HIGHLY SCALABLE APPLICATION LAYER SERVICE APPLIANCES

• US 20090063625A1
• Filed: 04/11/2008
• Published: 03/05/2009
• Est. Priority Date: 08/28/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Rohati Systems, Inc. (Cisco Systems, Inc.)
• Inventors: Patra, Abhijit, Prabhu, Kirti, Thakar, Anant, Bagepalli, Nagaraj, Gandhi, Prashant
• Granted Patent: US 8,161,167 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: Y10T 70/5827 Axially movable clutch

Abstract

A highly scalable application layer service appliance is described herein. According to one embodiment, a network element includes a plurality of application service modules (ASMs), each providing one or more application services to network traffic, including layer 5-7 services, a lossless data transport fabric (LDTF), a network service module (NSM) coupled to each of the ASMs over the LDTF. In response to a packet of a network transaction received from a client over for accessing a server of a datacenter, the NSM is configured to perform layer 2-5 processes on the packet, generating a data stream. The NSM is configured to route the data stream to at least two ASMs over the LDTF to allow the ASMs to perform layer 5-7 services on the packet. Other methods and apparatuses are also described.

Claims

1. A network element, comprising:

a plurality of application service modules (ASMs), each providing one or more application services to network traffic, including a layer 7 service;

a lossless data transport fabric (LDTF); and

a network service module (NSM) coupled to each of the ASMs over the LDTF, wherein in response to a packet of a network transaction received from a client over a first network for accessing a server of a datacenter over a second network, the NSM is configured to perform layer 2 to layer 5 (layer 2-5) processes on the packet, generating a data stream, and wherein the NSM is configured to route the data stream to at least two ASMs over the LDTF to allow the at least two ASMs to perform layer 5 to layer 7 (layer 5-7) services on the packet.

2. The network element of claim 1, wherein the at least two ASMs include a first ASM and a second ASM, and wherein the first ASM performs a first portion of the layer 5-7 services and the second ASM performs a second portion of the layer 5-7 services.

3. The network element of claim 2, wherein the first and second ASMs are configured to perform the layer 5-7 services in parallel.

4. The network element of claim 2, wherein the first ASM includes a first memory to store layer 5-7 states associated with the first portion of the layer 5-7 services performed by the first ASM, wherein the second ASM includes a second memory to store layer 5-7 states associated with the second portion of the layer 5-7 services performed by the second ASM, and wherein the layer 5-7 states of the first and second memories are synchronized periodically or constantly.

5. The network element of claim 4, wherein the layer 5-7 states of the first and second memories are synchronized via an RDMA (remote direct memory access) link over the LDTF.

6. The network element of claim 1, wherein the NSM is configured to terminate a TCP connection of the network transaction and to route the data stream with terminated TCP to the first and second ASMs, and wherein the first and second ASMs perform the layer 5-7 services without having to terminating the TCP connection again.

7. The network element of claim 1, wherein the NSM comprises:

a load balancer to determine a load status of each of the plurality of ASMs; and

a flow dispatcher coupled to the load balancer to dispatch the data stream to the first and second ASMa based on at least one of load statuses of the first and second ASMs and packet information including layer-3 header information.

8. The network element of claim 7, wherein the load balancer of the NSM is configured to monitor the load status of each ASM by polling a memory location of each ASM which stores the load status of one or more processors or processing cores of the ASM.

9. The network element of claim 8, wherein the load balancer of the NSM performs a one-way read from the memory location of each ASM via an RDMA channel over the LDTF without having to invoke significant processing power of the ASM.

10. The network element of claim 9, wherein the LDTF is one of an RDMA capable and an InfiniBand™

compatible fabric.

11. The network element of claim 1, wherein the network element is configured to operate as an application services gateway of the datacenter, and wherein in order to access a server of the datacenter, a client of the first network has to go through the application services gateway.

12. A method performed by a network element, the method comprising:

receiving at a network element a packet of a network transaction from a client over a first network for accessing a server of a datacenter over a second network, the network element operating as an application services gateway of the datacenter, wherein the network element includes a network service module (NSM) and a plurality of application service modules (ASMs) coupled to each other over a lossless data transport fabric (LDTF);

performing within the NSM layer 2 to layer 5 (layer 2-5) processes on the packet, generating a data stream; and

the NSM routing the data stream to at least two ASMs over the LDTF to allow the at least two ASMs to perform layer 5 to layer 7 (layer 5-7) services on the packet.

13. The method of claim 12, wherein the at least two ASMs include a first ASM and a second ASM, and wherein the first ASM performs a first portion of the layer 5-7 services and the second ASM performs a second portion of the layer 5-7 services in parallel.

14. The method of claim 13, wherein the first ASM includes a first memory to store layer 5-7 states associated with the first portion of the layer 5-7 services performed by the first ASM, wherein the second ASM includes a second memory to store layer 5-7 states associated with the second portion of the layer 5-7 services performed by the second ASM, and wherein the layer 5-7 states of the first and second memories are synchronized periodically or constantly via an RDMA (remote direct memory access) link over the LDTF.

15. The method of claim 12, wherein the NSM is configured to terminate a TCP connection of the network transaction and to route the data stream with terminated TCP to the first and second ASMs, and wherein the first and second ASMs perform the layer 5-7 services without having to terminating the TCP connection again.

16. The method of claim 12, wherein the NSM comprises:

a load balancer to determine a load status of each of the plurality of ASMs; and

a flow dispatcher coupled to the load balancer to dispatch the data stream to the first and second ASMa based on at least one of load statuses of the first and second ASMs and packet information including layer-3 header information.

17. The method of claim 16, wherein the load balancer of the NSM is configured to monitor the load status of each ASM by polling a memory location of each ASM which stores the load status of one or more processors or processing cores of the ASM.

18. The method of claim 17, wherein the load balancer of the NSM performs a one-way read from the memory location of each ASM via an RDMA channel over the LDTF without having to invoke significant processing power of the ASM.

19. A machine-readable medium having instructions stored therein, which when executed by a machine, cause the machine to perform a method performed, the method comprising:

receiving at a network element a packet of a network transaction from a client over a first network for accessing a server of a datacenter over a second network, the network element operating as an application services gateway of the datacenter, wherein the network element includes a network service module (NSM) and a plurality of application service modules (ASMs) coupled to each other over a lossless data transport fabric (LDTF);

performing within the NSM layer 2 to layer 5 (layer 2-5) processes on the packet, generating a data stream; and

the NSM routing the data stream to at least two ASMs over the LDTF to allow the at least two ASMs to perform layer 5 to layer 7 (layer 5-7) services on the packet.

20. The machine-readable medium of claim 19, wherein the at least two ASMs include a first ASM and a second ASM, and wherein the first ASM performs a first portion of the layer 5-7 services and the second ASM performs a second portion of the layer 5-7 services in parallel.

21. The machine-readable medium of claim 20, wherein the first ASM includes a first memory to store layer 5-7 states associated with the first portion of the layer 5-7 services performed by the first ASM, wherein the second ASM includes a second memory to store layer 5-7 states associated with the second portion of the layer 5-7 services performed by the second ASM, and wherein the layer 5-7 states of the first and second memories are synchronized periodically or constantly via an RDMA (remote direct memory access) link over the LDTF.

22. The machine-readable medium of claim 19, wherein the NSM is configured to terminate a TCP connection of the network transaction and to route the data stream with terminated TCP to the first and second ASMs, and wherein the first and second ASMs perform the layer 5-7 services without having to terminating the TCP connection again.

23. The machine-readable medium of claim 19, wherein the NSM comprises:

a load balancer to determine a load status of each of the plurality of ASMs; and

a flow dispatcher coupled to the load balancer to dispatch the data stream to the first and second ASMa based on at least one of load statuses of the first and second ASMs and packet information including layer-3 header information.

24. The machine-readable medium of claim 23, wherein the load balancer of the NSM is configured to monitor the load status of each ASM by polling a memory location of each ASM which stores the load status of one or more processors or processing cores of the ASM.

25. The machine-readable medium of claim 24, wherein the load balancer of the NSM performs a one-way read from the memory location of each ASM via an RDMA channel over the LDTF without having to invoke significant processing power of the ASM.