CENTRALIZED TCP TERMINATION WITH MULTI-SERVICE CHAINING

• US 20090063688A1
• Filed: 04/11/2008
• Published: 03/05/2009
• Est. Priority Date: 08/28/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Rohati Systems, Inc. (Cisco Systems, Inc.)
• Inventors: Patra, Abhijit, Prabhu, Kirti, Thakar, Anant, Bagepalli, Nagaraj, Gandhi, Prashant
• Granted Patent: US 7,913,529 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: Y10T 70/5827 Axially movable clutch

Abstract

A network element having centralized TCP termination with multi-service chaining is described herein. According to one embodiment, a network element includes a switch fabric, a first service module coupled to the switch fabric, and a second and a third service modules coupled to the first service module over the switch fabric. In response to packets of a network transaction received from a client over a first network for access a server of a data center having multiple servers over a second network, the first service module is configured to terminate a TCP connection of the packets. The TCP terminated packets are transmitted to the second and third service modules over the switch fabric. The second and third service modules are configured to perform different application network services on the TCP terminated packets without having to perform a TCP process again. Other methods and apparatuses are also described.

Claims

1. A network element, comprising:

a switch fabric;

a first service module coupled to the switch fabric;

a second service module coupled to the first service module over the switch fabric; and

a third service module coupled to the first service module and the second service module over the switch fabric,

wherein in response to packets of a network transaction received from a client over a first network for access a server of a data center having a plurality of servers over a second network, the first service module is configured to terminate a TCP (transport control protocol) connection of the packets, wherein the TCP terminated packets are transmitted to the second and third service modules over the switch fabric, and wherein the second and third service modules are configured to perform different application network services on the TCP terminated packets without having to perform a TCP process again.

2. The network element of claim 1, wherein the switch fabric is a lossless switch fabric which is implemented as one of an RDMA (remote direct memory access) capable fabric, an InfiniBand compatible fabric, and an iWARP (Internet wide area RDMA protocol) compatible fabric.

3. The network element of claim 1, wherein the network element is configured operate as an application services gateway to the data center, and wherein in order to access a server of the data center over a second network, each client of the first network has to go through the network element.

4. The network element of claim 1, wherein the application network services performed by the second and third service modules comprise at least layer-5 to layer-7 (layer 5-7) services associated with the network transaction.

5. The network element of claim 4, wherein the second and third service modules are configured to perform the layer 5-7 services in a pipeline manner.

6. The network element of claim 1, wherein the first service module generates a data stream based on the packets after terminating the TCP connection, and wherein the data stream is transmitted from the first service module to the second and third service modules over the switch fabric without having the second and third service modules to perform TCP processes.

7. The network element of claim 6, wherein the data stream is transmitted to the second service module to perform a first application network service and thereafter, the second service module transmits at least a portion of the data stream to the third service module to enable the third service module to perform a second application network service without further TCP processes, and wherein the third service module can transmit the data stream back to the second service module which after further processing, transmits the data stream to the first service module.

8. The network element of claim 7, wherein the first and second application network services are different types of services that are associated with the network transaction.

9. The network element of claim 1, wherein the first service module is implemented in a first plane while the second and third service modules are implemented in a plane other than the first plane and coupled to the first plane via a backplane.

10. The network element of claim 9, wherein the second and third service modules are implemented on the same plane or different planes.

11. A method performed by a network element, the method comprising:

receiving at a network element packets of a network transaction from a client over a first network for accessing a server of a data center having a plurality of servers over a second network, the network element including a plurality of service modules coupled to each other over a switch fabric;

terminating a TCP (transport control protocol) connection of the packets at a first service module, generating a data stream representing a TCP terminated packets; and

transmitting the data stream to a second service module and a third service module over the switch fabric for further processes, wherein the second and third service modules are configured to perform different application network services associated with the network transaction on the data stream without having to TCP termination related processes again.

12. The method of claim 11, wherein the switch fabric is a lossless switch fabric which is implemented as one of an RDMA (remote direct memory access) capable fabric, an InfiniBand compatible fabric, and an iWARP (Internet wide area RDMA protocol) compatible fabric.

13. The method of claim 11, wherein the network element is configured operate as an application services gateway to the data center, and wherein in order to access a server of the data center over a second network, each client of the first network has to go through the network element.

14. The method of claim 11, wherein the application network services performed by the second and third service modules comprise at least layer-5 to layer-7 (layer 5-7) services associated with the network transaction.

15. The method of claim 14, wherein the second and third service modules are configured to perform the layer 5-7 services in a pipeline manner.

16. The method of claim 11, wherein the first service module is implemented in a first plane while the second and third service modules are implemented in a plane other than the first plane and coupled to the first plane via a backplane.

17. The method of claim 16, wherein the second and third service modules are implemented on the same plane or different planes.

18. A machine-readable medium having instructions stored therein, which when executed by a machine, cause the machine to perform a method, the method comprising:

receiving at a network element packets of a network transaction from a client over a first network for accessing a server of a data center having a plurality of servers over a second network, the network element including a plurality of service modules coupled to each other over a switch fabric;

terminating a TCP (transport control protocol) connection of the packets at a first service module, generating a data stream representing a TCP terminated packets; and

transmitting the data stream to a second service module and a third service module over the switch fabric for further processes, wherein the second and third service modules are configured to perform different application network services associated with the network transaction on the data stream without having to TCP termination related processes again.

19. The machine-readable medium of claim 18, wherein the switch fabric is a lossless switch fabric which is implemented as one of an RDMA (remote direct memory access) capable fabric, an InfiniBand compatible fabric, and an iWARP (Internet wide area RDMA protocol) compatible fabric.

20. The machine-readable medium of claim 18, wherein the network element is configured operate as an application services gateway to the data center, and wherein in order to access a server of the data center over a second network, each client of the first network has to go through the network element.

21. The machine-readable medium of claim 18, wherein the application network services performed by the second and third service modules comprise at least layer-5 to layer-7 (layer 5-7) services associated with the network transaction.

22. The machine-readable medium of claim 21, wherein the second and third service modules are configured to perform the layer 5-7 services in a pipeline manner.

23. The machine-readable medium of claim 18, wherein the first service module is implemented in a first plane while the second and third service modules are implemented in a plane other than the first plane and coupled to the first plane via a backplane.

24. The machine-readable medium of claim 23, wherein the second and third service modules are implemented on the same plane or different planes.