HIGHLY SCALABLE ARCHITECTURE FOR APPLICATION NETWORK APPLIANCES

• US 20090063665A1
• Filed: 04/11/2008
• Published: 03/05/2009
• Est. Priority Date: 08/28/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Rohati Systems, Inc. (Cisco Systems, Inc.)
• Inventors: Patra, Abhijit, Prabhu, Kirti, Thakar, Anant, Bagepalli, Nagaraj, Gandhi, Prashant
• Granted Patent: US 7,921,686 B2
• Time in Patent Office: Days
• US Class Current: 709/222
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: Y10T 70/5827 Axially movable clutch

Abstract

A highly scalable application network appliance is described herein. According to one embodiment, a network element includes a switch fabric, a first service module coupled to the switch fabric, and a second service module coupled to the first service module over the switch fabric. In response to packets of a network transaction received from a client over a first network to access a server of a data center having multiple servers over a second network, the first service module is configured to perform a first portion of OSI (open system interconnection) compatible layers of network processes on the packets while the second service module is configured to perform a second portion of the OSI compatible layers of network processes on the packets. The first portion includes at least one OSI compatible layer that is not included in the second portion. Other methods and apparatuses are also described.

Claims

1. A network element, comprising:

a switch fabric;

a first service module coupled to the switch fabric; and

a second service module coupled to the first service module over the switch fabric, wherein in response to packets of a network transaction received from a client over a first network to access a server of a data center having a plurality of servers over a second network, the first service module is configured to perform a first portion of OSI (open system interconnection) compatible layers of network processes on the packets while the second service module is configured to perform a second portion of the OSI compatible layers of network processes on the packets, and wherein the first portion includes at least one OSI compatible layer that is not included in the second portion.

2. The network element of claim 1, wherein the network element operates as a security gateway of the data center, and wherein in order to access any of the plurality of servers, each client of the first network has to go through the security gateway.

3. The network element of claim 1, wherein the switch fabric is a reliable switch fabric as being a lossless switch fabric.

4. The network element of claim 1, wherein the first service module is implemented in a first service plane and the second service module is implemented in a second service plane coupled to the first service plane via a backplane.

5. The network element of claim 4, wherein the backplane includes at least a portion of connections to the switch fabric.

6. The network element of claim 1, wherein the first service module is configured to perform layer 2 to layer 5 (layers 2-5) of the network processes on the packets, and wherein the second service module is configured to perform layer 6 to layer 7 (layer 6-7) of the network processes on the packets.

7. The network element of claim 6, wherein after performing the layers 2-5 of the network processes, the first service module is configured to transmit a data stream to the second service module over the switch fabric.

8. The network element of claim 7, wherein the data stream represents the packets without header information associated with layers 2-5.

9. The network element of claim 1, wherein each of the first and second service modules can be configured to perform any one or more of OSI compatible layers of network processes.

10. The network element of claim 9, further comprising a database to store information indicating which of the OSI compatible layers of network processes that the first and second service modules are to perform respectively.

11. A method performed by a network element, the method comprising:

receiving packets of a network transaction at a network element from a client over a first network for accessing over a second network an application stored in a server of a data center having a plurality of servers, the network element including a plurality of service modules coupled to each other over a switch fabric;

processing at a first service module of the network element a first portion of OSI (open system interconnection) compatible layers of network processes on the packets; and

processing at a second service module of the network element a second portion of OSI compatible layers of network processes on the packets, wherein the first portion includes at least one layer that is not included in the second portion.

12. The method of claim 11, wherein the network element operates as an application services gateway of the data center, and wherein in order to access any of the plurality of servers, each client of the first network has to go through the application services gateway.

13. The method of claim 11, wherein the switch fabric is a reliable switch fabric as being a lossless switch fabric.

14. The method of claim 11, wherein the first service module is implemented in a first service plane and the second service module is implemented in a second service plane coupled to the first service plane via a backplane.

15. The method of claim 11, wherein the first service module is configured to perform layer 2 to layer 5 (layers 2-5) of the network processes on the packets, and wherein the second service module is configured to perform layer 6 to layer 7 (layer 6-7) of the network processes on the packets.

16. The method of claim 15, wherein after performing the layers 2-5 of the network processes, the first service module is configured to transmit a data stream to the second service module over the switch fabric.

17. The method of claim 16, wherein the data stream represents the packets without header information associated with layers 2-5.

18. A machine-readable medium having instructions stored therein, which when executed by a machine, cause the machine to perform a method, the method comprising:

receiving packets of a network transaction at a network element from a client over a first network for accessing over a second network an application stored in a server of a data center having a plurality of servers, the network element including a plurality of service modules coupled to each other over a switch fabric;

processing at a first service module of the network element a first portion of OSI (open system interconnection) compatible layers of network processes on the packets; and

processing at a second service module of the network element a second portion of OSI compatible layers of network processes on the packets, wherein the first portion includes at least one layer that is not included in the second portion.

19. The machine-readable medium of claim 18, wherein the network element operates as an application services gateway of the data center, and wherein in order to access any of the plurality of servers, each client of the first network has to go through the application services gateway.

20. The machine-readable medium of claim 18, wherein the switch fabric is a reliable switch fabric as being a lossless switch fabric.

21. The machine-readable medium of claim 18, wherein the first service module is implemented in a first service plane and the second service module is implemented in a second service plane coupled to the first service plane via a backplane.

22. The machine-readable medium of claim 18, wherein the first service module is configured to perform layer 2 to layer 5 (layers 2-5) of the network processes on the packets, and wherein the second service module is configured to perform layer 6 to layer 7 (layers 6-7) of the network processes on the packets.

23. The machine-readable medium of claim 22, wherein after performing the layers 2-5 of the network processes, the first service module is configured to transmit a data stream to the second service module over the switch fabric.

24. The machine-readable medium of claim 23, wherein the data stream represents the packets without header information associated with layers 2-5.