METHODS AND APPARATUS RELATED TO A FLEXIBLE DATA CENTER SECURITY ARCHITECTURE

• US 20100061242A1
• Filed: 09/11/2009
• Published: 03/11/2010
• Est. Priority Date: 09/11/2008
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Aybay, Gunes, Frailong, Jean-Marc, Sindhu, Pradeep, Vohra, Quaizar, Venkatramani, Anjan
• Granted Patent: US 8,265,071 B2
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0846 based on copy from other elements
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/0897 by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities
• CPC Class Codes: H04L 49/257 Cut-through or wormhole routing
• CPC Class Codes: H04L 49/30 Peripheral units, e.g. input or output ports
• CPC Class Codes: H04L 49/35 Switches specially adapted for specific applications
• CPC Class Codes: H04L 49/356 for storage area networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

In one embodiment, edge devices can be configured to be coupled to a multi-stage switch fabric and peripheral processing devices. The edge devices and the multi-stage switch fabric can collectively define a single logical entity. A first edge device from the edge devices can be configured to be coupled to a first peripheral processing device from the peripheral processing devices. The second edge device from the edge devices can be configured to be coupled to a second peripheral processing device from the peripheral processing devices. The first edge device can be configured such that virtual resources including a first virtual resource can be defined at the first peripheral processing device. A network management module coupled to the edge devices and configured to provision the virtual resources such that the first virtual resource can be migrated from the first peripheral processing device to the second peripheral processing device.

Claims

1. An apparatus, comprising:

a multi-stage switch fabric;

a plurality of edge devices having a first plurality of ports configured to be coupled to the multi-stage switch fabric and a second plurality of ports configured to be coupled to the plurality of peripheral processing devices, the plurality of edge devices and the multi-stage switch fabric collectively defining a single logical entity, the plurality of edge devices includes a first edge device and a second edge device, the first edge device being configured to be coupled to a first peripheral processing device from the plurality of peripheral processing devices, the second edge device being configured to be coupled to a second peripheral processing device from the plurality of peripheral processing devices, the first edge device being configured such that a plurality of virtual resources including a first virtual resource are defined at the first peripheral processing device; and

a network management module coupled to the plurality of edge devices, the network management module configured to provision the plurality of virtual resources such that the first virtual resource can be migrated from the first peripheral processing device to the second peripheral processing device.

2. The apparatus of claim 1, wherein:

a number of ports in the second plurality of ports for the plurality of edge devices is at least 1,000 ports.

3. The apparatus of claim 1, wherein:

a number of ports in the second plurality of ports for the plurality of edge devices is at least 100,000 ports.

4. The apparatus of claim 1, wherein:

a number of ports in the first plurality of ports for the plurality of edge devices is less than a number of ports in the second plurality of ports of the plurality of edge devices.

5. The apparatus of claim 1, wherein:

the network management module is configured to provision the plurality of virtual resources such that a virtual resource from a plurality of virtual resources from each peripheral processing device can be moved from the plurality of peripheral processing devices to at least one of the remaining peripheral processing device from the plurality of peripheral processing devices.

6. The apparatus of claim 1, wherein:

the plurality of edge devices and the multi-stage switch fabric collectively are configured to provide connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that congestion at the first virtual resource is isolated from data traffic sent to and received from a second virtual resource at the first peripheral processing device from the plurality of peripheral processing devices.

7. The apparatus of claim 1, wherein:

the second edge device is configured to be coupled to a second peripheral processing device from the plurality of peripheral processing devices; and

the plurality of edge devices and the multi-stage switch fabric collectively are configured to provide connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that congestion at the first virtual resource is isolated from data traffic sent to and received from a second virtual resource at the second peripheral processing.

8. An apparatus, comprising:

a multi-stage switch fabric;

a first plurality of edge devices, the first plurality of edge devices collectively having a plurality of output ports coupled to the multi-stage switch fabric and collectively having at least 1,000 input ports configured to be coupled to a plurality of peripheral processing devices, each edge device from the plurality of edge devices being configured such that a plurality of virtual resources are defined at the plurality of peripheral processing devices;

a second plurality of edge devices coupled to the multi-stage switch fabric, the first plurality of edge devices, the second plurality of edge devices and the multi-stage switch fabric collectively defining a single logical entity; and

a network management module coupled to the first plurality of edge devices and the second plurality of edge devices, the network management module configured to provision the plurality of processing devices such that the plurality of virtual resources from a first peripheral processing device from the plurality of peripheral processing devices can be migrated to a second peripheral processing from the plurality of peripheral processing devices.

9. The apparatus of claim 8, wherein:

the plurality of edge devices collectively has a plurality of ports coupled to the multi-stage switch fabric and collectively having at least 1,000 ports configured to be coupled to a plurality of peripheral processing devices.

10. The apparatus of claim 8, wherein:

the plurality of edge devices collectively has a plurality of ports coupled to the multi-stage switch fabric and collectively having at least 100,000 ports configured to be coupled to a plurality of peripheral processing devices.

11. An apparatus, comprising:

a multi-stage switch fabric; and

a plurality of edge devices having a first plurality of ports configured to be coupled to the multi-stage switch fabric and a second plurality of ports configured to be coupled to the plurality of peripheral processing devices, a number of ports in the first plurality of ports of the plurality of edge devices being less than a number of ports in the second plurality of ports of the plurality of edge devices, each edge device from the plurality of edge devices being configured such that a plurality of virtual resources are defined at the plurality of peripheral processing devices, the plurality of edge devices and the multi-stage switch fabric collectively defining a single logical entity,

the plurality of edge devices and the multi-stage switch fabric collectively configured such that data traffic sent from each virtual resource from the plurality of virtual resources through a respect edge device from the plurality of edge devices and through the multi-stage switch fabric is isolated from data traffic sent from the remaining virtual resources from the plurality of virtual resources associated with the remaining edge devices from the plurality of edge devices.

12. The apparatus of claim 11, wherein the multi-stage switch fabric configured to provide connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that each virtual resource from the plurality of virtual resources is equitably accessible by each remaining virtual resource from the plurality of virtual resources.

13. The apparatus of claim 11, wherein:

the plurality of edge devices includes a first edge device;

the plurality of virtual resources including a first virtual resource and a second virtual resource to which the first edge device is configured to be coupled; and

the multi-stage switch fabric configured to provide connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that congestion at the first virtual resource does not affect data traffic sent to and received from the second virtual resource.

14. The apparatus of claim 11, wherein:

the plurality of edge devices includes a first edge device and a second edge device;

the plurality of virtual resources including a first virtual resource to which the first edge device is configured to be coupled and a second virtual resource to which the second edge device is configured to be coupled; and

the multi-stage switch fabric configured to provide connectivity at line rate for each edge device from the plurality of edge devices to each remaining edge device from the plurality of edge devices such that congestion at the first virtual resource does not affect data traffic sent to and received from the second virtual resource.

15. The apparatus of claim 11, wherein:

the plurality of edge devices collectively having a plurality of ports coupled to the multi-stage switch fabric and collectively having at least 1,000 ports configured to be coupled to a plurality of peripheral processing devices.

16. The apparatus of claim 11, wherein:

the plurality of edge devices collectively having a plurality of ports coupled to the multi-stage switch fabric and collectively having at least 100,000 ports configured to be coupled to a plurality of peripheral processing devices.

17. The apparatus of claim 11, wherein:

the multi-stage switch fabric is configured as a deterministic network that admits a plurality of cells associated with a packet from an edge device from the plurality of edge devices when delivery within the switch fabric of the plurality of cells can be substantially guaranteed without loss through the multi-stage switch fabric.

18. The apparatus of claim 11, wherein the plurality of peripheral processing devices includes a first peripheral processing device configured to communicate with a fiber channel protocol and a second peripheral processing device configured to communicate with a fiber-channel-over-Ethernet protocol.

19. The apparatus of claim 11, wherein the plurality of edge devices includes a first edge device having a plurality of queues, the apparatus further comprising:

a flow control module coupled to the first edge device and configured to provide flow control on a per queue basis, each queue from the plurality of queues being uniquely associated with a virtual resource from the plurality of virtual resources at the peripheral processing device coupled to the first edge device.

20. The apparatus of claim 11, further comprising:

a flow control module coupled to the plurality of edge devices, the flow control module configured to provide flow control for each virtual resource from the plurality of virtual resources for each edge device from the plurality of edge devices.