LAYERS 4-7 SERVICE GATEWAY FOR CONVERGED DATACENTER FABRIC

• US 20090063701A1
• Filed: 04/11/2008
• Published: 03/05/2009
• Est. Priority Date: 08/28/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Rohati Systems, Inc. (Cisco Systems, Inc.)
• Inventors: Patra, Abhijit, Prabhu, Kirti, Thakar, Anant, Bagepalli, Nagaraj, Gandhi, Prashant
• Granted Patent: US 8,180,901 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: Y10T 70/5827 Axially movable clutch

Abstract

Layer 4 gateway for a converged datacenter fabric is described herein. According to one embodiment, a packet of a network transaction is received from a client over a first network for accessing a server of a datacenter having a plurality of servers over a second network. One or more network services are performed on the packet including terminating a TCP (transport control protocol) connection associated with the network transaction and generating a data stream. The data stream without TCP information is routed to the server via a converged I/O interface over the second network if the second network is a converged fabric network. The data stream with TCP information is routed via a TCP connection to the server if the second network is an Ethernet. Other methods and apparatuses are also described.

Claims

1. A method performed by a network element, the method comprising:

receiving a packet of a network transaction from a client over a first network for accessing a server of a datacenter having a plurality of servers over a second network;

performing one or more network services on the packet including terminating a TCP (transport control protocol) connection associated with the network transaction and generating a data stream;

routing the data stream without TCP information to the server via a converged input/output (I/O) interface over the second network if the second network is a converged fabric network; and

routing the data stream with TCP information via a TCP connection to the server if the second network is an Ethernet.

2. The method of claim 1, wherein the converged fabric network is one of an RDMA (remote direct memory access) capable, an InfiniBand compatible, and/or a data center Ethernet (DCE) compatible or fibre channel over Ethernet (FCoE) compatible fabric network.

3. The method of claim 1, wherein the network element is configured to operate as an application services gateway to the datacenter, and wherein in order to access a server of the datacenter, each client of the first network has to go through the network element.

4. The method of claim 3, wherein the network element comprises a plurality of service modules coupled to each other over a switch fabric including a network service module (NSM) and an application service module (ASM), wherein the NSM performs layer 2-5 processes on the packet and the ASM performs layer 5 to layer 7 (layer 5-7) processes on the packet.

5. The method of claim 4, wherein the NSM terminates a TCP connection of the packet and generates a data stream which is transmitted over the switch fabric to the ASM for layer 5-7 processing, and wherein the ASM is configured to perform the layer 5-7 processes on the data stream without having to terminating the TCP connection again.

6. The method of claim 5, wherein the ASM comprises a converged I/O interface coupled to the second network, and wherein if the second network is a converged fabric network, after performing layers 5-7 processing, the ASM is configured to route the data stream to the server over the second network via the converged I/O interface.

7. The method of claim 6, wherein if the second network is an Ethernet, after performing layer 5-7 processing, the ASM is configured to route the data stream back to the NSM over the switch fabric and the NSM is configured to route the data stream to the server over the Ethernet.

8. The method of claim 7, wherein the NSM repackages the data stream into a TCP packet before routing the TCP packet to the server over the Ethernet.

9. A machine-readable medium having instructions stored therein, which when executed by a machine, cause the machine to perform a method, the method comprising:

receiving a packet of a network transaction from a client over a first network for accessing a server of a datacenter having a plurality of servers over a second network;

performing one or more network services on the packet including terminating a TCP (transport control protocol) connection associated with the network transaction and generating a data stream;

routing the data stream without TCP information to the server via a converged input/output (I/O) interface over the second network if the second network is a converged fabric network; and

routing the data stream with TCP information via a TCP connection to the server if the second network is an Ethernet.

10. The machine-readable medium of claim 9, wherein the converged fabric network is one of an RDMA (remote direct memory access) capable, an InfiniBand compatible, and a data center Ethernet (DCE) compatible or fibre channel over Ethernet (FCoE) compatible fabric network.

11. The machine-readable medium of claim 9, wherein the network element is configured to operate as a security gateway to the datacenter, and wherein in order to access a server of the datacenter, each client of the first network has to go through the network element.

12. The machine-readable medium of claim 11, wherein the network element comprises a plurality of service modules coupled to each other over a switch fabric including a network service module (NSM) and an application service module (ASM), wherein the NSM performs layer 2 to layer 5 (layer 2-5) processes on the packet and the ASM performs layer 5 to layer 7 (layer 5-7) processes on the packet.

13. The machine-readable medium of claim 12, wherein the NSM terminates a TCP connection of the packet and generates a data stream which is transmitted over the switch fabric to the ASM for layer 5-7 processing, and wherein the ASM is configured to perform the layer 5-7 processes on the data stream without having to terminating the TCP connection again.

14. The machine-readable medium of claim 13, wherein the ASM comprises a converged I/O interface coupled to the second network, and wherein if the second network is a converged fabric network, after performing layer 5-7 processing, the ASM is configured to route the data stream to the server over the second network via the converged I/O interface.

15. The machine-readable medium of claim 14, wherein if the second network is an Ethernet, after performing layer 5-7 processing, the ASM is configured to route the data stream back to the NSM over the switch fabric and the NSM is configured to route the data stream to the server over the Ethernet.

16. The machine-readable medium of claim 15, wherein the NSM repackages the data stream into a TCP packet before routing the TCP packet to the server over the Ethernet.

17. A network element, comprising:

an Ethernet interface to be coupled to an Ethernet;

a converged input/output (I/O) interface to be coupled to a converged fabric network; and

a plurality of service modules coupled to each other over an internal switch fabric, including a network service module (NSM) and an application service module,

wherein in response to a packet received from a client via the Ethernet interface, the packet is part of a network transaction destined to a server of a datacenter having a plurality of servers, the NSM is configured to perform layer 2 to layer 5 (layer 2-5) processes on the packet, including terminating a TCP (transport control protocol) connection of the packet, generating a data stream, wherein the ASM receives the data stream from the NSM over the internal switch fabric to perform layer 5 to layer 7 (layer 5-7) processes on the data stream, and wherein the data stream is routed to the destined server via the converged I/O interface if the destined server is located in the converged fabric network and the data stream is routed to the destined server via the Ethernet interface if the destined server is located in the Ethernet.

18. The network element of claim 17, wherein the converged fabric network is one of an RDMA (remote direct memory access) capable, an InfiniBand compatible, and a data center Ethernet (DCE) compatible or fibre channel over Ethernet (FCoE) compatible fabric network.

19. The network element of claim 17, wherein the network element is configured to operate as a security gateway to the datacenter, and wherein in order to access a server of the datacenter, each client has to go through the network element.

20. The network element of claim 17, wherein the ASM is configured to perform the layer 5-7 processes on the data stream without having to perform TCP related processes.

21. The network element of claim 20, wherein the converged I/O interface is implemented within the ASM, wherein after performing the layer 5-7 processes on the data stream, the ASM routes the data stream to the destined server via the converged I/O interface within the ASM, if the destined server is located in the converged fabric network.

22. The network element of claim 21, wherein if the destined server is located in the Ethernet, after performing the layer 5-7 processes on the data stream, the ASM routes the data stream back to the NSM over the internal switch fabric, and wherein the NSM converts the data stream into a TCP packet and routes the TCP packet to the destined server over the Ethernet.