Distributing packets among multiple tiers of network appliances

• US 20020141401A1
• Filed: 01/26/2001
• Published: 10/03/2002
• Est. Priority Date: 07/01/1999
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: OʼRourke, Chris, Albert, Mark, Batz, Robert, Gray, Richard, Tsang, Tzu-Ming, Tiwari, Pranav, Menditto, Louis, McGuire, Jacob Mark
• Granted Patent: US 6,891,839 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/243 using M+N parallel active paths
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 45/76 Routing in software-defined topologies, e.g. routing between virtual machines
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network is disclosed that includes a first tier of forwarding agents connected to a first tier of network devices. A second tier of forwarding agents is connected to a second tier of network devices. A service manager is configured to receive a packet from one of the forwarding agents; determine the tier of the forwarding agent; and send an instruction to the forwarding agent directing the forwarding agent to forward the packet to a network device connected to the tier of forwarding agents that includes the forwarding agent. filed Jul. 2, 1999 (Attorney Docket No. CISCP519) entitled SENDING INSTRUCTIONS FROM A SERVICE MANAGER TO FORWARDING AGENTS ON A NEED TO KNOW BASIS which is incorporated herein by reference for all purposes; and co-pending U.S. patent application Ser. No. 09/347,126, filed Jul. 2, 1999 (Attorney Docket No. CISCP520) entitled DISTRIBUTION OF NETWORK SERVICES AMONG MULTIPLE SERVICE MANAGERS WITHOUT CLIENT INVOLVEMENT, filed Jul. 2, 1999 which is incorporated herein by reference for all purposes; and co-pending U.S. patent application Ser. No. 09/347,034, filed Jul. 2, 1999 (Attorney Docket No. CISCP521) entitled INTEGRATING SERVICE MANAGERS INTO A ROUTING INFRASTRUCTURE USING FORWARDING AGENTS which is incorporated herein by reference for all purposes, and co-pending U.S. patent application Ser. No. 09/347,048, filed Jul. 2, 1999 (Attorney Docket No. CISCP522) entitled SYNCHRONIZING SERVICE INSTRUCTIONS AMONG FORWARDING AGENTS USING A SERVICE MANAGER which is incorporated herein by reference for all purposes; and co-pending U.S. patent application Ser. No. 09/347,125, filed Jul. 2, 1999 (Attorney Docket No. CISCP527) entitled BACKUP SERVICE MANAGERS FOR PROVIDING RELIABLE NETWORK SERVICES IN A DISTRIBUTED ENVIRONMENT which is incorporated herein by reference for all purposes; and co-pending U.S. patent application Ser. No. 09/347,123, filed Jul. 2, 1999 (Attorney Docket No. CISCP528) entitled STATEFUL FAILOVER OF SERVICE MANAGERS which is incorporated herein by reference for all purposes; and co-pending U.S. patent application Ser. No. 09/347,109, filed Jul. 2, 1999 (Attorney Docket No. CISCP529) entitled NETWORK ADDRESS TRANSLATION USING A FORWARDING AGENT which is incorporated herein by reference for all purposes; and co-pending U.S. patent application Ser. No. 09/347,036, filed Jul. 2, 1999 (Attorney Docket No. CISCP530) entitled PROXYING AND UNPROXYING A CONNECTION USING A FORWARDING AGENT, which is incorporated herein by reference for all purposes; and co-pending U.S. patent application Ser. No. 09/651,436, filed Aug. 30, 2000 (Attorney Docket No. CISCP536) entitled DISTRIBUTED RULE-BASED PACKET REDIRECTION, which is incorporated herein by reference for all purposes.

Claims

1. A network comprising:

a first tier of forwarding agents connected to a first tier of network devices;

a second tier of forwarding agents connected to a second tier of network devices; and

a service manager configured to;

receive a packet from one of the forwarding agents;

determine the tier of the forwarding agent; and

send an instruction to the forwarding agent directing the forwarding agent to forward the packet to a network device connected to the tier of forwarding agents that includes the forwarding agent.

2. A network as recited in claim 1 wherein the first tier of network devices include state tracking network devices that keep track of the state of connections and wherein the service manager is further configured to:

in the event that the tier of the forwarding agent is connected to one of the state tracking network devices, determine whether the packet belongs to a connection that has already been assigned to the state tracking network device; and

in the event that the connection has been assigned to the state tracking network device, selecting the same state tracking network device to receive the packet.

3. A network as recited in claim 2 wherein the state tracking network device is a firewall.

4. A network as recited in claim 3 wherein the firewall is initially chosen by the service manager for a first packet that requests a connection and wherein the same firewall is chosen for a second packet that responds to the first packet.

5. A network as recited in claim 1 wherein the tier of the forwarding agent is determined by the subnet of the forwarding agent.

6. A network as recited in claim 1 wherein the tier of the forwarding agent is determined by the port of the forwarding agent.

7. A network as recited in claim 1 wherein the tier of the forwarding agent is determined by the inclusion of the IP address of the forwarding agent in a list for the tier.

8. A network as recited in claim 1 wherein second tier of forwarding agents are also connected to the first tier of network devices.

9. A service manager configured to distribute packets to multiple tiers of forwarding agents comprising:

a network interface configured to receive packets from a first tier of forwarding agents connected to a first tier of network devices and a second tier of forwarding agents connected to a second tier of network devices; and

a processor configured to;

determine the tier of a sending forwarding agent that sends a packet; and

send an instruction to the sending forwarding agent directing the sending forwarding agent to forward the packet to a network device connected to the tier of forwarding agents that includes the sending forwarding agent.

10. A service manager as recited in claim 9 wherein the first tier of network devices include state tracking network devices that keep track of the state of connections and wherein the processor is further configured to:

in the event that the tier of the forwarding agent is connected to one of the state tracking network devices, determine whether the packet belongs to a connection that has already been assigned to the state tracking network device; and

in the event that the connection has been assigned to the state tracking network device, selecting the same state tracking network device to receive the packet.

11. A service manager as recited in claim 10 wherein the state tracking network device is a firewall.

12. A service manager as recited in claim 11 wherein the firewall is initially chosen by the service manager for a first packet that requests a connection and wherein the same firewall is chosen for a second packet that responds to the first packet.

13. A service manager as recited in claim 9 wherein the tier of the forwarding agent is determined by the subnet of the forwarding agent.

14. A service manager as recited in claim 9 wherein the tier of the forwarding agent is determined by the port of the forwarding agent.

15. A service manager as recited in claim 9 wherein the tier of the forwarding agent is determined by the inclusion of the IP address of the forwarding agent in a list for the tier.

16. A method of distributing packets to multiple tiers of forwarding agents comprising:

receiving packets at a service manager from a first tier of forwarding agents connected to a first tier of network devices and a second tier of forwarding agents connected to a second tier of network devices;

determining the tier of a sending forwarding agent that sent a packet; and

sending an instruction to the sending forwarding agent directing the sending forwarding agent to forward the packet to a network device connected to the tier of forwarding agents that includes the sending forwarding agent.

17. A computer program product for distributing packets to multiple tiers of forwarding agents, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

determining a corresponding tier of a sending forwarding agent that sent a packet received at a service manager from a first tier of forwarding agents connected to a first tier of network devices and a second tier of forwarding agents connected to a second tier of network devices; and

sending an instruction to the sending forwarding agent directing the sending forwarding agent to forward the packet to a network device connected to the corresponding tier of forwarding agents.

18. A service manager configured to distribute packets to multiple tiers of forwarding agents comprising:

means for receiving packets from a first tier of forwarding agents connected to a first tier of network devices and a second tier of forwarding agents connected to a second tier of network devices;

means for determining the tier of a sending forwarding agent that sends a packet; and

means for sending an instruction to the sending forwarding agent directing the sending forwarding agent to forward the packet to a network device connected to the tier of forwarding agents that includes the sending forwarding agent.