Network appliance

• US 20050132030A1
• Filed: 12/10/2003
• Published: 06/16/2005
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: Aventail LLC
• Original Assignee: Aventail Corporation (SonicWall Holdings Ltd.)
• Inventors: Erickson, Rodger D., Brooke, John, Tomlinson, Gary B., Burdge, Jonathan, Brown, Derek W., Hopen, Chris A.
• Granted Patent: US 8,572,249 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 11/2007 using redundant communication media
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 45/121 by minimising delays
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 based on network conditions
• CPC Class Codes: H04L 67/1017 based on a round robin mechanism
• CPC Class Codes: H04L 67/1029 using data related to the state of servers by a load balancer
• CPC Class Codes: H04L 67/1034 Reaction to server failures by a load balancer
• CPC Class Codes: H04L 67/1038 Load balancing arrangements to avoid a single path through a load balancer

Abstract

A network appliance is described that can provide a variety of software services, including both platform services, such as access method services, and a load balancing service. A network may include a network appliance that both provides one or more platform services and acts as a load balancer. When two or more such appliances are used together, they can replace a substantial portion of a conventional network. For example, when a network appliance receives a client communication, its load balancer service can determine whether one of its own platform services will process the communication or forward the communication to another network appliance for processing. Moreover, if the load balancing service of a network appliance fails, another network appliance can provide load balancing. Similarly, if another service of a network appliance fails, then the network appliance may continue to provide load balancing but forward communications requiring the failed service to another network appliance for processing.

Claims

1. A network appliance, comprising:

at least one platform service;

a load balancing process that performs load balancing on communications received by the network appliance; and

a service monitoring process that monitors a status of the at least one platform service using interprocess communications.

2. The network appliance recited in claim 1, further comprising a backplane interface through which the network appliance exchanges data with another device.

3. The network appliance recited in claim 2, wherein

the another device hosts at least one second platform service, and

the service monitoring process monitors a status of the at least one second platform service using communications transmitted over the backplane.

4. The network appliance recited in claim 1, further comprising an interface monitoring process that monitors a status of interfaces and connections employed by the network appliance.

5. The network appliance recited in claim 1, wherein the at least one platform service is an access method service.

6. The network appliance recited in claim 5, wherein the access method service is a virtual private network service.

7. The network appliance recited in claim 1, wherein the access method service is an extranet Web service.

8. The network appliance recited in claim 1, further comprising a node manager process that monitors an operational status of the at least one platform service and provides a determined operational status of the at least one platform service to the service monitoring process.

9. The network appliance recited in claim 1, further comprising a distributed cache service that caches information relating to the at least one platform on another network appliance.

10. The network appliance recited in claim 1, wherein

the at least one platform service is an access method service;

and

the cached information includes authentication information and encryption key information for encryption sessions hosted by the access method service.

11. A network comprising:

a first network appliance having at least one first platform service, a first load balancing process that performs load balancing on communications received by the first network appliance, and a service monitoring process that monitors a status of the at least one first platform service using interprocess communications; and

a second network appliance having at least one second platform service and a second load balancing process that performs load balancing on communications received by the second network appliance.

12. The network recited in claim 11, wherein the second network appliance further includes a second service monitoring process that monitors a status of the at least one second platform service using interprocess communications.

13. The network recited in claim 11, wherein

the first network appliance is configured to receive all client communications to the network unless the first load balancing process fails, and

the second network appliance is configured to receive all client communications to the network if the first load balancing process fails.

14. The network appliance recited in claim 11, wherein the at least one first platform service is an access method service.

15. The network appliance recited in claim 14, wherein the access method service is a virtual private network service.

16. The network appliance recited in claim 14, wherein the access method service is an extranet Web service.

17. The network appliance recited in claim 11, wherein the at least one second platform service is an access method service.

18. The network appliance recited in claim 17, wherein the access method service is a virtual private network service.

19. The network appliance recited in claim 17, wherein the access method service is an extranet Web service.

20. A method of processing client communications to a network, comprising:

receiving a first client communication at a first network appliance;

employing a load balancing service hosted by the first network appliance to direct the first client communication to a first platform service also hosted by the first network appliance;

receiving a second client communication at the first network appliance; and

employing the load balancing service to direct the second client communication to a second platform service hosted by a second network appliance.

21. The method recited in claim 20, further comprising:

analyzing the first client communication to determine if the first client communication includes association data indicating that the first client communication is associated with the first platform service; and

determining that the first client communication includes association data indicating that the first communication is associated with the first platform service.

22. The method recited in claim 21, wherein the association data is a session identifier identifying an encryption session maintained by the first platform service.

23. The method recited in claim 20, further comprising:

executing a load balancing algorithm to determine whether the second client communication should be directed to the second platform service; and

determining that the second client communication should be directed to the second platform service based upon results of the executed load balancing algorithm.

24. A method of routing a communication to a platform service, comprising:

receiving a first message in a first communication;

sending an acknowledgement message to a source of the first communication in reply to the first message;

receiving a second message in the first communication containing payload data;

analyzing payload data contained in the second message to identify a platform service associated with the payload data;

sending a first message in a second communication to the platform service;

receiving an acknowledgement of the first message from the platform service;

sending a second message in the second communication to the platform service, such that the second message in the second communication includes the payload data contained in the second message of the first communication;

receiving a reply to the second message in the second communication from the platform service; and

relaying the reply from the platform service to the source of the first communication.

25. The method recited in claim 24, wherein

the messages in the first communication are sequentially numbered and the messages in the second communication are sequentially numbered differently from the messages in the first communication;

and

further comprising

modifying the sequential numbering of the second message in the first communication to correspond with the sequential numbering of the second communication with the platform service; and

modifying the sequential numbering of the reply to the second message in the second communication to correspond with the sequential numbering of the first communication.