Fortinet, Inc.

Woven Systems, Inc.

Sable Networks, Inc.

Bert H Tanaka

Joseph R Mihelich

Daniel J Maltbie

Faizel Lakhani

Gary Croke

Riad Hartani

Phillip Laverdiere

Methods and systems for shielding layer two host addresses (e.g., MAC addresses) from a network are provided. An edge network device interposed between a network of switches and multiple local hosts receives from a first local host a first packet destined for a first destination host. The first local host has a first layer 2 (L2) address and a first layer 3 (L3) address associated therewith. The first packet includes the first L2 address as a source L2 address of the first packet, and includes the first L3 address as a source L3 address of the first packet. The edge network device shields the first L2 address from the network of switches by replacing the source L2 address for the first packet with a first substitute L2 address of a first communication channel of the edge network device before sending the first packet to the network of switches.

Mechanism for enabling layer two host addresses to be shielded from the switches in a network

Methods and systems for selecting among multiple concurrently active paths through a network are provided. According to one embodiment, a method is performed by a network interface of a source network device within a loop-free, reverse-path-learning network. The network is divided into multiple virtual local area networks (VLANs). Network traffic destined for a destination network device and specifying an address for the destination or including information from which the address can be derived is received from the source. A set of VLANs that can be used to transport the packet from the source to the destination is determined. Each VLAN in the set of VLANs is associated with a different path through the network from the source to the destination. A particular VLAN from the set of VLANs networks is selected, thereby effectively selecting a particular path from multiple selectable paths between the source and the destination.

Selecting among multiple concurrently active paths through a network

Methods and systems for shielding layer two host addresses (e.g., MAC addresses) from a network are provided. A border component interposed between a network of switches and multiple local hosts receives from a first local host a first packet destined for a first destination host. The first local host has a first layer 2 (L2) address and a first layer 3 (L3) address associated therewith. The first packet includes the first L2 address as a source L2 address for the first packet, and includes the first L3 address as a source L3 address for the first packet. The border component shields the first L2 address from the network of switches by replacing the source L2 address for the first packet with a substitute L2 address before sending the first packet to the network of switches.

Methods and systems for selecting among multiple concurrently active paths through a network are provided. According to one embodiment, a method is performed by a network interface of a source node within a loop-free, reverse-path-learning network. The network is divided into multiple virtual networks. A packet destined for a destination node and specifying an address for the destination or including information from which the address can be derived is received from the source. A set of virtual networks that can be used to transport the packet from the source node to the destination node is determined. Each virtual network in the set of virtual networks provides a different path through the network from the source to the destination. A particular virtual network from the set of virtual networks is selected, thereby effectively selecting a particular path from multiple selectable paths between the source and the destination.

Methods and systems for performing rate limiting are provided. According to one embodiment, information is maintained regarding a set of virtual networks into which a network has been logically divided. Each virtual network comprises a loop-free switching path, reverse path learning network and provides a path through the network between a first and second network device thereby collectively providing multiple paths between the first and second network devices. Packets are received by the first device that are associated with a flow sent by a source network device. The packets are forwarded by the first device to the second device via a particular path of the multiple paths. A congestion metric is determined for the particular path and based thereon it is determined whether a congestion threshold has been reached. Responsive to an affirmative determination, the source device is instructed to reduce the rate at which the packets are sent.

Performing rate limiting within a network

Methods and systems for performing load balancing within an Ethernet network are provided. According to one embodiment, a set of paths is maintained by a first component of multiple components coupled in communication with a network. Each path is a loop-free switching path, reverse path learning network and the first component and a second component of the multiple components are connected through each path. A packet destined for the second component is received by the first component. On a packet-by-packet basis or on a per flow basis, the first component dynamically selects a particular path of the multiple of paths by selecting a virtual network of the set of virtual networks for transporting the received packet that tends to balance traffic load across the set of virtual networks. The first component causes the received packet to be transported through the network to the second component via the particular path.

Adaptive load balancing

Methods and systems for performing rate limiting are provided. According to one embodiment, information is maintained regarding a set of virtual networks into which a network has been logically divided. Each virtual network comprises a loop-free switching path, reverse path learning network and provides a path through the network between a first and second component thereby collectively providing multiple paths between the first and second components. Packets are received by the first component that are associated with a flow sent by a source component. The packets are forwarded by the first component to the second component along a particular path defined by the set of virtual networks. A congestion metric is determined for the particular path and based thereon it is determined whether a congestion threshold has been reached. Responsive to an affirmative determination, the source component is instructed to limit the rate at which the packets are sent.

Methods and systems for performing load balancing within an Ethernet network are provided. According to one embodiment, a set of virtual networks, into which a network has been logically divided that can be used by a first component is maintained. Each of the virtual networks is a loop-free switching path, reverse path learning network and provides a path through the network between the first component and a second component. A packet destined for the second component is received by the first component. On a packet-by-packet basis or on a per flow basis, the first component dynamically selects a particular path by selecting a virtual network for transporting the received packet that tends to balance traffic load across the virtual networks. The first component causes the received packet to be transported through the network to the second component via the particular path.

Methods and systems for shielding layer two host addresses (e.g., MAC addresses) from a network are provided. A border component interposed between a network of switches and multiple local hosts receives from a first local host a first packet destined for a first destination host. The first local host has a first layer 2 (L2) address and a first layer 3 (L3) address associated therewith. The first packet includes the first L2 address as a source L2 address for the first packet, and includes the first L3 address as a source L3 address for the first packet. The border component shields the first L2 address from the network of switches by replacing the source L2 address for the first packet with a substitute L2 address associated with a communication channel of the border component before sending the first packet to the network of switches.

Methods and systems for performing rate limiting are provided. According to one embodiment, multiple paths are provided between each pair of multi-path load balancing (MPLB) components within a Layer 2 network by establishing overlapping loop-free topologies in which each MPLB component is reachable by any other via each overlapping topology. A first MPLB component receives packets associated with a flow sent by a source component at a particular rate. The first MPLB component forwards the packets to a second MPLB component along a particular path in a network. A congestion metric for the particular path is determined. Based upon the congestion metric for the particular path, it is determined whether the particular path has reached a congestion threshold. In response to an affirmative determination, the source component is instructed to limit the rate at which it sends packets associated with the flow.

Methods and systems for determining a congestion metric for a path in a network are provided. According to one embodiment, multiple paths are provided between each pair of multi-path load balancing (MPLB) components within a Layer 2 network by establishing overlapping loop-free topologies in which each MPLB component is reachable by any other via each of the overlapping topologies. A first MPLB component associated with a first network device sends a latency request packet, including a first timestamp provided by a first clock associated with the first MPLB component, to a second MPLB component associated with a second network device via the path. Responsive thereto, the first MPLB component receives, from the second MPLB component, a latency response packet, including a second timestamp provided by a second clock associated with the second MPLB component. The first MPLB component derives a one-way latency value for the path based upon the timestamps.

Determining a congestion metric for a path in a network

Methods and systems for determining link failure in a network are provided. According to one embodiment, multiple paths are provided between each pair of multi-path load balancing (MPLB) components within a Layer 2 network by establishing overlapping loop-free topologies in which each MPLB component is reachable by any other via each loop-free topology. A first MPLB component sends latency requests to a second MPLB component via a particular path. Responsive thereto, the first MPLB component receives latency responses. Based on timestamp information in the latency responses, an estimated latency between the first and second MPLB components is determined. A link failure timeout period is derived based upon the estimated latency. An additional latency request is sent. If an additional latency response is not received by the first MPLB component prior to expiration of the link failure timeout period, then it is concluded that a link failure has occurred.

Determining link failure within a network

A mechanism is disclosed for enabling load balancing to be achieved in a network. In one implementation, load balancing is implemented on a 'per flow' basis. At the time that a new flow starts, a path is selected. Packets associated with the flow are thereafter sent along that particular path. As the packets associated with the flow are forwarded along the particular path, a congestion metric is determined for the particular path as well as for a set of one or more other paths. Based at least partially upon the congestion metrics, a determination is made as to whether the flow should be moved. If so, then the flow is moved to an alternate path. By determining the congestion metrics for the multiple paths, and by moving the flow in response, it is possible to adapt to changing traffic conditions to keep the loads on the paths relatively balanced.

Mechanism for implementing load balancing in a network

A mechanism is disclosed for enabling load balancing to be achieved in a loop-free switching path, reverse path learning network, such as an Ethernet network. The network is divided into a plurality of virtual networks, with each virtual network providing a different path through the network. When it comes time to send a set of information through the network, one of the plurality of virtual networks, and hence, one of the plurality of paths, is selected. The set of information is then updated to indicate the selected virtual network, and sent into the network to be transported along the selected path. With multiple paths, and with the ability to select between the multiple paths, it is possible to balance the load imposed on the multiple paths.

Mechanism for enabling load balancing to be achieved in a loop-free switching path, reverse path learning network

Methods and systems for shielding layer two host addresses (e.g., MAC addresses) from a network are provided. According to one embodiment, a border component of a network of switches receives a first packet intended for a first host having a first L2 address and a first L3 address associated therewith. The first packet includes the first L3 address and a substitute L2 address as destination addresses. The substitute L2 address is associated with a communication channel of the border component. A data structure including information regarding an association between the first L3 address and the first L2 address is accessed by the border component. A determination is made that the destination L2 address for the first packet should be the first L2 address. A first updated packet is derived from the first packet by replacing the substitute L2 address with the first L2 address and sent to the first host.

Growing community of inventors

Saratoga, CA, United States of America

Bert H Tanaka