SYSTEMS AND METHODS FOR LISTENING POLICIES FOR VIRTUAL SERVERS OF APPLIANCE

• US 20110149755A1
• Filed: 12/23/2009
• Published: 06/23/2011
• Est. Priority Date: 12/23/2009
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Suganthi, Josephine, Gandhewar, Dinesh
• Granted Patent: US 8,654,659 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

The present invention is directed towards a method for using a listening policy for a virtual server on an intermediary device. An intermediary device establishes for a first virtual server a first listening policy with an expression for evaluating packets received by the intermediary device to determine whether the packet may access the first virtual server. The intermediary device listens for packets at a first internet protocol (IP) address and a first port specified for the first virtual server. Then, the intermediary device evaluates the expression of the first listening policy to a first packet received at the first IP address and first port and determines whether to provide the first packet to the first virtual server based on a result of the evaluation.

Claims

1. A method of using a listening policy for a virtual server on an intermediary device, the method comprising:

(a) establishing for a first virtual server executing on an intermediary device deployed between a plurality of clients and one or more servers, a first listening policy, the first listening policy comprising an expression for evaluating packets received by the intermediary device to determine whether the packet may access the first virtual server;

(b) listening, by the intermediary device, for packets at a first internet protocol (IP) address and a first port specified for the first virtual server;

(c) evaluating, by the intermediary device, the expression of the first listening policy of the first virtual server to a first packet received at the first IP address and first port; and

(d) determining, by the intermediary device, whether to provide the first packet to the first virtual server based on a result of the evaluation.

2. The method of claim 1, wherein step (a) further comprises establishing, for the first virtual server, the listening policy comprising the expression to compare a virtual local area network (VLAN) identifier of a packet to a predetermined value.

3. The method of claim 1, wherein step (c) further comprises evaluating the VLAN identifier of the first packet and wherein step (d) further comprises determining to provide the first packet to the first virtual server if the VLAN identifier of the first packet matches the predetermined value.

4. The method of claim 1, wherein step (a) further comprises establishing the listening policy comprising the expression to compare an interface identifier of a received packet to a predetermined value.

5. The method of claim 1, wherein step (c) further comprises evaluating the interface identifier of the first packet and wherein step (d) further comprises determining to provide the first packet to the first virtual server if the interface identifier of the first packet matches the predetermined value.

6. The method of claim 1, wherein step (b) further comprises listening, by the intermediary device, for packets for a service type specified for the first virtual server.

7. The method of claim 1, wherein step (a) further comprises establishing a first listening priority for the first virtual server and establishing a second listening policy and a second listening priority for a second virtual server executing on the intermediary device.

8. The method of claim 7, wherein step (b) further comprises listening by the intermediary device on the first IP address and the first port specified for both the first virtual server and the second virtual server.

9. The method of claim 8, wherein step (c) further comprises evaluating the first listening policy and the second listening policy to the first packet and determining that the first packet matches both the first listening policy and the second listening policy.

10. The method of claim 9, wherein step (d) further comprises determining to forward the first packet to the second virtual server instead of the first virtual server based on a comparison of the second listening priority to the first listening priority.

11. A system of using a listening policy for a virtual server on an intermediary device, the system comprising:

a first virtual server executing on an intermediary device deployed between a plurality of clients and one or more servers, the first virtual server configured to have a first listening policy, the first listening policy comprising an expression for evaluating packets received by the intermediary device to determine whether the packet may access the first virtual server;

a packet engine of the intermediary device listening for packets at a first internet protocol (IP) address and a first port specified for the first virtual server;

a policy engine of the intermediary device evaluating the expression of the first listening policy of the first virtual server to a first packet received at the first IP address and first port; and

wherein the intermediary device determines whether to provide the first packet to the first virtual server based on a result of the evaluation.

12. The system of claim 11, wherein the listening policy comprises the expression to compare a virtual local area network (VLAN) identifier of a packet to a predetermined value.

13. The system of claim 12, wherein the intermediary devices evaluates the VLAN identifier of the first packet and determines to provide the first packet to the first virtual server if the VLAN identifier of the first packet matches the predetermined value.

14. The system of claim 11, wherein the listening policy comprises the expression to compare an interface identifier of a received packet to a predetermined value.

15. The system of claim 14, wherein the intermediary device evaluates the interface identifier of the first packet and determines to provide the first packet to the first virtual server if the interface identifier of the first packet matches the predetermined value.

16. The system of claim 11, wherein the packet engine listens for packets for a service type specified for the first virtual server.

17. The system of claim 11, wherein the intermediary device establishes a first listening priority for the first virtual server and establishes a second listening policy and a second listening priority for a second virtual server.

18. The system of claim 17, wherein the packet engine listens on the first IP address and the first port specified for both the first virtual server and the second virtual server.

19. The system of claim 18, wherein the intermediary evaluates the first listening policy and the second listening policy to the first packet and determines that the first packet matches both the first listening policy and the second listening policy.

20. The system of claim 19, wherein the intermediary devices determines to forward the first packet to the second virtual server instead of the first virtual server based on a comparison of the second listening priority to the first listening priority.