Methods and apparatus for providing services in distributed switch

• US 10,129,182 B2
• Filed: 06/29/2012
• Issued: 11/13/2018
• Est. Priority Date: 06/29/2012
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Narayanaswamy, Krishna, Frailong, Jean-Marc, Venkatramani, Anjan, Jagannadhan, Srinivasan
• Primary Examiner(s): Nguyen, Dustin
• Application Number:
  US13/538,328
• Publication Number:
  US 20140006549A1
• Time in Patent Office: 2,328 Days
• Field of Search: 709217
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 49/25 Routing or path finding in a switch fabric
• CPC Class Codes: H04L 49/355 Application aware switches, e.g. for HTTP
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

In some embodiments, a non-transitory processor-readable medium stores code representing instructions to be executed by a processor. The code causes the processor to receive, at an edge device, a first data unit having a characteristic. The code causes the processor to identify, at a first time, an identifier of a service module associated with the characteristic in response to each entry from a set of entries within a flow table not being associated with the characteristic. The code causes the processor to define an entry in the flow table associated with the characteristic and the identifier of the service module. The code causes the processor to send the first data unit to the service module. The code causes the processor to receive, at the edge device, a second data unit having the characteristic, and send the second data unit to the service module based on the entry.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive, at an edge device, a first data unit having a first characteristic of a characteristic type, the first characteristic including information relating to the first data unit;

determine whether the first characteristic from the first data unit is associated with at least one of a plurality of identifiers of service modules stored in a flow table at the edge device, the flow table including a service module counter value for a first service module, the counter value being representative of usage of the first service module;

identify, at a first time, an identifier of the first service module to associate with a characteristic identifier code identifying the characteristic type of the first characteristic in response to each entry from a set of entries within the flow table not being associated with the characteristic identifier code for the first characteristic at the first time;

define an entry in the flow table associated with the characteristic identifier code for the first characteristic and the identifier of the service module in response to identifying the identifier of the first service module;

send the first data unit to the first service module in response to identifying the identifier of the first service module;

receive, at the edge device and at a second time after the first time, a second data unit having a second characteristic of the characteristic type, the second characteristic being associated with the characteristic identifier code;

map the characteristic identifier code to the identifier of the first service module using the entry in the flow table;

send the second data unit to the first service module based on the entry in the flow table and not a second service module when the service module counter value fails to satisfy a predetermined threshold; and

send the second data unit to the second service module based on the entry in the flow table and not the first service module when the service module counter value satisfies the predetermined threshold.

2. The non-transitory processor-readable medium of claim 1, wherein the first service module is associated with at least one of a security service or a load balancing service.

3. The non-transitory processor-readable medium of claim 1, wherein the first characteristic includes at least one of an identifier of a source peripheral processing device, an identifier of a destination peripheral processing device, a type of the first data unit, or a protocol associated with the first data unit.

4. The non-transitory processor-readable medium of claim 1, further comprising code to cause the processor to:

remove the entry from the flow table in response to not receiving a third data unit having the characteristic identifier code for the first characteristic within a predetermined time period after receiving the second data unit.

5. The non-transitory processor-readable medium of claim 1, wherein the code to cause the processor to identify includes code to cause the processor to identify the identifier of the first service module at the first time based on a hash function using at least one of an identifier of a source peripheral processing device, an identifier of a destination peripheral processing device, a type of the first data unit, or a protocol associated with the first data unit as an input.

6. The non-transitory processor-readable medium of claim 1, wherein the code to cause the processor to identify includes code to cause the processor to identify the identifier of the first service module based on a hash function, the code to cause the processor to send the second data unit includes code to cause the processor to send the second data unit to the first service module based on the entry and without using the hash function.

22. The non-transitory processor-readable medium of claim 1, the code further comprising code to cause the processor to update the service module counter for the first service module after the second data unit is sent to the first service module.

24. The non-transitory processor-readable medium of claim 1, wherein the counter value is a first counter value, the flow table further including a second service module counter value for the first service module, the second service module counter being representative of an accumulated number of data units that have been sent to the first service module for service during a specific period of time.

7. An apparatus, comprising:

an edge device configured to receive, from a first peripheral processing device, a first data unit, the edge device configured to identify an identifier of a first service module associated with a service to be provided on the first data unit by mapping a characteristic identifier associated with a characteristic associated with the first data unit to an entry in a flow table associated with the characteristic identifier and a first service module and stored at the edge device, the flow table including a first service module counter value for the first service module and a second service module counter value for the first service module, the first service module counter value being representative of a rate associated with usage of the first service module and the second service module counter value being representative of an accumulated number associated with the usage of the first service module, the characteristic identifier being header data related to the first data unit, the characteristic identifier being a code identifying a characteristic type, the characteristic associated with the first data unit being of the characteristic type, the edge device configured to send the first data unit to the first service module based on identifying the identifier of the first service module and at least one of the first service module counter value or the second service module counter value,

the edge device configured to receive, from a second peripheral processing device, a second data unit including a characteristic associated with the second data unit, a characteristic type associated with the second data unit corresponding to the characteristic type associated with the first data unit, the characteristic associated with the second data unit being associated with the characteristic identifier, the edge device configured to identify the identifier of the first service module associated with the service to be provided on the second data unit by mapping the characteristic identifier to the entry in the flow table with the characteristic identifier and the first service module stored at the edge device, the edge device configured to send the second data unit to a second service module different from the first service module based at least in part on the edge device sending the first data unit to the first service module.

8. The apparatus of claim 7, wherein the edge device is configured to send the first data unit to the first service module via a distributed switch fabric such that the first service module sends the first data unit to a third peripheral processing device via the distributed switch fabric.

9. The apparatus of claim 7, wherein the edge device is configured to receive the second data unit at a first time, the edge device configured receive a third data unit from the second peripheral processing device at a second time after the first time, the edge device configured to send the third data unit to the second service module based at least in part on the edge device sending the second data unit to the second service module.

10. The apparatus of claim 7, wherein the edge device is configured to store an association between the identifier of the first service module and the characteristic identifier in a flow table, the edge device configured to send the second data unit to the second service module and not the first service module based at least in part on the association.

11. The apparatus of claim 7, wherein the edge device is configured to store an association between the identifier of the first service module and the characteristic identifier in a flow table, the edge device configured to load balance data between a plurality of service modules including the first service module and the second service module based at least in part on the association.

12. The apparatus of claim 7, wherein the edge device is configured to receive, from the first peripheral processing device and during a time period, a plurality of data units including the first data unit, the edge device configured to receive the second data unit after the time period, the edge device configured to send the second data unit to the second service module and not the first service module based at least in part on a rate at which the edge device sends data units from the plurality of data units to the first service module.

13. The apparatus of claim 7, wherein the service is at least one of a security service or a load balancing service.

14. The apparatus of claim 7, wherein the characteristic associated with the first data unit includes at least one of an identifier of the first peripheral processing device, an identifier of a destination peripheral processing device, a type of the first data unit, or a protocol associated with the first data unit.

15. The apparatus of claim 7, wherein the second peripheral processing device is different from the first peripheral processing device.

16. The apparatus of claim 7, wherein the second peripheral processing device is the first peripheral processing device.

25. The apparatus of claim 7, wherein the flow table is stored at the edge device.

26. The apparatus of claim 7, wherein the flow table is stored at the first peripheral processing device.

17. An apparatus, comprising:

an edge device configured to receive a first data unit, the edge device configured to identify an identifier of a service module associated with a service to be provided on the first data unit by mapping a first characteristic identifier for a first characteristic associated with the first data unit to a first entry in a flow table associated with the service module and stored at the edge device, the flow table includes (1) a first counter value for the service module and associated with the first characteristic identifier, and (2) a second counter value for the service module associated with a second characteristic identifier and not the first characteristic identifier, the second characteristic identifier being associated with a second characteristic different form the first characteristic, the first counter value being representative of usage of the service module for data associated with the first characteristic identifier, the second counter value being representative of usage of the service module for data associated with the second characteristic identifier and not the first characteristic identifier, the first characteristic identifier being a code identifying a first type of characteristic, the second characteristic identifier being a code identifying a second type of characteristic different from the first type of characteristic, the edge device configured to send the first data unit to the service module such that the service module performs the service on the first data unit,

the edge device configured to receive, from the service module and in response to performing the service on the first data unit, an indication associated with the service provided on the first data unit, the edge device configured to receive a second data unit having the first characteristic identifier for the first characteristic, the edge device configured to perform the service on the second data unit in response to receiving the indication without sending the second data unit to the service module.

18. The apparatus of claim 17, wherein the edge device is configured to store an association between the first characteristic identifier for the first characteristic and the indication associated with the service in a flow table in response to receiving the indication, the edge device configured to perform the service on the second data unit in response to the association with the service.

19. The apparatus of claim 17, wherein the edge device is configured to send the first data unit to the service module via a distributed switch fabric such that the service module sends the first data unit to a peripheral processing device via the distributed switch fabric, the edge device configured to send the second data unit to the peripheral processing device via the distributed switch fabric without sending the second data unit to the service module.

20. The apparatus of claim 17, wherein the edge device is configured to store an association between the first characteristic identifier for the first characteristic and the indication associated with the service in a flow table in response to receiving the indication, the edge device configured to remove the association with the service between the first characteristic identifier for the first characteristic and the indication in response to the edge device not receiving data having the first characteristic identifier for the first characteristic for a predetermined time period.

21. The apparatus of claim 17, wherein the first characteristic includes at least one of an identifier of a source peripheral processing device, an identifier of a destination peripheral processing device, a type of the first data unit, or a protocol associated with the first data unit.

23. The apparatus of claim 17, wherein a value of the first characteristic identifier is 37, the first characteristic identifier indicating that the first characteristic associated with the first data unit is a destination peripheral processing device address.