Network agent for reporting to a network policy system

Patent metadata

Field	Value
Publication number	US-12368629-B2
Application number	US-202218054084-A
Country	US
Kind code	B2
Filing date	Nov 9, 2022
Priority date	Mar 27, 2017
Publication date	Jul 22, 2025
Grant date	Jul 22, 2025

Abstract

The disclosed technology relates to a network agent for reporting to a network policy system. A network agent includes an agent enforcer and an agent controller. The agent enforcer is configured to implementing network policies on the system, access data associated with the implementation of the network policies on the system, and transmit, via an interprocess communication, the data to the agent controller. The agent controller is configured to generate a report including the data and transmit the report to a network policy system.

First claim

The invention claimed is:

1. A method comprising:
at a network policy platform of a network policy system, translating a statement of user intent of a network policy system user with respect to one or more network rules into a network policy, wherein the statement of user intent of the network policy system user is a high-level expression;
communicating via a network the network policy to a first frontend network policy module in networked communication with a first network agent, the first frontend network policy module and the first network agent in a first location, and communicating via the network the network policy to a second frontend network policy module in networked communication with a second network agent, the second frontend network policy module and the second network agent in a second location;
receiving, at the first network agent, a first network policy configuration message sent by the first frontend network policy module;
receiving, at the second network agent, a second network policy configuration message sent by the second frontend network policy module;
implementing, by the first network agent, the network policy for a first data flow from a first network entity, wherein implementing the network policy by the first network agent includes configuring the first network agent to take an action consistent with the network policy; and
implementing, by the second network agent, the network policy for a second data flow from a second network entity, wherein implementing the network policy by the second network agent includes configuring the second network agent to take an action consistent with the network policy.

2. The method of claim 1 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to redirect the first data flow.

3. The method of claim 1 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to allow the first data flow.

4. The method of claim 1 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to drop the first data flow.

5. The method of claim 1 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to load balance the first data flow.

6. The method of claim 1 , wherein translating the statement of user intent associated with the network policy system user with respect to the one or more network rules into the network policy further comprises transforming the network policy into a platform-independent format.

7. The method of claim 1 , wherein one of the first or second network policy configuration messages includes one or more changes in network agent configuration needed to enforce the policy.

8. The method of claim 1 further comprising converting one of the first or second network policy configuration messages into a platform-specific policy.

9. A non-transitory computer-readable medium containing instructions, which when interpreted by one or more processors on one or more computing hosts in a networked distributed system, cause the system to:
at a network policy platform, translate a statement of user intent of a network policy system user with respect to one or more network rules into a network policy;
communicate via a network the network policy to a first frontend network policy module in networked communication with a first network agent, the first frontend network policy module and the first network agent in a first location, and communicating via the network the network policy to a second frontend network policy module in networked communication with a second network agent, the second frontend network policy module and the second network agent in a second location;
receive, at the first network agent, a first network policy configuration message sent by the first frontend network policy module;
receive, at the second network agent, a second network policy configuration message sent by the second frontend network policy module;
implement, by the first network agent, the network policy for a first data flow from a first network entity, wherein implementing the network policy by the first network agent includes configuring the first network agent to take an action consistent with the network policy; and
implement, by the second network agent, the network policy for a second data flow from a second network entity, wherein implementing the network policy by the second network agent includes configuring the second network agent to take an action consistent with the network policy.

10. The computer-readable medium of claim 9 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to redirect the first data flow. the first data flow.

11. The computer-readable medium of claim 9 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to allow the first data flow.

12. The computer-readable medium of claim 9 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to drop the first data flow.

13. The computer-readable medium of claim 9 , wherein implementing the network policy for the first data flow from the first network entity includes configuring the first network agent to load balance the first data flow.

14. The computer-readable medium of claim 9 , further comprising instructions, which when executed in association with translating the statement of user intent associated with the network policy system user with respect to the one or more network rules into the network policy, further cause the system to transform the network policy into a platform-independent format.

15. The computer-readable medium of claim 9 , wherein one of the first or second network policy configuration messages includes one or more changes in network agent configuration needed to enforce the policy.

16. The computer-readable medium of claim 9 , further comprising instructions, which when executed, cause the system to convert one of the first or second network policy configuration messages into a platform-specific policy.

17. A system comprising a plurality of hosts, each host including a processor and a memory, arranged into an intent driven network management system, the system comprising:
a network policy platform;
a plurality of frontend policy modules in networked communication with the network policy platform;
a plurality of network agents, wherein each agent is in networked communication with a frontend policy module of the plurality of frontend policy modules; and
a plurality of network entities, each network entity associated with a network agent of the plurality of network agents,
wherein the plurality of network entities send and receive data flows,

wherein the network policy platform is configured to translate a statement of user intent of an intent driven network management system user with respect to one or more network rules into a network policy,
wherein the network policy platform communicates via a network the network policy to a first frontend network policy module of the plurality of frontend policy modules in networked communication with a first network agent of the plurality of network agents, and communicates via a network the network policy

Assignees

• Cisco Tech Inc

Inventors

• Vu Hai
• Chang Shih-Chun
• Malhotra Varun
• Gandham Shashi
• Yadav Navindra
• Chen Allen
• Vallem Praneeth
• Prasad Rohit

Classifications

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L43/0817

  by checking functioning · CPC title

• H04L43/065

  related to network devices · CPC title