

Abstract

In one embodiment, a first set of one or more control policies at a control server of a network domain may be transmitted to a routing master controller of the network domain, which uses a second set of one or more traffic policies to determine optimal paths for directing traffic through the domain. The routing master controller may then generate a third set of one or more integrated policies based on the first and second sets of policies, e.g., based on the knowledge and policies of both the control server and the routing master controller.

Claims

1. A method, comprising:

determining a first set of one or more control policies at a control server of a network domain;

transmitting the first set of policies from the control server to a routing master controller of the network domain, the routing master controller having a second set of one or more traffic policies used to determine optimal paths for directing traffic through the domain; and

generating a third set of one or more integrated policies at the routing master controller based on the first and second sets of policies.

2. The method of claim 1, further comprising:

classifying one or more traffic classes at the routing master controller; and

associating at least one optimal path with each of the one or more traffic classes at the routing master controller based on the third set of policies.

3. The method of claim 2, further comprising:

notifying one or more routers in the network domain of the at least one optimal path associated with each of the one or more traffic classes.

4. The method of claim 3, further comprising:

receiving traffic at one of the routers;

determining the traffic class of the traffic at the router; and

routing the traffic at the router based on the traffic class and the associated optimal path received from the routing master controller.

5. The method of claim 4, further comprising:

defining markings at the control server for traffic classes based on the first set of policies;

transmitting the defined markings to one or more control agents; and

marking traffic at the one or more control agents of the network domain based on the defined markings, wherein determining the traffic class at the router further comprises identifying the markings of the traffic.

6. The method of claim 2, further comprising:

defining the traffic classes at the control server; and

informing the routing master controller of the traffic classes for classification by the routing master controller.

7. The method of claim 2, wherein the at least one optimal path conforms to the third set of integrated policies.

8. The method of claim 2, wherein the optimal path is to a particular egress of the network domain.

9. The method of claim 1, wherein generating the third set of integrated policies further comprises:

combining the first and second sets of policies.

10. The method of claim 1, further comprising:

selecting the policy of the first set of control policies for use in generating the third set of integrated policies;

determining if one policy of the first set of control policies conflicts with one of the second set of traffic policies; and

in response, selecting the policy of the first set of control policies.

11. The method of claim 1, further comprising:

mapping one or more application streams to respective traffic classes at the routing master controller.

12. The method of claim 11, further comprising:

transmitting information of one or more of the application streams from the control server to the routing master controller.

13. The method of claim 12, wherein the information identifies the one or more application streams.

14. The method of claim 11, further comprising:

learning about one or more of the application streams at the routing master controller.

15. The method of claim 1, further comprising:

detecting a security event based on the third set of integrated policies; and

in response,

performing a security action associated with the security event based on the third set of integrated policies.

16. The method of claim 1, further comprising:

associating one or more policies based on hosts of traffic with the first set of control policies, wherein the generated third set of integrated policies comprise the one or more policies based on the hosts of traffic.

17. A system, comprising:

a control server of a network domain configured to determine a first set of one or more control policies; and

a routing master controller of the network domain configured to receive the first set of control policies from the control server, the routing master controller having a second set of one or more traffic policies used to determine optimal paths for directing traffic through the domain;

the routing master controller configured to generate a third set of one or more integrated policies based on the first and second sets of policies.

18. The system of claim 17, wherein the routing master controller is further configured to i) classify one or more traffic classes;

ii) associate at least one optimal path with each of the one or more traffic classes based on the third set of policies; and

iii) notify one or more routers in the network domain of the at least one optimal path associated with each of the one or more traffic classes; and

wherein the one or more routers are configured to i) receive traffic;

ii) determine the traffic class of the traffic; and

iii) route the traffic based on the traffic class and the associated optimal path.

19. An apparatus, comprising:

one or more network interfaces adapted to communicate with a control server and one or more routers of a network domain;

a processor coupled to the network interfaces and adapted to execute one or more processes; and

a memory adapted to store a routing master controller process executable by the processor, the routing master controller process when executed operable to;

i) receive a first set of one or more control policies from the control server;

ii) use a second set of one or more traffic policies to determine optimal paths for directing traffic through the domain; and

iii) generate a third set of one or more integrated policies based on the first and second sets of policies.

20. The apparatus as in claim 19, wherein the routing master controller process is further operable to:

i) classify one or more traffic classes;

ii) associate at least one optimal path with each of the one or more traffic classes based on the third set of policies;

iii) notify one or more routers in the network domain of the at least one optimal path associated with each of the one or more traffic classes, wherein the one or more routers configured to receive traffic;

v) the one or more routers are further configured to route traffic based on a traffic class and an associated optimal path.