Citrix Systems, Inc.

Ranjith Nath

Sandhya Gopinath

Abhishek Chauhan

Sathaiah Dontula

Vivekanand Rangaraman

Venkata Subba Rao Gorrepati

Jubin Jose

Disclosed herein includes a system, a method, and a device for preventing replay attacks in a cluster. A first node in the cluster having a plurality of nodes can receive an indication of a node event. The first node can access a first sequence number from a storage corresponding to a previous communication between the plurality of nodes. The first node can adjust the first sequence number by a delta indicative of an average number of communications between the plurality of nodes in the cluster in a determined time period to generate a second sequence number. The first node can transmit a packet including the second sequence number to the plurality of nodes in the cluster. The second sequence number can be used by the plurality of nodes to reset a starting sequence number for communications between the plurality of nodes to prevent replay attacks in the cluster.

Systems and methods for preventing replay attacks

Described embodiments provide systems and methods for pushing session information to a newly joined node in a cluster of nodes. In the cluster, each node may maintain a session table of existing sessions. One or more nodes may detect a new node has joined the cluster. Each node, responsive to the detection, may apply a hash function on a tuple of each session of the existing sessions in the session table of the node to determine whether one or more existing sessions are identified to be owned by the new node as a result of the hash function. Each node, responsive to identifying that one or more sessions are to be owned by the new node, may push corresponding session information to the new node. The new node may become configured to receive a packet corresponding to the one or more sessions and to process the packet.

Systems and methods to retain existing connections so that there is no connection loss when nodes are added to a cluster for capacity or when a node is taken out from the cluster for maintenance

In the present solution, when a cluster node sends an Address Resolution Protocol (ARP) request for an external internet protocol (IP), the node sends a message to all the other nodes, which are part of the Cluster Link Aggregation (CLAG) to expect an ARP reply for the IP. When a node in the cluster receives the ARP reply, the node informs the other nodes which are part of the same CLAG to update the Machine Access Control (MAC) address. Also when an ARP entry is learned/updated over a CLAG link as part of an ARP request/Gratuitous ARP, the node learning/updating the ARP entry will inform other nodes which are part of the same CLAG about the learned/updated ARP entry. Nodes in a cluster may communicate between with each other over a dedicated backplane, which may be a separate physical medium.

Systems and methods for address resolution protocol (ARP) resolution over a link aggregation of a cluster channel

In the present solution, when a cluster node sends an ARP request for an external IP, the node sends a message to all the other nodes, which are part of the CLAG to expect an ARP reply for the IP. When a node in the cluster receives the ARP reply, the node informs the other nodes which are part of the same CLAG to update the MAC address. Also when an ARP entry is learned/updated over a CLAG link as part of an ARP request/Gratuitous ARP, the node learning/updating the ARP entry will inform other nodes which are part of the same CLAG about the learned/updated ARP entry. Nodes in a cluster may communicate between with each other over a dedicated backplane, which may be a separate physical medium.

Systems and methods for ARP resolution over an asynchronous cluster network

While each node in a cluster of nodes sources connections with the same IP if each node allocates a port on this IP independently, there may be port clashes. Also, the return traffic is not guaranteed to hit the originating node. These issues are addressed by allocating a port in such a way that the response traffic hashes back to the originating node. A good hash is chosen such that the ports are equally divided among the nodes. When a node leaves, the other nodes take over the port range used by this node. When a node joins, the node takes back its share of ports.

Systems and methods for supporting IP ownership in a cluster

The present application is directed towards systems and methods for distributing traffic across nodes of a cluster of intermediary devices through distributed flow distribution (DFD). Upon receipt of network traffic, a cluster node, such as an intermediary computing device or appliance, may internally steer a portion of the traffic via an inter-node communications backplane to one or more other nodes in the cluster so that the load is equally handled by all of the nodes in the cluster. A cluster node may determine whether to process the traffic steered via the backplane by computing a hash of packet parameters of the network traffic. Hash keys may be selected such that uniformity is assured, and the key used in hash computation may be synchronized across all of the nodes so that only one node determines that it should process the particular packets or traffic flow.

Growing community of inventors

Karnataka, India

Ranjith Nath