Brocade Communications Systems, Inc.

Foundry Networks, Inc.

Nutanix, Inc.

Sridhar J Devarapalli

Mani Kancherla

David B Cheung

Louis Yun

Deepak Bansal

Yan-Zhe Wang

Sean Hou

Sam Htin Moy

Prajakta S Joshi

Mehrdad Hamadani

Rajkumar Ramniranjan Jalan

Bing Wang

Ravikanth Samprathi

David Chun Ying Cheung

Rajesh P Bhatt

Ronald W Szeto

Ken Chen

Viraj Sapre

Julie Ni

Steenivasulu Malli

Avinash Jindal

Sreenivasulu Malli

A request to create a set of security policies for an application is received at a graphical user interface. Information identifying a set of source VMs, a set of destination VMs, and a set of target VMs also are received, wherein the target VMs are executing the application and are supported by (a) node(s) in a clustered virtualization environment. A set of inbound rules identifying (a) category(ies) of source VMs permitted to initiate connections with a subset of target VMs and a set of outbound rules identifying (a) category(ies) of destination VMs to which the subset of target VMs are permitted to initiate connections are received at the graphical user interface. Upon receiving a request to apply the security policies, the policies are configured based at least in part on the inbound and outbound rules and a visual representation of the security policies is presented in the graphical user interface.

Creation of security policies using a visual approach

A network device includes a plurality of blades, each having a plurality of CPU cores that process requests received by the network device. Each blade further includes an accumulator circuit. Each accumulator circuit periodically aggregates the local counter values of the CPU cores of the corresponding blade. One accumulator circuit is designated as a master, and the other accumulator circuit(s) are designated as slave(s). The slave accumulator circuits transmit their aggregated local counter values to the master accumulator circuit. The master accumulator circuit aggregates the sets of aggregated local counter values to create a set of global counter values. The master accumulator circuit transmits the global counter values to a management processor (for display), to the CPU cores located on its corresponding blade, and to each of the slave accumulator circuits. Each slave accumulator circuit then transmits the global counter values to the CPU cores located on its corresponding blade.

Load balance connections per server in multi-core/multi-blade system

Stateful failover redundancy support is provided for network address translation (NAT). A master NAT device is backed-up with at least one back-up NAT device. Existing sessions are synchronized between the two NAT devices, such as via a dedicated link between them. In the event of a failover where the master NAT device is unable to perform its NAT functions, ownership of Internet protocol (IP) addresses is transferred from the master NAT device to the back-up NAT device. The back-up NAT device, which is now owner of the IP addresses, assumes the NAT functionality associated with these IP addresses and continues the existing sessions, as well as processing new sessions.

Redundancy support for network address translation (NAT)

Techniques are provided to enable a network device, such as a switch, to perform global server load balancing (GSLB) while operating as a proxy to a domain name system security extensions (DNSSEC)-capable authoritative DNS server. The network device preserves an original signature generated by the DNSSEC-capable authoritative DNS server for a resource record set contained in a DNSSEC reply.

Domain name system security extensions (DNSSEC) for global server load balancing

A multi-processor architecture for a network device that includes a plurality of barrel cards, each including: a plurality of processors, a PCIe switch coupled to each of the plurality of processors, and packet processing logic coupled to the PCIe switch. The PCIe switch on each barrel card provides high speed flexible data paths for the transmission of incoming/outgoing packets to/from the processors on the barrel card. An external PCIe switch is commonly coupled to the PCIe switches on the barrel cards, as well as to a management processor, thereby providing high speed connections between processors on separate barrel cards, and between the management processor and the processors on the barrel cards.

Multi-processor architecture using multiple switch fabrics implementing point-to-point serial links and method of operating same

Transaction rate limiting is provided to monitor new connections. If the number of new connections requested by a particular client exceeds a predetermined threshold value, then the client may be frozen out for a configured period of time. By denying access for the configured period of time, the client is prevented from monopolizing a particular client. Additionally, if the client does have malicious intent, a denial of service attack may be thwarted. The denial of service may be accomplished without alerting the client. This prevents a malicious client from regrouping and attempting an assault via a different mechanism.

Transaction rate limiting

Web-based authentication includes receiving a packet in a network switch having at least one associative store configured to forward packet traffic to a first one or more processors of the switch that are dedicated to cryptographic processing if a destination port of the packet indicates a secure transport protocol, and to a second one or more processors of the switch that are not dedicated to cryptographic processing if the destination port does not indicate a secure transport protocol. If a source of the packet is an authenticated user, the packet is forwarded via an output port of the switch, based on the associative store. If the source is an unauthenticated user, the packet is forwarded to the first one or more processors if the destination port indicates a secure transport protocol, and to the second one or more processors if the destination port does not indicate a secure transport protocol.

Scalable distributed web-based authentication

Multi-processor architecture implementing a serial switch and method of operating same

Growing community of inventors

Sunnyvale, CA, United States of America

Sridhar J Devarapalli