Juniper Networks, Inc.

Hillstone Networks Corp.

Other

Dongyi Jiang

Jin Shang

Chih-Wei Chao

David Yu

Tsai-Zong Lin

Ye Zhang

Jun Xie

Jiaxiang Su

Qijun Yang

Michael Lin

Juxi Li

Linyang Shu

Krishna Narayanaswamy

Nitin Kumar

Nischal Sheth

Yong Tian

Raghavendra Mallya

Colby Barth

Xiao Ping Zhu

Haiyu Wang

Bhasker R Allam

Laxminarayana Tumuluru

Hua Ji

Anthony Ng

Daniel Hirschberg

Yu Jia

Jianwen K Pi

Yan Zhuang

Rakesh Nair

Jinfeng Yu

Jiangbo Nie

Rakesh Gopala Krishnan Nair

Sammy Chung

Mike Ji

Rakesh Nair Gopala Krishnan Nair

Anchung Chung

Xuefei Zhang

Panning Huang

A method for processing network data traffic includes obtaining a first distributed structure corresponding to a program based on a first storage structure, wherein the program is configured to process network data traffic; dividing a network device based on a second storage structure into a plurality of execution units, wherein the plurality of execution units is configured to execute the program; mapping the first distributed structure and the plurality of execution units to obtain a second distributed structure; and controlling the plurality of execution units to process network data traffic based on the second distributed structure.

Method and device for processing network data traffic based on distributed structure

A data center system includes: at least two data center subsystems interconnected through a layer-2 network, each of the data center subsystems comprising a plurality of hosts, a plurality of layer-2 switches connected with the plurality of hosts, a firewall group connected with the layer-2 switches, and a layer-2 extension device connected with the layer-2 switches; wherein the firewall groups of the at least two data center subsystems are configured to transmit synchronization information to each other through a synchronization channel in a first virtual local area network; wherein the layer-2 extension devices of the at least two data center subsystems are configured to transmit service information through a service channel in a second virtual local area network; and wherein the first virtual local area network and the second virtual local area network are implemented in the layer-2 network.

Data center system

A processing system includes: a first service machine having a first service module; and a first service switch; wherein the first service machine and the first service switch are configured for logically coupling between virtual machines and a virtual switch; wherein the first service machine comprises a first communication interface and a second communication interface, the second communication interface configured for communication with the first service switch. A processing system includes: a service module; a first communication interface for communication with a virtual switch, the virtual switch configured for communicating with virtual machines; a second communication interface for communication with the virtual switch; the first communication interface being associated with a plurality of VM-based network segments at the virtual switch, the plurality of VM-based network segments corresponding with the plurality of virtual machines, respectively; and wherein the second communication interface is associated with original network segments at the virtual switch.

Service insertion in basic virtual network environment

A device receives traffic; identifies an address associated with the traffic; determines whether the address is associated with an aggregate interface, the aggregate interface being associated with a first port and a second port. The first port corresponds to a first node in a first state, that indicates that the first node is available to forward the traffic, and the second port corresponds to a second node in a second state, that indicates that that the second node is not available to forward the traffic. The device transmits the traffic to the first node via the first port and to the second node, via the second port, when the address is associated with the aggregate interface. Transmitting the traffic enables the second node to forward the traffic when the first node changes from the first state to the second state.

Providing non-interrupt failover using a link aggregation mechanism

A method performed by a network appliance having a plurality of application processing units, includes: receiving a first packet at the network appliance; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a first application processing unit of the plurality of application processing units in the network appliance. A network appliance includes: a plurality of processing units that are communicatively connected to each other; wherein a first processing unit of the plurality of processing units is configured for: calculating a first value using a mathematical algorithm based on one or more information regarding a first packet; and using the calculated first value to identify a second processing unit of the plurality of processing units.

Distributed network firewall and flow-based forwarding system

A method performed by a network system having a plurality of processing units implemented using a plurality of respective virtual machines, includes: receiving a first packet at a first virtual machine of the plurality of virtual machines, wherein the first virtual machine is configured to receive the first packet from a network through an interface and has session processing capability; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a second virtual machine of the plurality of virtual machines in the network system.

Distributed virtual security appliance and flow-based forwarding system using virtual machines

In general, techniques are described for performing decentralized packet dispatch. A network device comprising one or more service processing units (SPUs) and an interface may implement the techniques. The interface receives a packet associated with a session and selects a first one of SPUs to dispatch the packet based on first information extracted from the packet. The first one of the SPUs dispatches the packet to a second one of the SPUs based on second information extracted from the packet. The second one of the SPUs performs first pass processing to configure the network security device to perform fast path processing of the packet such that second one of the SPUs applies one or more services to the packet and subsequent packets associated with the same session without application of services to the packets by the first one of the service processing units.

Decentralized packet dispatch in network devices

This disclosure is directed toward an integrated switching and routing security device that provides zone-based security directly between layer two (L2) interfaces of L2 bridge domains and/or layer three (L3) interfaces of L3 routing instances within the security device. The integrated switching and routing security device supports both switching and routing functionalities for packets on L2 and L3 interfaces, and supports security within and between L2 bridge domains and L3 routing instances. The integrated switching and routing security device configures L2 security zones for one or more L2 interfaces and configures L3 security zones for one or more L3 interfaces. The integrated switching and routing security device then applies security policies to incoming packets according to the L2 security zones and/or the L3 security zones associated with the incoming interface and an outgoing interface for the packets to provide end-to-end security within the security device.

Fully integrated switching and routing in a security device

In general, techniques are for providing a direct forwarding path between virtual routers within a single virtualized routing system. In one example, a method includes combining forwarding information from a plurality of virtual routers into collapsed forwarding information that comprises one or more direct forwarding paths between the respective virtual routers. The method also includes determining a direct forwarding path to an egress interface of the second virtual router, in response to receiving a network packet at an ingress interface of a first virtual router. The method also includes forwarding the network packet from the ingress interface of the first virtual router to the egress interface of the second virtual router using the direct forwarding path, wherein the network packet traverses a switch fabric directly from the ingress interface of the first virtual router to the egress interface of the second virtual router.

Traffic cut-through within network device having multiple virtual network devices

A device may reserve a slot for a received packet in a packet ordering queue (POQ), convey the packet to one of a plurality of threads for processing, obtain the packet from the one of the plurality of threads after the packet has been processed, organize the packet in the POQ in accordance with a position of the reserved slot, and release the packet from the POQ if the reserved slot is a head of the POQ.

Sequencing packets from multiple threads

A network device connects between a client and a server. The network device is configured to store information regarding a capability of the server; receive a first message, from the client, intended for the server; obtain the stored information regarding the capability of the server; generate a second message that includes the information regarding the capability of the server; send the second message to the client; receive a third message from the client; and establish, based on the third message, a connection between the client and the server.

Using a server's capability profile to establish a connection

In general, techniques are described for dynamically managing weighted queues. In accordance with the techniques, a network security device comprises a queue management module that assigns, for each queue of a plurality of queues, a quota desirable to a user that a processor of the network security device consumes to service each queue. The queue management module determines, based on the desirable quotas, a queue weight for each queue and computes. Based on the computation, the queue management module dynamically adjusts one or more of the weights such that subsequent amounts of processing time actually required to process the number of packets defined by each of the queue weights more accurately reflects the desirable quotas assigned to each of the queues. The network device outputs the number of packets in accordance with the adjusted weights.

Packet forwarding using feedback controlled weighted queues dynamically adjusted based on processor utilization

A method may be performed by a device in a network, the device including multiple security process units (SPUs). The method includes receiving a packet over the network, the packet including a media access control (MAC) address, and assigning one SPU as the MAC address owner. The method also includes sending information about the MAC address to other SPUs within the device, storing the MAC address in a MAC table within each SPU, and initiating a MAC age query to confirm the MAC address has timed out among all SPUs. The MAC age query is passed via a logical ring of the SPUs beginning with the MAC address owner. If the MAC address is aged out at each SPU, the MAC address is deleted from each MAC table. If the MAC entry is still active, a different SPU is assigned as the MAC address owner.

Cooperative MAC learning/aging in highly distributed forwarding system

A device may receive packets for a system and obtain a packet drop rate of the system, a processor utilization rate of the system, and a target processor utilization rate of the system. In addition, the device may determine a target packet drop rate based on the packet drop rate, the processor utilization rate, and the target processor utilization rate. The device may drop a portion of the packets in accordance with the packet drop rate.

Growing community of inventors

Milpitas, CA, United States of America

Dongyi Jiang