Discovering and grouping application endpoints in a network environment

Patent metadata

Field	Value
Publication number	US-2017353355-A1
Application number	US-201715686445-A
Country	US
Kind code	A1
Filing date	Aug 25, 2017
Priority date	Oct 16, 2014
Publication date	Dec 7, 2017
Grant date	—

Abstract

An example method for discovering and grouping application endpoints in a network environment is provided and includes discovering endpoints communicating in a network environment, calculating affinity between the discovered endpoints, and grouping the endpoints into separate endpoint groups (EPGs) according to the calculated affinity, each EPG comprising a logical grouping of similar endpoints for applying common forwarding and policy logic according to logical application boundaries. In specific embodiments, the affinity includes a weighted average of network affinity, compute affinity and user specified affinity.

First claim

What is claimed is:

1 . A method executed by a network element in network environment, comprising:
discovering endpoints communicating in a network environment; calculating affinity between the discovered endpoints; grouping the endpoints into separate endpoint groups (EPGs) according to the calculated affinity, each EPG comprising a logical grouping of similar endpoints for applying common forwarding and policy logic according to logical application boundaries, and generating, using the EPGs, application profiles to allow for stateless network policy definition and enforcement.

2 . The method of claim 1 ,
wherein,
the affinity comprises a weighted average of network affinity, compute affinity, and user specified affinity.

3 . The method of claim 2 ,
wherein,
the network affinity comprises a percentage of server peers and client peers and associated traffic attributes common between each pair of discovered endpoints.

4 . The method of claim 2 ,
wherein,
the compute affinity comprises a percentage of process and socket attributes common between each pair of discovered endpoints.

5 . The method of claim 2 ,
wherein,
the user specified affinity comprises a percentage of common user specified attributes between each pair of discovered endpoints.

6 . The method of claim 1 ,
wherein,
the application profiles include a collection of EPGs, connections among the EPGs, and the policies associated with the connections.

7 . The method of claim 1 ,
wherein,
grouping the endpoints includes:
creating a peer relationship matrix comprising the discovered endpoints;
sorting the endpoints in the peer relationship matrix according to a total number of connected peers;
selecting a specific endpoint as a seed;
sequentially comparing affinity of the seed with other endpoints in the peer relationship matrix; and
grouping the other endpoints having affinity greater than a predetermined threshold into a same EPG as the seed.

8 . The method of claim 7 ,
wherein,
grouping the endpoints further includes:
editing the peer relationship matrix to remove the grouped endpoints;
selecting another specific endpoint in the edited peer relationship matrix as a next seed; and
repeating the sequentially comparing affinity, grouping, and selecting the next seed until all endpoints in the peer relationship matrix are grouped into the separate EPGs.

9 . The method of claim 7 ,
wherein,
the endpoints in the peer relationship matrix are sorted in an order according to the total number of connected peers.

10 . The method of claim 1 ,
wherein,
the network element includes a collection engine, a grouping analysis module, and a reporting module,
the collection engine is configured to securely capture configuration information of the endpoints,
the grouping analysis module is configured to analyze communication patters among the endpoints and groups the endpoints, and
the reporting module is configured to arrange grouping results in a user presentable form.

11 . A non-transitory tangible media that includes instructions for execution, which when executed by a processor of a network element, is operable to perform operations comprising:
discovering endpoints communicating in a network environment; calculating affinity between the discovered endpoints; grouping the endpoints into separate endpoint groups (EPGs) according to the calculated affinity, each EPG comprising a logical grouping of similar endpoints for applying common forwarding and policy logic according to logical application boundaries; and generating, using the EPGs, application profiles to allow for stateless network policy definition and enforcement.

12 . The media of claim 11 ,
wherein,
the affinity comprises a weighted average of network affinity, compute affinity and user specified affinity.

13 . The media of claim 11 ,
wherein,
the application profiles comprise a collection of EPGs, connections among the EPGs, and the policies associated with the connections.

14 . The media of claim 11 ,
wherein,
grouping the endpoints includes:
creating a peer relationship matrix comprising the discovered endpoints;
sorting the endpoints in the peer relationship matrix according to a total number of connected peers;
selecting a specific endpoint as a seed;
sequentially comparing affinity of the seed with other endpoints in the peer relationship matrix; and
grouping the other endpoints having affinity greater than a predetermined threshold into a same EPG as the seed.

15 . The media of claim 14 ,
wherein,
grouping the endpoints further includes:
editing the peer relationship matrix to remove the grouped endpoints;
selecting another specific endpoint in the edited peer relationship matrix as a next seed; and
repeating the sequentially comparing affinity, grouping, and selecting the next seed until all endpoints in the peer relationship matrix are grouped into the separate EPGs.

16 . An apparatus, comprising:
a collection engine; a grouping analysis module; a reporting module; a memory element for storing data; and a network processor, wherein the network processor executes instructions associated with the data, wherein the network processor and the memory element cooperate, such that the apparatus is configured for:
discovering endpoints communicating in a network environment;
calculating affinity between the discovered endpoints;
grouping the endpoints into separate endpoint groups (EPGs) according to the calculated affinity, each EPG comprising a logical grouping of similar endpoints for applying common forwarding and policy logic according to logical application boundaries.

17 . The method of claim 16 ,
wherein,
the affinity comprises a weighted average of network affinity, compute affinity and user specified affinity.

18 . The apparatus of claim 16 ,
wherein,
the application profiles comprise a collection of EPGs, connections among the EPGs, and the policies associated with the connections.

19 . The apparatus of claim 16 ,
wherein,
grouping the endpoints includes:
creating a peer relationship matrix comprising the discovered endpoints;
sorting the endpoints in the peer relationship matrix according to a total number of connected peers;
selecting a specific endpoint as a seed;
sequentially comparing affinity of the seed with other endpoints in the peer relationship matrix; and
grouping the other endpoints having affinity greater than a predetermined threshold into a same EPG as the seed.

20 . The apparatus of claim 19 ,
wherein,
grouping the endpoints further includes:
editing the peer relationship matrix to remove the grouped endpoints;
selecting another specific endpoint in the edited peer relationship matrix as a next seed; and
repeating the sequentially comparing affinity, grouping, and selecting the next seed until all endpoints in the peer relationship matrix are grouped into the separate EPGs.

Assignees

• Cisco Tech Inc

Inventors

• Danait Sachin Waman
• Ponnuswamy Kannan
• Lesiak Paul John

Classifications

• H04L41/0853 Primary

  by actively collecting configuration information or by backing up configuration information · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/122

  of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] · CPC title