Methods and apparatus related to a flexible data center security architecture

• US 10,454,849 B2
• Filed: 05/25/2018
• Issued: 10/22/2019
• Est. Priority Date: 09/11/2008
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Sindhu, Pradeep, Aybay, Gunes, Frailong, Jean-Marc, Venkatramani, Anjan, Vohra, Quaizar
• Primary Examiner(s): Duong, Duc T
• Application Number:
  US15/990,102
• Publication Number:
  US 20180278547A1
• Time in Patent Office: 515 Days
• Field of Search: None
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0846 based on copy from other elements
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/0897 by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities
• CPC Class Codes: H04L 49/257 Cut-through or wormhole routing
• CPC Class Codes: H04L 49/30 Peripheral units, e.g. input or output ports
• CPC Class Codes: H04L 49/35 Switches specially adapted for specific applications
• CPC Class Codes: H04L 49/356 for storage area networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

In one embodiment, edge devices can be configured to be coupled to a multi-stage switch fabric and peripheral processing devices. The edge devices and the multi-stage switch fabric can collectively define a single logical entity. A first edge device from the edge devices can be configured to be coupled to a first peripheral processing device from the peripheral processing devices. The second edge device from the edge devices can be configured to be coupled to a second peripheral processing device from the peripheral processing devices. The first edge device can be configured such that virtual resources including a first virtual resource can be defined at the first peripheral processing device. A network management module coupled to the edge devices and configured to provision the virtual resources such that the first virtual resource can be migrated from the first peripheral processing device to the second peripheral processing device.

Claims

1. A method, comprising:

sending a signal to provision a plurality of virtual resources at a plurality of peripheral processing devices coupled to a plurality of edge devices having a first plurality of ports coupled to a multi-stage switch fabric and having a second plurality of ports coupled to the plurality of peripheral processing device, and

sending a signal to migrate a virtual resource from the plurality of virtual resources and defined at a first peripheral processing device from the plurality of peripheral processing devices to a second peripheral processing device from the plurality of peripheral processing devices.

2. The method of claim 1, further comprising:

receiving a signal including topology information associated with at least one of a peripheral processing device from the plurality of peripheral processing devices, an edge device from the plurality of edge devices, or the multi-stage switch fabric,

at least one of the signal to provision or the signal to migrate being based on the topology information.

3. The method of claim 1, wherein sending the signal provision the plurality of virtual resources is sent to the plurality of edge devices via the multi-stage switch fabric to provision the second plurality of ports.

4. The method of claim 1, further comprising:

receiving, before sending the signal to provision, operating state and location of the plurality of virtual resources,

at least one of the signal to provision or the signal to migrate being based on operating state of the plurality of virtual resources.

5. The method of claim 1, wherein a number of ports in the second plurality of ports for the plurality of edge devices is at least 1,000 ports.

6. The method of claim 1, wherein a number of ports in the second plurality of ports for the plurality of edge devices is at least 100,000 ports.

7. The method of claim 1, wherein a number of ports in the first plurality of ports for the plurality of edge devices is less than a number of ports in the second plurality of ports of the plurality of edge devices.

8. The method of claim 1, further comprising:

sending a signal to provision the plurality of virtual resources such that a virtual resource from a plurality of virtual resources from each peripheral processing device can be moved from that peripheral processing device to at least the remaining peripheral processing device from the plurality of peripheral processing devices.

9. The method of claim 1, wherein the plurality of edge devices and the multi-stage switch fabric collectively are configured to provide connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that congestion at the first virtual resource is isolated from data traffic sent to and received from a second virtual resource at the first peripheral processing device.

10. The method of claim 1, wherein the plurality of edge devices and the multi-stage switch fabric collectively are configured to provide connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that congestion at the first virtual resource is isolated from data traffic sent to and received from a second virtual resource at the second peripheral processing device.

11. A method, comprising:

receiving, at an edge device from a plurality of edge devices, a signal to provision a plurality of virtual resources at a plurality of peripheral processing devices coupled to the plurality of edge devices, the plurality of edge devices having a first plurality of ports coupled to a multi-stage switch fabric and having a second plurality of ports coupled to the plurality of peripheral processing device; and

sending a signal to migrate a virtual resource from the plurality of virtual resources and defined at a first peripheral processing device from the plurality of peripheral processing devices to a second peripheral processing device from the plurality of peripheral processing devices.

12. The method of claim 11, further comprising:

sending a signal including topology information associated with at least one of a peripheral processing device from the plurality of peripheral processing devices, an edge device from the plurality of edge devices, or the multi-stage switch fabric,

at least one of the signal to provision or the signal to migrate being based on the topology information.

13. The method of claim 11, wherein receiving the signal to provision the plurality of virtual resources is received via the multi-stage switch fabric to provision the second plurality of ports.

14. A method, comprising:

receiving, at a plurality of edge devices, data traffic from a plurality of virtual resources defined at a plurality of peripheral processing devices coupled to a plurality of edge devices that have (1) a first plurality of ports coupled to a multi-stage switch fabric and (2) a second plurality of ports coupled to the plurality of peripheral processing devices; and

sending, from an edge device from the plurality of edge devices, data traffic through the multi-stage switch fabric such that the data traffic is isolated from data traffic sent from the remaining virtual resources from the plurality of virtual resources associated with the remaining edge devices from the plurality of edge devices.

15. The method of claim 14, wherein the multi-stage switch fabric provides connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that each virtual resource from the plurality of virtual resources is equitably accessible by each remaining virtual resource from the plurality of virtual resources.

16. The method of claim 14, wherein:

the plurality of edge devices includes a first edge device, and the plurality of virtual resources including a first virtual resource and a second virtual resource to which the first edge device is coupled,

the multi-stage switch fabric provides connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that congestion at the first virtual resource does not affect data traffic sent to and received from the second virtual resource.

17. The method of claim 14, wherein the multi-stage switch fabric is a deterministic network that admits a plurality of cells associated with a packet from an edge device from the plurality of edge devices when delivery within the switch fabric of the plurality of cells can be substantially guaranteed without loss through the multi-stage switch fabric.

18. The method of claim 14, wherein the plurality of peripheral processing devices includes a first peripheral processing device that communicates with a fiber channel protocol and a second peripheral processing device that communicates with a fiber-channel-over-Ethernet protocol.

19. The method of claim 14, wherein the plurality of edge devices includes a first edge device having a plurality of queues, the method further comprising:

providing flow control on a per queue basis, each queue from the plurality of queues being uniquely associated with a virtual resource from the plurality of virtual resources at the peripheral processing device coupled to the first edge device.

20. The method of claim 14, wherein a number of ports in the second plurality of ports for the plurality of edge devices is at least 1,000 ports.