Cisco Technology, Inc.

Thomas John Nosella

Thomas James Edsall

Fabio Rodolfo Maino

Chandan Mishra

Marco Di Benedetto

Marco Foschiano

Michael Fine

Ankur Jain

Ian Herbert Wilson

Methods and devices are provided for role-based access control of network devices. The network devices may constitute the fabric of a storage area network ('SAN') that has been logically partitioned into virtual storage area networks ('VSANs') that are allocated to various administrators. Roles assigned according to preferred aspects of the invention do not need to be hierarchical, but are customized according to administrators' needs.

Method and apparatus for role-based access control

Gateway load balancing and failover methods, apparatus and systems use more than one gateway device in a gateway device group for communications directed outside of a LAN. In the load balancing arrangement, hosts that send ARP messages to a shared virtual IP address receive replies from one of the gateway devices in the gateway device group, directing the host to address outgoing communications to a virtual MAC address assigned to one of the gateway devices. Hosts are assigned virtual MAC addresses for the gateway devices according to a prescribed algorithm or methodology. In the event that one member of the gateway device group fails, the outgoing communications that would have been handled by the failed gateway device are re-assigned to another member of the gateway device group. A master gateway device controls address assignment and failover features. In the event that the master fails, additional steps are taken to appoint or elect a new master and ensure continuity in the load balancing function.

Gateway load balancing protocol

Methods and devices are provided for simulating a direct failure between a network device and an end device. In some implementations, the network device is a gateway of a first network and the end device is a host or a storage device on the first network. In some implementations, the network device includes a linked interface, the administrative and/or operational state of which is determined by the operational state of one or more tracked interfaces. The tracked interfaces may be in the same network device or other network devices, and may be physical or virtual. In some such implementations, when a tracked interface fails, the linked interface will bring down a link between the network device and the end device, thereby causing a switchover to a redundant path. Other implementations involve direct notification of the network device that the link has failed or is about to fail.

Methods and devices for high network availability

The invention uses a layer 2 switch (L2 switch), or bridge, to separate user's message traffic by use of Virtual Local Area Networks (VLANs) defined within the switch. Three new types of ports are defined, 'promiscuous' ports 'isolated' ports, and &#x201c;community&#x201d; ports. Three types of VLANs internal to the switch are defined, &#x201c;primary&#x201d; VLANs, &#x201c;isolated&#x201d; VLANs and &#x201c;community&#x201d; VLANs. The promiscuous ports are connected to layer 3 or layer 4 devices. Isolated ports and community ports are connected to individual user's servers, etc., and maintain traffic for each user separate from other users. The primary VLAN connects to all promiscuous ports, to all isolated ports, and to all community ports. The primary VLAN is a one way connection from promiscuous ports to isolated or community ports. An isolated VLAN connects to all promiscuous ports and to all isolated ports. The isolated VLAN is a one way connection from an isolated port to the promiscuous ports. A community VLAN is defined as connecting to a group of community ports, and also connecting to all of the promiscuous ports. The group of community ports is referred to as a &#x201c;community&#x201d; of community ports. A community VLAN is a one way connection from a community of ports to the promiscuous ports, but allows a packet received by one community port to be transmitted out of the switch, through the other community ports connected to that community VLAN.

Private VLANs

The invention uses a layer switch (L switch), or bridge, to separate user's message traffic by use of Virtual Local Area Networks (VLANs) defined within the switch. Three new types of ports are defined, &ldquo;promiscuous&rdquo; ports &ldquo;isolated&rdquo; ports, and &ldquo;community&rdquo; ports. Three types of VLANs internal to the switch are defined, &ldquo;primary&rdquo; VLANs, &ldquo;isolated&rdquo; VLANs and &ldquo;community&rdquo; VLANs. The promiscuous ports are connected to layer or layer devices. Isolated ports and community ports are connected to individual user's servers, etc., and maintain traffic for each user separate from other users. The primary VLAN connects to all promiscuous ports, to all isolated ports, and to all community ports. The primary VLAN is a one way connection from promiscuous ports to isolated or community ports. An isolated VLAN connects to all promiscuous ports and to all isolated ports. The isolated VLAN is a one way connection from an isolated port to the promiscuous ports. A community VLAN is defined as connecting to a group of community ports, and also connecting to all of the promiscuous ports. The group of community ports is referred to as a &ldquo;community&rdquo; of community ports. A community VLAN is a one way connection from a community of ports to the promiscuous ports, but allows a packet received by one community port to be transmitted out of the switch, through the other community ports connected to that community VLAN.

Growing community of inventors

San Jose, CA, United States of America

Thomas John Nosella