Patent Description:
A computer network is a collection of interconnected computing devices that exchange data and share resources. In certain types of computer networks, such as enterprise networks, data center networks, and service provider access networks, administrators need to configure and manage large numbers of endpoint users or customers attempting to send and receive data through the network.

As one example, a network connects a plurality of remote branch sites that belong to a single enterprise, such as a university, corporation, business, or other large entity. Each of the branch sites may include a private network, such a local area network (LAN) or wide area network (WAN) that includes a plurality of customer devices, such as desktop computers, laptops, workstations, personal digital assistants (PDAs), Internet of Things (IOT) devices, wireless devices, network-ready appliances, file servers, print servers or other devices.

A network may include a branch site switch that manages connectivity between hosts or endpoints within the network. The branch site switch may include a plurality of network devices, e.g., routers and/or switches, that provide hosts with access to the network, and to provide hosts with connectivity for host-to-host traffic within and between the branch sites.

Following "Junos Fusion Provider Edge Overview", Junos Fusion provides a method of significantly expanding the number of available network interfaces on a device by allowing the aggregation device to add interfaces through interconnections with satellites devices.

Like reference characters denote like elements throughout the description and figures.

<FIG> is a block diagram illustrating an example system <NUM> which uses a service provider network <NUM> to connect a central site <NUM> and branch sites 18A-18N (collectively, "branch sites <NUM>"), in accordance with one or more techniques of this disclosure. As illustrated in <FIG>, central site <NUM> includes an orchestrator <NUM> which may be responsible for managing at least some aspects of system <NUM>. Although orchestrator <NUM> is illustrated as being located in central site <NUM>, in some examples, orchestrator <NUM> may be located in any of branch sites <NUM>. In examples where orchestrator <NUM> is located in one of branch sites <NUM>, the respective branch site that includes orchestrator <NUM> may be referred to as a "central site. " Additionally, as illustrated in <FIG>, branch site 18A includes branch site switch <NUM> which manages connectivity between hosts or endpoints within system <NUM>, including local hosts 24A-24N (collectively "hosts <NUM>") within branch site 18A as well as hosts included in branch sites 18B-18N. Collectively, central site <NUM> and branch sites <NUM> may be referred to herein as sites <NUM>, <NUM>. In some examples, branch sites <NUM> may be referred to as "branch networks.

Central site <NUM>, in some cases, may be a "central office" which acts as an administrator of system <NUM> which includes central site <NUM> and branch sites <NUM>. In some examples, system <NUM> represents a wide area network (WAN). In some examples, central site <NUM> includes orchestrator <NUM> which is configured to manage a connection between sites <NUM>, <NUM>. For example, orchestrator <NUM> may provision an Internet Protocol (IP) address corresponding to each of sites <NUM>, <NUM>. If an additional branch site <NUM> is added to system <NUM>, orchestrator <NUM> may provision an IP address corresponding to the additional branch site <NUM> and update a topology of system <NUM> to include the additional branch site <NUM>. Additionally, in some cases, orchestrator <NUM> may configure the additional branch site <NUM> such that the additional branch site <NUM> can exchange information with other sites <NUM>, <NUM> of system <NUM>.

Branch site 18A, for example, may include branch site switch <NUM> which is coupled to hosts <NUM>. In some cases, branch site 18A represents a local area network (LAN) or a WAN within the WAN given by system <NUM>. Additionally, in some cases, each branch site of branch sites <NUM> represents a separate LAN within the WAN given by system <NUM>. Branch site switch <NUM> may facilitate access of hosts <NUM> to other branch sites of system <NUM>. For example, branch site switch <NUM> may connect a host (e.g., host 24A) to other hosts (e.g., hosts 24B-24N) within branch site <NUM>. Additionally, branch site switch <NUM> may connect host 24A with other hosts (not shown) coupled to other sites <NUM>, <NUM>, via service provider network <NUM>.

Orchestrator <NUM>, in some examples, may manage each of branch sites <NUM> as a single logical switch. In other words, a branch site (e.g., branch site 18A) may communicate with orchestrator <NUM> via one management interface. For example, branch site switch <NUM> of branch site 18A may include an aggregation device and a set of satellite devices (not shown), where the set of satellite devices are coupled to hosts <NUM>. The aggregation device of branch site switch <NUM> may manage the set of satellite devices, obviating a need for orchestrator <NUM> to manage the set of satellite devices. In other words, orchestrator <NUM> registers each branch site switch located in branch sites <NUM> as a single logical switch. For example, orchestrator <NUM> may exchange configuration information with branch site switch <NUM> via a management interface of the aggregation device of branch site switch <NUM>. In some examples, the aggregation device represents a universal customer premises equipment (uCPE) device where Virtual Network Functions (VNFs) are deployed as software applications for various functions (e.g., a firewall function or a router function) on standard x86 servers.

In some examples, an administrator logs in to orchestrator <NUM>, enabling the administrator to access information associated with each of branch sites <NUM>. Orchestrator <NUM> may display information associated with branch sites <NUM> on a user interface that is configured to accept user input. Additionally, in some cases, orchestrator <NUM> may receive user input representing an instruction to be sent to a branch site (e.g., branch site 18A). Subsequently, orchestrator <NUM> may send the instruction to branch site 18A.

In some examples, the set of satellite devices are not registered with orchestrator <NUM>. For example, orchestrator <NUM> might not provision an IP address corresponding to each satellite device of the set of satellite devices, and orchestrator <NUM> might not create any other type of record corresponding to the satellite devices. In this way, a number of satellite devices located within branch site switch <NUM> might not be recorded by orchestrator <NUM>. In some examples, orchestrator <NUM> provisions a single IP address corresponding to each respective branch site switch of branch sites <NUM>, and orchestrator <NUM> does not provision IP addresses corresponding to satellite devices of branch sites <NUM>. If a satellite device is added or removed from branch site switch <NUM>, for example, the aggregation device may track the respective addition or subtraction - without providing orchestrator <NUM> with information indicating the addition/subtraction. By isolating orchestrator <NUM> from the management of the satellite devices of branch site switch <NUM>, and by isolating orchestrator <NUM> from the management of other branch site switches of branch sites <NUM>, system <NUM> may decrease a likelihood that orchestrator <NUM> will become overburdened and go offline.

Sites <NUM>, <NUM> may be geographically separated sites that belong to a single enterprise, such as a university, corporation, business, or other large entity. In some examples, each of branch sites <NUM> may have a number of users (e.g., employees, students, or customers) within a range between <NUM> and <NUM>. Each of the sites <NUM>, <NUM> may include a private network, such as a LAN or a WAN that includes a plurality of hosts, e.g., hosts <NUM> within branch site 18A. As an example, hosts <NUM> may include data servers, switches, or customer devices, such as desktop computers, laptop computers, workstations, smartphones, smart televisions, tablet devices, personal digital assistants (PDAs), Internet of Things (IOT) devices, wireless devices, network-ready appliances, file servers, printers, print servers, Voice over Internet Protocol (VoIP) phones, wireless access points, IP cameras, card readers or other devices.

One or more hosts (not shown) within sites <NUM>, <NUM> may be logically connected to one or more of hosts <NUM> within branch site 18A across service provider network <NUM>. The hosts within each of the sites <NUM>, <NUM> may each be included in one or more virtual LANs (VLANs), which are groups of devices on one or more LANs that are configured to communicate as if they are attached to the same wire. Branch site switch <NUM> may be configured to provide hosts <NUM> with access to service provider network <NUM> via router <NUM>, and to provide hosts <NUM> with connectivity for host-to-host traffic within branch site 18A. Service provider network <NUM>, in turn, provides hosts within central site <NUM> and branch sites 18B-18N with access to branch site switch <NUM> within branch site 18A.

Service provider network <NUM> may be coupled to one or more networks (not shown) administered by other providers, and may thus form part of a large-scale public network infrastructure, e.g., the Internet. Service provider network <NUM>, therefore, may provide hosts or endpoints within sites <NUM>, <NUM> with access to the Internet. Router <NUM> may perform Layer <NUM> routing to route network traffic between branch site switch <NUM>, central site <NUM>, and branch sites 18B-18N using service provider network <NUM>. Service provider network <NUM> may include a variety of network devices other than router <NUM>, such as other provider edge (PE) routers, core routers, customer edge (CE) routers, and switches.

Although additional network devices are not shown for ease of explanation, system <NUM> may include additional networks, branch sites, and/or data centers including, for example, one or more additional switches, routers, hubs, gateways, security devices such as firewalls, intrusion detection, and/or intrusion prevention devices, servers, computer terminals, laptops, printers, databases, wireless mobile devices such as cellular phones or personal digital assistants, wireless access points, bridges, cable modems, application accelerators, or other network devices. Moreover, although the elements of system <NUM> are illustrated as being directly coupled, one or more additional network elements may be included along any links between service provider network <NUM> and sites <NUM>, <NUM>, and any links between branch site switch <NUM> and hosts <NUM>, such that the network elements of system <NUM> are not directly coupled.

Although illustrated as a single switch in <FIG>, branch site switch <NUM> may include a plurality of network devices, e.g., routers and/or switches. For example, as described above, branch site switch <NUM> may include a set of access or satellite devices interconnected via one or more aggregation devices. In some examples, the architecture of branch site switch <NUM> includes a multi-tiered architecture in which two tiers of access or satellite devices and aggregation devices are interconnected to forward data packets between hosts <NUM> within branch site 18A and from hosts <NUM> to other hosts within central site <NUM> and branch sites 18B-18N via service provider network <NUM>. The interconnection between the aggregation device and satellite devices appear in system <NUM> as a single, port-dense device that is managed using a single IP address.

As described in more detail below with respect to <FIG>, the aggregation device included in branch site switch <NUM> is connected to one or more access or satellite devices, and acts as a single point of management for the satellite devices. For example, the aggregation device centrally manages interface configuration for each satellite device interface. The aggregation device may add interfaces through interconnections with the satellite devices to expand the number of available network interfaces. For example, the aggregation device includes cascade ports for sending and receiving control and network traffic from satellite devices. The satellite devices each includes one or more host-facing ports, also referred to as extended ports, that transmit and receive network traffic from hosts <NUM>, and are associated with the cascade ports of the aggregation device. Since the aggregation device manages the interfaces between the satellite devices and the aggregation device is within branch site switch <NUM>, orchestrator <NUM> might not need to individually log in to each respective satellite device in order to configure ports of the satellite devices. Rather, from the perspective of orchestrator <NUM>, the satellite devices may appear as line cards on branch site switch <NUM>. In other words, branch site switch <NUM> may be viewed by a user of orchestrator <NUM> (e.g., an end user) as a chassis switch with multiple line cards, enabling the user to configure interfaces of branch site switch <NUM> (e.g., interfaces of the apparent line cards that are actually satellite devices) as though branch site switch <NUM> is indeed a chassis switch with multiple line cards. In some examples, rather than line cards, the satellite devices appear to orchestrator <NUM> as subsystems. In this manner, the aggregation device (e.g., a uCPE device) provides orchestrator <NUM> with a central point of management for managing the LAN of branch site 18A, simplifying the management process and allowing more scalability.

In general, the techniques of this disclosure are described with respect to a branch site switch in a network used to provide access between hosts within the network. In other examples, the techniques of the disclosure may be similarly performed within a data center switch included in a data center network used to provide hosts with access to web sites, data, and services housed in a data center.

In some examples, the aggregation device allocates one or more resources (e.g., Quality of Service (QoS) queues, firewalls, etc.) for each of the extended ports of the satellite devices on the cascade ports of the aggregation device. While the resources are provisioned on the cascade ports of the aggregation device, the extended ports of the satellite devices may utilize the resources (i.e., perform the classification, queueing, and scheduling) on the traffic.

<FIG> is a block diagram illustrating an example of branch site switch <NUM> including aggregation device <NUM>, in accordance with one or more techniques of this disclosure. The architecture illustrated in <FIG> is merely an example and, in other examples, branch site switch <NUM> may conform to a different architecture.

Satellite devices 32A-32N (collectively, "satellite devices <NUM>") form the access layer of branch site switch <NUM> and provides hosts with access to the internal switch fabric of branch site switch <NUM>. In the example of <FIG>, satellite device 32A may provide hosts 52A-52N (collectively, "hosts <NUM>") with access to the internal switch fabric of branch site switch <NUM>, and satellite device 32N may provide hosts 54A-54N (collectively, "hosts <NUM>") with access to the internal switch fabric of branch site switch <NUM>. In other examples, more or fewer hosts may be connected, either multi-homed or singularly homed, to one or more of satellite devices <NUM>. Hosts <NUM> and hosts <NUM> (collectively, "hosts <NUM>, <NUM>") may, in some examples, be examples of hosts <NUM> of <FIG>. Satellite devices <NUM> may each provide layer <NUM>, medium access control (MAC) address switching and/or layer <NUM>, IP address switching between the hosts.

The host-facing ports of each of satellite devices <NUM> are referred to herein as extended ports. For example, satellite device 32A may include extended ports 34A-34N (collectively, "extended ports <NUM>") and satellite device 32N may include extended ports 36A-36N (collectively, "extended ports <NUM>"). Extended ports <NUM> and <NUM> (collectively, "extended ports <NUM>, <NUM>") may be capable of transmitting and receiving traffic from hosts <NUM> and <NUM>, respectively. Extended ports <NUM>, <NUM> may, in some cases, represent Power over Ethernet (PoE) ports for physically connecting hosts <NUM>, <NUM> to satellite devices <NUM>. As such, satellite devices <NUM> may represent hardware-based Ethernet switches for connecting hosts <NUM>, <NUM> to aggregation device <NUM> and service provider network <NUM>.

In some examples, it may be beneficial to include Ethernet switches in satellite devices <NUM> and include a forwarding unit such as a packet forwarding engine (PFE) in aggregation device <NUM> in order to provide PoE to hosts <NUM>, <NUM> or connect multi-rate ports. In some examples, up to <NUM>% of bandwidth available to branch site 18A is used by branch site switch <NUM> and hosts <NUM>, <NUM>. Additionally, security features such as IP Source Guard, dynamic host configuration protocol (DHCP) security, Institute of Electrical and Electronics Engineers (IEEE) <NUM>. 1X authentication, Captive portal, VoIP provisioning, and advanced access control list (ACL) options may be applied to satellite devices <NUM> and extended ports <NUM>, <NUM>. Such security features may, in some cases, be deployed to aggregation device <NUM> as VNFs. By implementing security features as VNFs, aggregation device <NUM> may improve a management and orchestration (MANO) efficiency of system <NUM>. Additionally, since satellite devices <NUM> route packets through aggregation device <NUM>, which includes the security features, it might not be necessary for satellite devices <NUM> themselves to include such security features, which may expensive to include in satellite devices <NUM>. In this way, it may be possible to cost-effectively connect satellite devices <NUM> to the LAN which is managed by the aggregation device.

Satellite devices <NUM> may include uplink ports that are each a physical interface that provides connection to aggregation device <NUM>. For example, uplink ports 44A-44D (collectively, "uplink ports <NUM>") provide connections for satellite device 32A to aggregation device <NUM>, and uplink ports 46A-46D (collectively, "uplink ports <NUM>") provide connections for satellite device 32N to aggregation device <NUM>. Network and control traffic on satellite devices <NUM> that are transported to aggregation device <NUM> are sent or received on uplink ports <NUM> and <NUM>. Uplink ports <NUM> and <NUM> may be a <NUM>-gigabit/second (Gbps) small form-factor pluggable (SFP+) interface or a <NUM>-Gbps quad small form-factor pluggable (QSFP+) interface, but may also be any interface on satellite devices <NUM> that connects satellite devices <NUM> to aggregation device <NUM>.

Aggregation device <NUM> may serve as a master switch with respect to satellite devices <NUM>. Aggregation device <NUM> includes a plurality of cascade ports 38A-38D (collectively, "cascade ports <NUM>") that are physical interfaces on aggregation device <NUM> that provide connectivity to one or more satellite devices, e.g., satellite devices <NUM>. Aggregation device <NUM> may configure one or more cascade port connections with each of satellite devices <NUM> over which control and network traffic is sent and received. For example, cascade ports 38A-38D connect to uplink ports 44A-44D, respectively, on satellite device 32A via links 42A-42D, and cascade ports 38A-38D connect to uplink ports 46A-46D, respectively, on satellite device 32N via links 42E-<NUM>. Although shown for purposes of example with connections between only certain cascade ports <NUM> and certain uplink ports <NUM>, in some examples, every cascade port <NUM> may be connected to every uplink port <NUM>. Each of links 42A-<NUM> (collectively, "links <NUM>") may include an interface on each end of the link. The interface on the aggregation device end of the link is a cascade port, and the interface on the satellite device end of the link is an uplink port. Each of cascade ports <NUM> may be a <NUM>-gigabit/second (Gbps) SFP+ interface or a <NUM>-Gbps QSFP+ interface, but may also be any interface on aggregation device <NUM> that connects satellite devices <NUM> to aggregation device <NUM>.

Additionally, aggregation device <NUM> includes a management interface <NUM>, where management interface <NUM> is a physical interface on aggregation device <NUM> that provides connectivity to orchestrator <NUM>. In some examples, management interface <NUM> may represent the most direct interface to orchestrator <NUM> within branch site switch <NUM>. Orchestrator <NUM> may, in some examples, register branch site switch <NUM> as a single logical switch represented by aggregation device <NUM>. In some examples, orchestrator <NUM> does not register satellite devices <NUM> in a network topology. As such, a number of satellite devices <NUM> connected to aggregation device <NUM> might not be registered with orchestrator <NUM>.

Aggregation device <NUM> centrally manages satellite devices <NUM>, therefore eliminating the need for central site <NUM> to manage satellite devices <NUM> individually, which reduces the overhead associated with configuring, monitoring, and upgrading satellite devices <NUM>. To facilitate the centralized management, aggregation device <NUM> may configure connections between cascade ports <NUM> of aggregation device <NUM> and satellite devices <NUM>. Each of extended ports <NUM> of satellite devices <NUM> may include an identifier, e.g., a flexible physical interface card (PIC) concentrator identifier (FPC ID) that is mapped to one or more of cascade ports <NUM>. As one example, extended port 34A of satellite device 32A may include an FPC ID of <NUM>, and cascade port 38A of aggregation device <NUM> may include a port ID of xe-<NUM>/<NUM>/<NUM>. To configure a connection between aggregation device <NUM> and satellite device 32A, aggregation device <NUM> may map the FPC ID of <NUM> of extended port 34A to the xe-<NUM>/<NUM>/<NUM> port ID of cascade port 38A such that extended port 34A is associated with cascade port 38A.

Based on the configured connections, extended ports <NUM> may appear as ports of sub-systems, such as a additional interfaces of line cards, that can be managed via aggregation device <NUM>. In the example of <FIG>, aggregation device <NUM> may handle traffic for extended ports 34A-34N on satellite device 32A and handle traffic for extended ports <NUM> for satellite device 32N.

Aggregation device <NUM> provides one or more resources, such as Quality of Service (QoS) queues or firewalls, for use by extended ports <NUM>, <NUM>. As one example, aggregation device <NUM> may include QoS hardware queues used to facilitate controlled sharing of network bandwidth for forwarding packets. In one example, each of hosts <NUM> may have a particular priority associated with a service level subscription (i.e., host 52A may have a higher priority to access services, whereas host 52C may have a lower priority to access server). Extended ports <NUM> of satellite devices <NUM> may need the QoS hardware queues provisioned on aggregation device <NUM> to facilitate controlled sharing of network bandwidth for forwarding packets based on the priorities to hosts <NUM>.

In some examples, aggregation device <NUM> represents a uCPE device where VNFs are spawned as software applications for various functions (e.g., a firewall function or a router function) on standard x86 servers. For example, the VNFs of the uCPE device may run on an operating system hosted by a server (not illustrated in <FIG>). The operating system of the uCPE may manage a lifecycle of the VNFs, and also provide switching among NIC ports of the uCPE using a software-based data plane (e.g., a forwarding unit). It may be beneficial, in some cases, for aggregation device <NUM> to be a uCPE device, since uCPE devices provide an efficient interface between hardware (e.g., a PFE) and software components (e.g., VNFs). Additionally, it may be efficient to add and remove VNFs from the uCPE.

In some examples, extended port 34A of satellite device 32A receives packet <NUM> from host 52A, where packet <NUM> is destined for host 52N. Traffic sent between aggregation device <NUM> and satellite devices <NUM> is sent over a logical path, referred to herein as "E-channel. " Satellite device 32A may insert an E-channel tag (ETAG) header to the packet. The ETAG header may include an E-channel identifier (ECID) value that is assigned by aggregation device <NUM> and identifies the source or destination extended port on satellite devices <NUM>. In the example of <FIG>, satellite device 32A may insert in packet <NUM> an ETAG header that carries an ECID value identifying extended port 34A of satellite device 32A as the source extended port.

Satellite device 32A load-balances the packet on one of uplink ports 44A-44D (collectively, "uplink ports <NUM>") to forward packet <NUM> to aggregation device <NUM>. For example, satellite device 32A may perform a hash algorithm on packet <NUM>, and based on a per-packet hash that is computed using key fields in packet <NUM>, one of the uplink port connections is selected to forward packet <NUM> to aggregation device <NUM>. In the example of <FIG>, satellite device 32A may select uplink port 44A to forward packet <NUM> to aggregation device <NUM>.

Cascade port 38A of aggregation device <NUM> may receive packet <NUM> and extract the ECID value identifying extended port 34A from the ETAG header and determine that the packet is sourced from extended port 34A of satellite device 32A. Aggregation device <NUM> then removes the ETAG header from the packet. Aggregation device <NUM> performs a lookup for host 52N in its forwarding information and the result of the lookup is extended port 34N of satellite device 32A.

Aggregation device <NUM> may insert a new ETAG header and ECID value in packet <NUM> identifying extended port 34N of satellite device 32A as the destination extended port and may forward packet <NUM> (represented as packet 48A in <FIG>) through the active cascade port, e.g., cascade port 38B, to uplink port 44B of satellite device 32A. Uplink port 44B of satellite device 32A receives packet <NUM> and extracts the ECID value from the ETAG header. In this example, satellite device 32A maps the ECID value identifying extended port 34N to extended port 34N and forwards packet <NUM> to host 52N. As such, branch site switch <NUM> may route packet <NUM> from host 52A to host 52N. In cases where an originating host device of a packet and a destination host device of the packet are located within the same branch site <NUM>, the packet may be referred to as a "local packet.

Aggregation device <NUM> may be configured to register satellite devices <NUM>. In some examples, to register satellite devices <NUM>, aggregation device <NUM> is configured to provision an IP address corresponding to each satellite device of satellite devices <NUM>. Additionally, in some examples, aggregation device <NUM> is configured to map satellite devices <NUM> to a network topology stored in a storage device (not illustrated in <FIG>) of aggregation device <NUM>, configure satellite devices <NUM> for exchanging information with aggregation device <NUM>, manage connections between cascade ports <NUM> and satellite devices <NUM>, or any combination thereof. For example, aggregation device <NUM> may manage interface configuration for satellite devices <NUM> which are coupled to aggregation device <NUM> via cascade ports <NUM>. Using aggregation device <NUM> to manage the interface configuration for satellite devices <NUM> may obviate a need for orchestrator <NUM> to manage the interface connection for the satellite devices <NUM>. For example, orchestrator <NUM> might not need to reserve public IP addresses as management IP addresses for each of satellite devices <NUM>. As such, orchestrator <NUM> might not be required to log in to each satellite device <NUM> separately. Rather, orchestrator <NUM> may communicate directly with aggregation device <NUM> via management interface <NUM>, and view satellite devices <NUM> as line cards on a single logical switch (e.g., branch site switch <NUM>). Because switches are logically represented to orchestrator <NUM> as sub-systems of branch site switch <NUM> and orchestrator <NUM> need not interface directly with the switches, it may be simpler, from the perspective of orchestrator <NUM>, to add or remove switches (represented as satellite devices) to or from branch site switch <NUM>.

In some examples, aggregation device <NUM> includes a forwarding unit (not illustrated in <FIG>) configured to route packets within branch site 30A, and forward packets to central site <NUM>, branch sites 18B-18N, or any combination thereof. Aggregation device <NUM> may forward packets on behalf of satellite devices 32A, eliminating a need for a satellite device to forward packets between a source host device and a destination host device that are both coupled to the satellite device. For example, satellite device 32A may receive a packet from a first host device (e.g., host 52A) that is destined for a second host device (e.g., host 52N), where both the first host device and the second host device are coupled to satellite device 32A. Satellite device 32A may forward the packet to aggregation device <NUM>, and the forwarding unit of aggregation device <NUM> may in turn route the packet back to satellite device 32A. Subsequently, satellite device 32A may forward the packet to host 52N, the destination host device. Additionally, in some examples, the forwarding unit may be configured to receive a packet from a first host device (e.g., host 52A) that is destined for a second host device (e.g., host device 54N), where both the first host device and the second host device are coupled to different satellite devices within branch site 18A (e.g., satellite device 32A and satellite device 32N, respectively).

When aggregation device <NUM> receives a packet destined for a host device within branch site 18A (e.g., hosts <NUM>, <NUM>), aggregation device <NUM> is configured to determine, based on a header of the packet, a cascade port of cascade ports <NUM> corresponding to a satellite device <NUM> coupled to the host device. Subsequently, aggregation device <NUM> may forward the packet through the cascade port <NUM> to the host device. In some examples, the host device is coupled to the satellite device <NUM> by an extended port (e.g., extended ports <NUM>, <NUM>). In some examples, the extended port is a PoE port. In some cases, to determine the correct cascade port <NUM> for forwarding the packet to the destination host device, the forwarding unit is configured to: determine the cascade port assigned to the extended port coupled to the destination host device and forward the packet to the destination device via the extended port coupled to the destination host device.

In some examples, a set of VNFs are provisioned in aggregation device <NUM>. The set of VNFs may be software models each representing a virtualized model of computer hardware, and the set of VNFs may execute tasks (e.g., security tasks and packet forwarding tasks) based on the respective virtualized models of computer hardware. In some examples, aggregation device <NUM> receives a packet, from a host device of branch site 18A (e.g., hosts <NUM>, <NUM>), that is destined for a device outside of branch site 18A. In such examples, aggregation device <NUM> is configured to forward the packet to the set of VNFs for processing, and subsequently forward the processed packet to the WAN (e.g., central site <NUM>, branch sites 18B-18N, or any combination thereof) through WAN uplink port <NUM> and router <NUM>. In some examples, the set of VNFs may include a port extension bridge function (also referred to as a port extension service), which may assist in discovering satellite devices <NUM> and routing packets between satellite devices <NUM> via aggregation device <NUM>. The VNFs in some cases, may form a service chain for processing packets, and the port extension service may be a VNF in the service chain.

<FIG> is a block diagram illustrating an example of an aggregation device <NUM> within a branch site switch, such as aggregation device <NUM> from <FIG> and <FIG>, in accordance with one or more techniques of this disclosure. Aggregation device <NUM> may include a network device, such as a router and/or a switch. Aggregation device <NUM> may be configured to operate substantially similar to aggregation device <NUM> from <FIG>.

In the illustrated example of <FIG>, aggregation device <NUM> includes a control unit <NUM> that provides control plane functionality for the network device. Control unit <NUM> may include a routing component <NUM> (e.g., a routing engine) coupled to a forwarding unit <NUM>. Aggregation device <NUM> includes interface cards 64A-64N (collectively, "IFCs <NUM>") that receive packets via inbound links and send packets via outbound links. IFCs <NUM> typically have one or more physical network interface ports (e.g., cascade ports <NUM> of <FIG>). Additionally, control unit <NUM> may include virtualized network functions (VNFs) 66A-66N (collectively, "VNFs <NUM>"). VNFs <NUM> may be software models each representing a virtualized model of computer hardware, and the VNFs <NUM> may execute tasks (e.g., security tasks and packet forwarding tasks) based on the respective virtualized models of computer hardware. In some examples, aggregation device <NUM> receives a packet, from a host device of branch site 18A (e.g., hosts <NUM>, <NUM>), that is destined for a device outside of branch site 18A. In such examples, aggregation device <NUM> is configured to forward the packet to VNFs <NUM> for processing, and subsequently forward the processed packet to the WAN (e.g., central site <NUM>, branch sites 18B-18N, or any combination thereof) through WAN uplink port <NUM> and router <NUM>.

In some examples, aggregation device <NUM> implements the IEEE <NUM>. 1BR standard as a VNF, such as by port extension service <NUM>. In this way, aggregation device <NUM> may represent access switches as satellite devices <NUM>, where satellite devices <NUM> include extended ports <NUM>, <NUM> that, in some examples, represent PoE ports. By implementing IEEE <NUM>. 1BR as a VNF in a VNF service chain, aggregation device <NUM> may improve a MANO efficiency of the system, obviating a need for orchestrator <NUM> to implement IEEE <NUM>. In this way, from the perspective of orchestrator <NUM>, branch site switch <NUM> may represent a single logical switch with PoE capabilities. Additionally, or alternatively, in some cases, VNFs <NUM> may implement other protocols or standards such as IEEE <NUM>. 1X authentication, IP Source Guard, DHCP security, Captive Portal, VoIP provisioning, advanced ACL, or any combination thereof.

In some cases, from the perspective of orchestrator <NUM>, satellite devices <NUM> appear as line cards on a single logical switch (e.g., branch site switch <NUM>). In some examples, port extension service <NUM> may "discover" satellite devices <NUM>, such as by using a discovery protocol, and provide orchestrator <NUM> with data that portrays satellite devices <NUM> as line cards to orchestrator <NUM>. In this way, if an additional satellite device <NUM> is added to branch site switch <NUM>, port extension service <NUM> may discover the existence of the additional satellite device <NUM> and report the existence of respective additional line cards to orchestrator <NUM>. Orchestrator <NUM> may then configure ports (e.g., extended ports <NUM>, <NUM>) of satellite devices <NUM> as ports on a line card. In other words, orchestrator <NUM> may output instructions to aggregation device <NUM> via management interface <NUM>, where the instructions cause aggregation device <NUM> to configure the ports of satellite devices <NUM>, such as by a communication synchronization protocol for communicating with the satellite devices <NUM>.

Routing component <NUM> provides an operating environment for various protocols (not shown) that execute at different layers of a network stack. Routing component <NUM> is responsible for the maintenance of routing information <NUM> to reflect the current topology of a network and other network entities to which aggregation device <NUM> is connected. In particular, routing protocols periodically update routing information <NUM> to accurately reflect the topology of the network and other entities based on routing protocol messages received by aggregation device <NUM>.

The protocols may be software processes executing on one or more processors. For example, routing component <NUM> may include bridge port extension protocols, such as IEEE <NUM>. Routing component <NUM> may also include network protocols that operate at a network layer of the network stack. In the example of <FIG>, network protocols may include one or more control and routing protocols such as border gateway protocol (BGP), internal gateway protocol (IGP), label distribution protocol (LDP) and/or resource reservation protocol (RSVP). In some examples, the IGP may include the open shortest path first (OSPF) protocol or the intermediate system-to-intermediate system (IS-IS) protocol. Routing component <NUM> also may include one or more daemons that include user-level processes that run network management software, execute routing protocols to communicate with peer routers or switches, maintain and update one or more routing tables, and create one or more forwarding tables for installation to forwarding unit <NUM>, among other functions.

Routing information <NUM> may include, for example, route data that describes various routes within the network, and corresponding next hop data indicating appropriate neighboring devices within the network for each of the routes. Aggregation device <NUM> updates routing information <NUM> based on received advertisements to accurately reflect the topology of the network.

Based on routing information <NUM>, routing component <NUM> generates forwarding information <NUM> and installs forwarding data structures (e.g., cascade port identifier list <NUM>) into forwarding information <NUM> within forwarding unit <NUM> in the forwarding plane. Forwarding information <NUM> associates network destinations with specific next hops and corresponding interface ports within the forwarding plane.

Routing component <NUM> may include one or more resource modules <NUM> for configuring resources for extended ports and uplink ports on satellite devices interconnected to aggregation device <NUM>. Resource modules <NUM> may include a scheduler module for configuring Quality of Service (QoS) policies, firewall module for configuring firewall policies, or other modules for configuring a resource for network devices.

Forwarding unit <NUM> represents hardware and logic functions that provide high-speed forwarding of network traffic. In some examples, forwarding unit <NUM> may be implemented as a programmable forwarding plane. Forwarding unit <NUM> may include a set of one or more forwarding chips programmed with forwarding information that maps network destinations with specific next hops and the corresponding output interface ports. In the example of <FIG>, forwarding unit <NUM> includes forwarding information <NUM>. In accordance with routing information <NUM>, forwarding unit <NUM> maintains forwarding information <NUM> that associates network destinations with specific next hops and corresponding interface ports (e.g., extended ports <NUM>). For example, routing component <NUM> analyzes routing information <NUM> and generates forwarding information <NUM> in accordance with routing information <NUM>. Forwarding information <NUM> may be maintained in the form of one or more tables, link lists, radix trees, databases, flat files, or any other data structures.

Forwarding information <NUM> may, in some examples, include a cascade port identifier list <NUM> having a list of unicast next hops. Cascade port identifier list <NUM> may include a list of cascade port identifiers associated with cascade ports included in IFCs <NUM> coupled to aggregation device <NUM>. Cascade port identifier list <NUM> may represent an identifier of any of cascade ports <NUM> of <FIG>.

Although not shown in <FIG>, forwarding unit <NUM> may include a central processing unit (CPU), memory and one or more programmable packet-forwarding application-specific integrated circuits (ASICs).

The architecture of aggregation device <NUM> illustrated in <FIG> is shown for example purposes only. The disclosure is not limited to this architecture. In other examples, aggregation device <NUM> may be configured in a variety of ways. In one example, some of the functionally of routing component <NUM> and forwarding unit <NUM> may be distributed within IFCs <NUM>.

Elements of control unit <NUM> may be implemented solely in software, or hardware, or may be implemented as combinations of software, hardware, or firmware. For example, control unit <NUM> may include one or more processors, one or more microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or any other equivalent integrated or discrete logic circuitry, or any combination thereof, which execute software instructions. In that case, the various software modules of control unit <NUM> may include executable instructions stored, embodied, or encoded in a computer-readable medium, such as a computer-readable storage medium, containing instructions. Instructions embedded or encoded in a computer-readable medium may cause a programmable processor, or other processor, to perform the method, e.g., when the instructions are executed. Computer-readable storage media may include random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM), non-volatile random access memory (NVRAM), flash memory, a hard disk, a CD-ROM, a floppy disk, a cassette, a solid state drive, magnetic media, optical media, or other computer-readable media. Computer-readable media may be encoded with instructions corresponding to various aspects of aggregation device <NUM>, e.g., protocols. Control unit <NUM>, in some examples, retrieves and executes the instructions from memory for these aspects.

Storage device <NUM> may be configured to store information within aggregation device <NUM> during operation. Storage device <NUM> may include a computer-readable storage medium or computer-readable storage device. In some examples, storage device <NUM> includes one or more of a short-term memory or a long-term memory. Storage device <NUM> may include, for example, RAM, DRAM, SRAM, magnetic discs, optical discs, flash memories, or forms of EPROM or EEPROM. In some examples, storage device <NUM> is used to store data indicative of instructions for execution by processing circuitry (not illustrated) of aggregation device <NUM>. Storage device <NUM> may be used by software or applications running on aggregation device <NUM> to temporarily store information during program execution.

Additional examples regarding the aggregation device are described in <CIT>, and <CIT>.

<FIG> is a block diagram illustrating a path of an example first packet <NUM> and a path of an example second packet <NUM>, in accordance with one or more techniques of this disclosure. <FIG> includes service provider network <NUM>, satellite devices <NUM>, and aggregation device <NUM>, which may be an example of aggregation device <NUM> of <FIG> and <FIG>. In the example illustrated in <FIG>, aggregation device <NUM> may include VNFs <NUM>, forwarding unit <NUM>, and port extension service <NUM>.

Aggregation device <NUM> may forward packets received from satellite devices <NUM>. In this way, aggregation device <NUM> may eliminate a need for satellite devices <NUM> to themselves route packets between host devices. For example, packets may be tunneled from satellite devices <NUM> to aggregation device <NUM>, such as in accordance with the IEEE <NUM>. 1BR standard, for example. Such tunneling may be facilitated by port extension service <NUM>, in some examples. For example, port extension service <NUM> may provide NFV functionality that allows aggregation device <NUM> to decapsulate the packet and determine where to send the packet (e.g., on for further VNF service chain application, or to forwarding unit <NUM> for outputting via one of ports <NUM>, <NUM>. In some examples, port extension service <NUM> is provided as a VNF within aggregation device <NUM>. In the example of <FIG>, Port extension service <NUM> may be separate from VNFs <NUM>.

In some examples, port extension service <NUM> cooperates with forwarding unit <NUM> to forward a packet (e.g., first packet <NUM>) originating from a host device coupled to a satellite device (e.g., satellite device 32A) within branch site 18A, where first packet <NUM> is destined for a host device that is also coupled to a satellite device within branch site 18A. For example, forwarding unit <NUM> may receive first packet <NUM> via uplink port 44A and cascade port 38A. Forwarding unit <NUM> may identify, based on a header of first packet <NUM>, cascade port 38B, where cascade port 38B corresponds to an extended port of satellite device 32A that is coupled to host device that first packet <NUM> is destined for. In this manner, forwarding unit <NUM> provides LAN-to-LAN switching. An example of such forwarding (switching) may be sending packets from a laptop to a printer, for example. Although shown for purposes of example as being sent through forwarding unit <NUM> without application of VNFs <NUM> or port extension service <NUM>, in some examples such LAN-to-LAN switching may include application of VNFs <NUM> and/or port extension service <NUM>.

Additionally, in some examples, aggregation device <NUM> is configured to forward a packet (e.g., second packet <NUM>) from an originating host device coupled to a satellite device (e.g., satellite device 32N) within branch site 18A, where second packet <NUM> is destined for a device outside of branch site 18A. For example, forwarding unit <NUM> may receive second packet <NUM> via uplink port 46D and cascade port 38D. Port extension service <NUM> may decapsulate the packet (e.g., by removing an outer tunnel header), and cooperates with forwarding unit <NUM> to determine what should happen to the packet next. For example, based on an inner header of second packet <NUM>, forwarding unit <NUM> may determine that second packet <NUM> is destined for a device outside of branch site 18A. Subsequently, forwarding unit <NUM> may forward the packet to VNFs <NUM> for processing, and forward the processed packet to service provider network <NUM> via WAN uplink port <NUM>.

Port extension service <NUM> may use discovery protocol <NUM> (e.g., a link layer discovery protocol (LLDP)) for discovering satellite devices, such as when a new switch is added. Discovery protocol <NUM> may also detect when a switch is removed. Port extension service <NUM> accordingly adds or removes a new switch (e.g., an access switch) to or from the cluster of aggregation device <NUM>, e.g., to a cluster of branch site switch <NUM>. Port extension service <NUM> may provision IP addresses corresponding to each satellite device of satellite devices <NUM>. For example, when an additional satellite device is added to branch site switch <NUM>, discovery protocol <NUM> may detect the additional satellite device and port extension service <NUM> may provision an additional IP address corresponding to the additional satellite device. In response to detecting that a switch has been added, port extension service <NUM> causes management interface <NUM> to communicate the addition of a logical sub-system representing the added switch. Additionally, in response to detecting that a switch is removed, port extension service <NUM> causes management interface <NUM> to communicate the removal of the logical sub-system representing the removed switch. Port extension service <NUM>, in some cases, may represent the sub-systems as line cards on a single logical switch (e.g., branch site switch <NUM>). In such examples, to configure the satellite device of the set of satellite devices, aggregation device <NUM> may be configured to restructure the configuration information such that the configuration information defines a second data structure referencing aggregation device <NUM> and the satellite devices <NUM>. In other words, when representing satellite devices <NUM> as sub-systems, port extension service <NUM> may be configured to "translate" the representation of branch site switch <NUM> such that branch site switch <NUM> appears as a single logical switch having sub systems (e.g., representations of satellite devices <NUM>).

Port extension service <NUM> may use communication synchronization protocol <NUM> (CSP) for configuring the satellite devices. In some examples, a CSP such as a TCP-based remote procedure call (RCP) may be used. For example, uCPE commands may be sent to satellite devices using JSON on top of a TCP-based connection to push the commands down to satellite devices. The satellite device receives the command and programs its ASICs accordingly.

In this manner, managed LAN functionality can be provided as a service, and may be offered as a service to providers using any switch vendor (including multi-vendor deployments), and the LAN can be managed via a VNF in a service chain. This converges the functions of managing the WAN and the LAN by the aggregation device (e.g., uCPE). In addition, because the forwarding function is performed by aggregation device <NUM> on behalf of each of the satellite devices <NUM>, the administrator of branch site switch <NUM> can centrally modify the forwarding plane of branch site switch <NUM> by configuring only the forwarding plane of aggregation device <NUM>, rather than having to separately log in and configure forwarding planes of individual switches/satellite devices. In addition, switches that may not support particular forwarding functionality can be used, because the switches gain the benefit of the richer forwarding plane provided by aggregation device <NUM>. This allows for increased network scalability and deployment of larger scale networks without a corresponding increase in administrative burden, as well as potentially lower costs. It may be beneficial for aggregation device <NUM> to include VNFs <NUM> and port extension service <NUM>, enabling the aggregation device to implement one or more security features. For example, since satellite devices <NUM> route packets through aggregation device <NUM>, which includes a rich set of access and control features provided by VNFs <NUM> and port extension service <NUM>, it might not be necessary for satellite devices <NUM> to include such access and control features, which may expensive to include satellite devices <NUM>. In this way, it may be possible to cost-effectively add or remove large numbers of satellite devices to the LAN which is managed via aggregation device <NUM>.

The techniques of this disclosure provide a port extension service as a VNF, including tunneling functionality (e.g., <NUM>. 1BR) for port extension, for branch sites where uCPE devices are used, and represent the access switches as the satellite devices in the managed LAN, and the PoE capable ports as "extended ports" of the uCPE device itself, after which the general-purpose server logically becomes a massive PoE-capable switch.

<FIG> is a flow diagram illustrating an example operation for managing branch site 18A of system <NUM>, in accordance with one or more techniques of this disclosure. For purposes of example, <FIG> is described with respect to orchestrator <NUM>, branch site 18A, and branch site switch <NUM> of <FIG>. However, the techniques of <FIG> may be performed by different additional or alternative systems and devices.

Branch site 18A, in some cases, may be a single branch site of a plurality of branch sites <NUM> that are managed by orchestrator <NUM> of central site <NUM>. Central site <NUM> and branch sites <NUM> may be geographically separated sites that belong to a single enterprise, such as a university, corporation, business, or other large entity. In this way, sites <NUM>, <NUM> may collectively represent a WAN, where each of branch sites <NUM> represent a respective LAN. While orchestrator <NUM> may be configured to manage branch sites <NUM>, orchestrator <NUM> may manage each branch site of branch sites <NUM>. For example, orchestrator <NUM> may manage branch site 18A using branch site switch <NUM>, which represents a single logical switch from the perspective of orchestrator <NUM>.

In the example operation of <FIG>, aggregation device <NUM> is configured to communicate with orchestrator <NUM> (<NUM>). For example, aggregation device <NUM> is configured to communicate with orchestrator <NUM> via management interface <NUM>. In some cases, aggregation device <NUM> may send information to orchestrator <NUM>. In other examples, aggregation device <NUM> may receive information from orchestrator <NUM>. Management interface <NUM> may, in some cases, be the only interface by which orchestrator <NUM> can communicate with aggregation device <NUM>. In this way, aggregation device <NUM> may serve as a master switch of branch site 18A, since aggregation device <NUM> processes and distributes to the satellite devices data received from orchestrator <NUM> via management interface <NUM>. Orchestrator <NUM> may be coupled to satellite devices <NUM> via cascade ports <NUM>, where the satellite devices <NUM> provide switching functionality.

Aggregation device <NUM> detects each satellite device of satellite devices <NUM> which are coupled to aggregation device <NUM> (<NUM>). In some examples, to detect each satellite device, aggregation device <NUM> uses port extension service <NUM>. Port extension service <NUM> may represent a VNF executing on aggregation device <NUM> that includes a discovery protocol <NUM> (e.g., an LLDP) configured to identify satellite devices <NUM> and create a representation of satellite devices <NUM> relative to aggregation device <NUM>. For example, discovery protocol <NUM> may identify each connection between satellite devices <NUM> and cascade ports <NUM>. In turn, port extension service <NUM> may create a representation of satellite devices <NUM> as sub-systems within a logical switch. In this way, the logical switch may be a representation of branch site switch <NUM> including the sub-systems corresponding to satellite devices <NUM>. Additionally, port extension service <NUM> may provision IP addresses corresponding to each satellite device of satellite devices <NUM>.

Aggregation device <NUM> sends data to orchestrator <NUM>, the data indicating satellite devices <NUM> as respective sub-systems within a logical switch (<NUM>). In some examples, the data represents the sub-systems as line cards connected to the logical switch. Since the logical switch modelled by the data may represent branch site switch <NUM>, orchestrator <NUM> and an administrator may view branch site switch <NUM> as a single logical switch, even though branch site switch <NUM> includes several physical switching devices (i.e., aggregation device <NUM> and each of satellite devices <NUM>). Representing branch site switch <NUM> as a single logical switch may improve a MANO efficiency because in this way, an administrator is only required to manage one logical switch per branch site versus having to manage each satellite device independently. Additionally, because satellite devices <NUM> are modelled as sub-systems within the logical switch in the data that is available to orchestrator <NUM>, orchestrator <NUM> may receive user input representing instructions for configuring satellite devices <NUM> in the context of the sub-systems that represent satellite devices <NUM>. For example, aggregation device <NUM> may receive, from orchestrator <NUM>, configuration information for managing at least one sub-system within the logical switch (<NUM>).

After receiving the configuration information, aggregation device <NUM> configures, based on the configuration information, the satellite device of satellite devices <NUM> corresponding to the at least one sub-system (<NUM>). In some examples, the configuration information may define a first data structure representing a LAN including the logical switch and the at least one sub-system. In such examples, to configure the satellite device of the set of satellite devices, aggregation device <NUM> may be configured to restructure the configuration information such that the configuration information defines a second data structure referencing aggregation device <NUM> and the satellite devices <NUM>. In other words, aggregation device <NUM> may be configured to "translate" the configuration information such that aggregation device <NUM> is able to carry out an instruction referencing the at least on sub-system by configuring the respective satellite device <NUM> based on the configuration information. In some examples, while translating the configuration information, aggregation device <NUM> may perform management tasks that are not required of orchestrator <NUM>, such as provisioning IP addresses for at least one of satellite devices <NUM>.

In some cases, aggregation device <NUM> may configure, based on the configuration information, a set of connections between the set of satellite devices and the aggregation device. For example, aggregation device <NUM> may map, for each connection of the set of connections, an extended port <NUM>, <NUM> of a respective satellite device <NUM> to a cascade port <NUM> of aggregation device <NUM>. Subsequently, aggregation device <NUM> may establish the set of connections, enabling information to pass through each connection of the set of connections between aggregation device <NUM> and the respective satellite device <NUM>.

Additionally, aggregation device <NUM> may facilitate the addition or removal of additional satellite devices to or from branch site switch <NUM>. For example, aggregation device <NUM> may detect, using port extension service <NUM>, an additional satellite device not included in satellite devices <NUM>. Aggregation device <NUM> may send, to orchestrator <NUM>, data indicating the additional satellite device as an additional sub-system within the logical switch. Subsequently, aggregation device <NUM> may receive, from orchestrator <NUM>, additional configuration information for managing the additional sub-system within the logical switch. Aggregation device <NUM> may configure, by the port extension service based on the additional configuration information, the additional satellite device corresponding to the additional sub-system.

<FIG> is a flow diagram illustrating an example operation for forwarding packets using aggregation device <NUM>, in accordance with one or more techniques of this disclosure. For purposes of example, <FIG> is described with respect to central site <NUM>, branch sites <NUM>, branch site switch <NUM>, aggregation device <NUM>, satellite devices <NUM>, and hosts <NUM>, <NUM>, and <NUM> of <FIG>. However, the techniques of <FIG> may be performed by different additional or alternative systems and devices.

Aggregation device <NUM> may be configured to route network traffic (e.g., packets) within branch site 18A and route network traffic to a destination outside of branch site 18A (e.g., the WAN). In this way, branch site switch <NUM> may operate using the configuration that is established by orchestrator <NUM> based on a representation of branch site switch <NUM> as a single logical switch having at least one sub-system. Aggregation device <NUM> may, in some cases, receive network traffic from satellite devices <NUM>. In some cases, the example operation of <FIG> follows after the example operation of <FIG>.

In the example operation of <FIG>, aggregation device <NUM> receives a packet from a source satellite device, the packet having a header (<NUM>). In some examples, the source satellite device is satellite device 32A which is coupled to a source host device (e.g., host 52A). For example, satellite device 32A may receive the packet from source host 52A, which is coupled to extended port 34A of satellite device 32A and forward the packet to aggregation device <NUM> via uplink port 44A. In some examples, the header includes an "inner header," which is represented by an ETAG header. Additionally, in some examples, the packet includes a tunnel header which represents an "outer header. " Aggregation device processes the header using port extension service <NUM> (<NUM>). In some cases, to process the packet, port extension service <NUM> may remove the outer header of the packet and cooperate with forwarding unit <NUM> to determine a next destination of the packet based on the inner header.

Aggregation device <NUM> performs a forwarding lookup (<NUM>) to determine the next destination of the packet. For example, aggregation device <NUM> may perform the forwarding lookup to determine if the packet is bound for the LAN (<NUM>) (e.g., if the next destination of the packet is one of satellite devices <NUM> coupled to aggregation device <NUM>) or if the packet is bound for the WAN (e.g., if the next destination of the packet is WAN uplink port <NUM>). To perform the forwarding lookup in order to determine if the packet is bound for the LAN, port extension service <NUM> and/or forwarding unit <NUM> may read the inner header (e.g., the ETAG header) of the packet and identify the destination of the packet. For example, port extension service <NUM> may determine whether the packet is bound for a destination host device that is coupled to a satellite device within branch site switch <NUM>. In other words, port extension service <NUM> may determine whether the packet is bound for a destination host device within branch site 18A.

If aggregation device <NUM> determines that the packet is bound for the LAN ("YES" branch of block <NUM>), aggregation device <NUM> determines, from the inner header of the packet, a destination host device coupled to a destination satellite device (<NUM>). For example, aggregation device <NUM> may determine that the packet is bound for host 52B coupled to satellite device 32A. Aggregation device <NUM> may use port extension service <NUM> to read the inner header of the packet and identify host 52B as the destination host device and identify satellite device 32A as the destination satellite device coupled to host 52B. Subsequently, aggregation device <NUM> may determine a cascade port of cascade ports <NUM> corresponding to the destination satellite device (<NUM>). In some examples, aggregation device <NUM> may determine the cascade port using forwarding unit <NUM> and/or port extension service <NUM>. The destination host device may be coupled to the destination satellite device by an extended port. For example, host 52B is coupled to satellite device 32A by extended port 34B. In this way, and to determine the respective cascade port, aggregation device <NUM> may determine, using forwarding unit <NUM>, the cascade port assigned to the extended port which is coupled to the destination host device 52B. Aggregation device <NUM> forwards the packet through the cascade port to the destination host device (e.g., host 52B) (<NUM>).

If aggregation device <NUM> determines that the packet is not bound for the LAN ("NO" branch of block <NUM>), aggregation device <NUM> determines that the packet is bound for the WAN (<NUM>). Subsequently, aggregation device <NUM> may process the packet using VNFs <NUM> (<NUM>). Additionally, in some examples, aggregation device <NUM> may process the packet using port extension service <NUM>. VNFs <NUM> may be software models each representing a virtualized model of computer hardware, and the VNFs <NUM> may execute tasks (e.g., security tasks and packet forwarding tasks) based on the respective virtualized models of computer hardware. For example, VNFs <NUM> may implement protocols or standards such as IEEE <NUM>. 1X authentication, IEEE <NUM>. 1BR, IP Source Guard, DHCP security, Captive Portal, VoIP provisioning, advanced ACL, or any combination thereof. After the packet is processed using VNFs, aggregation device <NUM> may forward the processed packet to the WAN through WAN uplink port <NUM> (<NUM>).

<FIG> is a flow diagram illustrating another example operation for forwarding packets using aggregation device <NUM>, in accordance with one or more techniques of this disclosure. For purposes of example, <FIG> is described with respect to central site <NUM>, branch sites <NUM>, branch site switch <NUM>, aggregation device <NUM>, satellite devices <NUM>, and hosts <NUM>, <NUM>, and <NUM> of <FIG>. However, the techniques of <FIG> may be performed by different additional or alternative systems and devices.

Aggregation device <NUM> may be configured to route network traffic (e.g., packets) within branch site 18A and route network traffic to a destination outside of branch site 18A (e.g., the WAN). In this way, branch site switch <NUM> may operate using the configuration that is established by orchestrator <NUM> based on a representation of branch site switch <NUM> as a single logical switch having at least one sub-system. Aggregation device <NUM> may, in some cases, receive network traffic from the WAN. In some cases, the example operation of <FIG> follows after the example operation of <FIG>.

In the example operation of <FIG>, aggregation device <NUM> receives a packet from the WAN via WAN uplink port <NUM>, the packet having a header (<NUM>). In some examples, the packet originates from central site <NUM> or branch sites 18B-18N. In some examples, the header includes an "inner header," which is represented by an ETAG header. Additionally, in some examples, the packet includes a tunnel header which represents an "outer header. " Aggregation device processes the header using VNFs <NUM> (<NUM>). In some examples, VNFs <NUM> may represent a chain of services. For example, VNFs <NUM> may be software models each representing a virtualized model of computer hardware, and the VNFs <NUM> may execute tasks (e.g., security tasks and packet forwarding tasks) based on the respective virtualized models of computer hardware. For example, VNFs <NUM> may implement protocols or standards such as IEEE <NUM>. 1X authentication, IEEE <NUM>. 1BR, IP Source Guard, DHCP security, Captive Portal, VoIP provisioning, advanced ACL, or any combination thereof. In some cases, to process the packet, VNFs <NUM> may remove the outer header of the packet and cooperate with forwarding unit <NUM> and/or port extension service <NUM> to determine a next destination of the packet based on the inner header.

If aggregation device <NUM> determines that the packet is bound for the LAN ("YES" branch of block <NUM>), aggregation device <NUM> determines, from the inner header of the packet, a destination host device coupled to a destination satellite device (<NUM>). For example, aggregation device <NUM> may determine that the packet is bound for host 54B coupled to satellite device 32A. Aggregation device <NUM> may use port extension service <NUM> to read the inner header of the packet and identify host 54A as the destination host device and identify satellite device 32N as the destination satellite device coupled to host 54A. Subsequently, aggregation device <NUM> may determine a cascade port of cascade ports <NUM> corresponding to the destination satellite device (<NUM>). In some examples, aggregation device <NUM> may determine the cascade port using forwarding unit <NUM> and/or port extension service <NUM>. The destination host device may be coupled to the destination satellite device by an extended port. For example, host 54A is coupled to satellite device 32N by extended port 36A. In this way, and to determine the respective cascade port, aggregation device <NUM> may determine, using forwarding unit <NUM>, the cascade port assigned to the extended port which is coupled to the destination host device 54A. Aggregation device <NUM> forwards the packet through the cascade port to the destination host device (e.g., host 54A) (<NUM>).

If aggregation device <NUM> determines that the packet is not bound for the LAN ("NO" branch of block <NUM>), aggregation device <NUM> determines that the packet is bound to return to the WAN (<NUM>). Subsequently, aggregation device <NUM> may process the packet using VNFs <NUM> (<NUM>). Additionally, in some examples, aggregation device <NUM> may process the packet using port extension service <NUM>. After the packet is processed using VNFs, aggregation device <NUM> may forward the processed packet to the WAN through WAN uplink port <NUM> (<NUM>).

Depending on the example, certain acts or events of any of the techniques described herein can be performed in a different sequence, may be added, merged, or left out altogether (e.g., not all described acts or events are necessary for the practice of the techniques).

A control unit including hardware may also perform one or more of the techniques of this disclosure.

The techniques described in this disclosure may also be embodied or encoded in a computer-readable medium, such as a computer-readable storage medium, containing instructions. Instructions embedded or encoded in a computer-readable medium may cause a programmable processor, or other processor, to perform the method, e.g., when the instructions are executed. A computer-readable medium may thus include transient media such as carrier signals and transmission media.

Computer readable storage media may include random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM), flash memory, a hard disk, a CD-ROM, a floppy disk, a cassette, magnetic media, optical media, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. The term "computer-readable storage media" refers to non-transitory, tangible storage media, and not connections, carrier waves, signals, or other transitory media.

Claim 1:
A system comprising:
a set of satellite network devices providing switching functionality; and
an aggregation network device providing control plane functionality, wherein the aggregation network device is configured to communicate with an orchestrator of a wide area network, WAN, and wherein the aggregation network device is configured to:
send, to the orchestrator, data indicating the satellite network devices as respective sub-systems within a logical switch comprising the aggregation network device and the set of satellite network devices;
receive, from the orchestrator, configuration information for managing at least one sub-system within the logical switch; and
configure, based on the configuration information and by a port extension service executing on the aggregation network device, a satellite network device of the set of satellite network devices corresponding to the at least one sub-system,
wherein the port extension service executes a link layer discovery protocol, LLDP, configured to detect each satellite network device of the set of satellite network devices coupled to the aggregation network device.