Cisco Technology, Inc.

Embrane, Inc.

Marco Di Benedetto

Umesh Mahajan

Ramana Mellacheruvu

Claudio Desanti

Thomas Vincent Flynn

Fabio Rodolfo Maino

Silvano Gai

Pierluigi Rolando

Vijay K Chander

Alessandro Salvatori

Norman William Finn

Chandan Mishra

Claudio DeSanti

Ankur Jain

Arthur Lihder Chang

Dante Malagrino

Thomas John Nosella

Mario Baldi

Chengelpet Ramesh

Hei Tao Fung

Alagu Annaamalai

Sunil Kumar

Sridhar Aswathnarayan

John B McEwan

Alessandro Carpi

Mrinal Baruah

John B Mcewan

Alessandro Carip

Methods and apparatus are provided for improving both node-based and message-based security in a fiber channel network. Entity to entity authentication and key exchange services can be included in existing initialization messages used for introducing fiber channel network entities into a fiber channel fabric, or with specific messages exchanged over an already initialized communication channel. Both per-message authentication and encryption mechanisms can be activated using the authentication and key exchange services. Messages passed between fiber channel network entities can be encrypted and authenticated using information provided during the authentication sequence. Security services such as per-message authentication, confidentiality, integrity protection, and anti-replay protection can be implemented.

Methods and apparatus for security over fibre channel

Passing data over virtual links is disclosed, including: encapsulating a layer three data packet as an inner payload of a network data packet; and generating an outer header of the network data packet with a layer two header and a layer three header, wherein the network data packet is configured to communicate over a virtual link between a first interface of a first network appliance and a first interface of a second network appliance.

Passing data over virtual links

Creating virtual links including: determining a first network appliance to configure to communicate with a second network appliance using a virtual link, wherein the virtual link comprises a layer three overlay point-to-point data link; and determining the second network appliance to configure to communicate with the first network appliance using the virtual link.

Virtual links for network appliances

A distributed virtual appliance is disclosed, including: determining a classification type associated with the first flow; and determining an allocation of the first flow to the first data plane compute unit of the distributed virtual appliance based at least in part on the determined classification type and at least a subset of information of a first flow identifier, wherein the distributed virtual appliance includes a plurality of compute units, including the first data plane compute.

Distributed virtual appliance

VLAN tagging in a virtual environment is described, including configuring a set of VLAN tagging parameters for each virtual network device to be used by the virtual network device to correctly perform VLAN tagging of frames in response to configuration changes with respect to the virtual network device. A first example of a configuration change with respect to the virtual network device comprises the virtual network device being transitioned from being attached to a virtual switch tagging (VST) port group to being attached to a virtual guest tagging (VGT) port group. A second example of a configuration change with respect to the virtual network device comprises the virtual network device being migrated from a first host to a second host.

VLAN tagging in a virtual environment

Providing a shared interface among a plurality of compute units is disclosed. A plurality of compute units is determined and a shared interface for the plurality of compute units is provided, wherein incoming traffic is received by any of the plurality of compute units. Also, the packet is received at the shared interface for a plurality of compute units. The packet is encapsulated using a first header, wherein the first header specifies one of the plurality of compute units, and wherein the one of the plurality of compute units is selected independent of an interface address associated with the shared interface.

Shared interface among multiple compute units

Creating virtual links is disclosed, including: determining a first network appliance to configure to communicate with a second network appliance using a virtual link, wherein the virtual link comprises a layer three overlay point-to-point data link; and determining the second network appliance to configure to communicate with the first network appliance using the virtual link.

In one embodiment, a Fibre Channel over Ethernet (FCoE) proxy point (FPP) that is connected to one or more end-point devices is coupled to one or more other FPPs, and to a FCoE control and management plane (F-CMP) server. The FPP provides data plane functionality. The F-CMP server provides control plane functionality. At least some control and management traffic received at the FPP is proxied between the F-CMP server and the one or more end point devices connected to the FPP. FCoE traffic received at the FPP from the one or more end point devices connected to the FPP is transmitted to the one or more other FPPs without the FCoE traffic traversing the F-CMP server. The transmitting is performed by data plane functionality of the FPP operating under directions from the control plane functionality of the F-CMP server.

End-to end fibre channel over ethernet

A distributed virtual appliance is disclosed, including: allocating network traffic to a plurality of compute units implementing a network service associated with the distributed virtual appliance; and dynamically adding or removing one or more compute units implementing the network service without disruption to the network traffic.

In one embodiment, one or more Fiber Channel over Ethernet (FCoE) proxy points (FPPs) communicates control and management information with a separately housed FCoE control and management plane (F-CMP) server in order to direct data plane functionality of the FPPs. Each FPP also proxies control and management protocols between the F-CMP server and one or more FCoE end-point devices for which the FPP is responsible (on FCoE ports). Traffic received by the FPP may then be processed according to the directed data plane functionality, such that FCoE traffic transmitted between first and second FCoE end-point devices separated by the Ethernet network is directed over the Ethernet network end-to-end between correspondingly responsible FPPs without traversing the F-CMP server.

End-to-end fibre channel over ethernet

Methods and devices are provided for role-based access control of network devices. The network devices may constitute the fabric of a storage area network ('SAN') that has been logically partitioned into virtual storage area networks ('VSANs') that are allocated to various administrators. Roles assigned according to preferred aspects of the invention do not need to be hierarchical, but are customized according to administrators' needs.

Method and apparatus for role-based access control

In one embodiment, a method includes defining a virtual node port proxy and virtual fabric port proxies at a Fiber Channel over Ethernet (FCoE) bridge, the virtual node port proxy in communication with an FCoE forwarder, each of the virtual fabric port proxies in communication with an FCoE node in an FCoE network. The method further includes proxying FCoE Initialization Protocol (FIP) functions between the FCoE nodes and the FCoE forwarder at the FCoE bridge. An apparatus is also disclosed.

Ethernet node port virtualizer

A multiple instance spanning tree protocol (MI-STP) creates a plurality of active topologies (i.e., loop-free paths) within a computer network. These active topologies may be established through the exchange and processing of multiple instance spanning tree bridge protocol data unit messages (MI-STP BPDUs) by the intermediate network devices within the network. The active topologies are preferably created independently of any virtual local area network (VLAN) designations defined within the network. Once the active topologies are defined, each VLAN designation is then mapped to a single active topology, although multiple VLAN designations are preferably mapped to the same active topology to provide load balancing.

Growing community of inventors

Santa Clara, CA, United States of America

Marco Di Benedetto