Cisco Technology, Inc.

Rajendra Kumar Thirumurthi

Samar Sharma

Mouli Vytla

Ashish Purushottam Attarde

Praveen Parthasarathy Iyengar

Sachin Vijay Vishwarupe

Puneet Kumar

Kushal A Patel

Anand Akella

Vivek Purushotham

Krishna Bharadwaj Dharwada

Anand V Akella

A method of managing security rules may include extracting metadata from a data packet received at a first network device. The metadata including network metadata and network system metadata. The method may further include distributing the metadata to at least one service endpoint registered with the first network device, receiving from the at least one service endpoint, an indication as to how traffic associated with the data packet is to be handled, and enabling the traffic based at least in part on feedback received from the at least one service endpoint and creating a first service flow hash entry of a hash table associated with the data packet at the first network device. The first service flow hash entry identified each of a number of services using a unique number. The method may further include distributing the hash table including the first service flow hash entry across a fabric to at least a second network device.

Dynamic management of security rules and policies

In an example, a network switch is configured to natively act as a high-speed load balancer. Numerous load-balancing techniques may be used, including one that bases the traffic 'bucket' on a source IP address of an incoming packet. This particular technique provides a network administrator a powerful tool for shaping network traffic. For example, by assigning certain classes of computers on the network particular IP addresses, the network administrator can ensure that the traffic is load balanced in a desirable fashion. To further increase flexibility, the network administrator may apply a bit mask to the IP address, and expose only a portion, selected from a desired octet of the address.

Adjustable bit mask for high-speed native load balancing on a switch

In one embodiment, load balancing criteria and an indication of a plurality of network nodes is received. A plurality of forwarding entries are created based on the load balancing criteria and the indication of the plurality of nodes. A content addressable memory of a network element is programmed with the plurality of forwarding entries. The network element selectively load balances network traffic by applying the plurality of forwarding entries to the network traffic, wherein network traffic meeting the load balancing criteria is load balanced among the plurality of network nodes.

Selective load balancing of network traffic

In an example, a network switch is configured to operate natively as a load balancer. The switch receives incoming traffic on a first interface communicatively coupled to a first network, and assigns the traffic to one of a plurality of traffic buckets. This may include looking up a destination IP of an incoming packet in a fast memory such as a ternary content-addressable memory (TCAM) to determine whether the packet is directed to a virtual IP (VIP) address that is to be load balanced. If so, part of the source destination IP address may be used as a search tag in the TCAM to assign the incoming packet to a traffic bucket or IP address of a service node.

TCAM-based load balancing on a switch

Embodiments include receiving configuration information including a match criterion for packets received at a network device in a network and a pool of layer 3 addresses associated with a set of servers in the network, resolving layer 2 destination addresses based on the layer 3 addresses of the servers, and programming a hardware layer of the network device based, at least in part, on the match criterion, the pool of layer 3 addresses, and the layer 2 destination addresses. Specific embodiments include configuring a policy to indicate that packets from an external source are to be forwarded to a server of the set of servers. Further embodiments include receiving a packet at the network device, and matching the packet to the pool of layer 3 addresses and the resolved layer 2 addresses based, at least in part, on the match criterion programmed in the hardware layer.

Scalable network address translation at high speed in a network environment

In an example, there is disclosed a network apparatus, comprising: one or more logic elements, including at least one hardware logic element, to provide a network manager engine to: provide a switched fabric management function; communicatively couple to at least one network switch, the network switch configured to provide optional native hardware-based load balancing; monitor one or more load balancing factors; and at least partly responsive to the one or more load balancing factors, configure native hardware-based load balancing on the at least one network switch.

Load balancing mobility with automated fabric architecture

In an example, there is provided a network apparatus for providing native load balancing within a switch, including a first network interface operable to communicatively couple to a first network; a plurality of second network interfaces operable to communicatively couple to a second network, the second network comprising a service pool of service nodes; one or more logic elements providing a switching engine operable for providing network switching; and one or more logic elements comprising a load balancing engine operable for: load balancing incoming network traffic to the service pool via native hardware according to a load balancing configuration; detecting a new service node added to the service pool; and adjusting the load balancing configuration to account for the new service node; wherein the switching engine and load balancing engine are configured to be provided on the same hardware as each other and as the first network interface and plurality of second network interfaces.

Adaptive load balancing

In accordance with one example embodiment, a system configured for providing multifunctional switching is disclosed. The system is configured for filtering at least some incoming traffic to select network packets originating from one or more predefined sources and destined to a predefined destination, load balancing at least some of the selected network packets among a plurality of server nodes to assign each network packet to one server node of the plurality of server nodes, for each network packet assigned to one server node of the plurality of server nodes replacing a destination address of the predefined destination with a destination address of the assigned server node, and forwarding the each network packet assigned to one server node in accordance with the replaced destination address in the network packet.

Multifunctional network switch

A method is described and in one embodiment includes, for each of a plurality of outgoing ports of a first network element: collecting data comprising a number of packets arriving the outgoing port and an amount of power consumed by the outgoing port for a first time interval; calculating a packet per watt ('P/W') metric for the port for the first time interval, wherein the P/W metric comprises the number of packets coming into the port divided by the amount of power consumed by the port during the first time interval; repeating the collecting and calculating for a number of successive time intervals; calculating a mean P/W metric for a time period comprising the first time interval and the successive time intervals; and calculating a variance for the time period comprising the first time interval and the successive time intervals. The method further includes redirecting traffic received at the network element to the outgoing port having the lowest variance.

Power aware switching using analytics

A network apparatus for providing native load balancing within a switch, including: a first network interface operable to communicatively couple to a first network; a plurality of second network interfaces operable to communicatively couple to a second network; one or more logic elements providing a switching engine operable for providing network switching or routing; and one or more logic elements providing a load balancing engine operable for: load balancing network traffic among a plurality of service nodes; probing a first service node; determining that the first service node is unavailable; and reassigning the buckets associated with the first service node to a next available service node.

Growing community of inventors

Cupertino, CA, United States of America

Rajendra Kumar Thirumurthi