Systems and Methods for Policy Based Integration to Horizontally Deployed WAN Optimization Appliances

• US 20120173759A1
• Filed: 12/27/2011
• Published: 07/05/2012
• Est. Priority Date: 12/29/2010
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Agarwal, Mugdha, Choudhary, Akshat
• Granted Patent: US 9,065,866 B2
• Time in Patent Office: Days
• US Class Current: 709/241
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

The present disclosure presents systems and methods for policy-based redirection of network traffic, by an intermediary device, to a horizontally deployed WAN device. An intermediary receives a request from a client to access a server. The request was previously modified by a first WAN device to include information in an option field of a transport layer. The intermediary may determine, responsive to a redirection policy, to send the request to a second WAN device deployed horizontally from the intermediary, instead of the server. The intermediary transmits the request to the second WAN device, while maintaining the information from the option field. The intermediary device receives the request including the information identifying the first WAN optimization device to the second WAN device. The intermediary receives a modified request from the second WAN device, the modified request determined by the intermediary to be sent to the destination server.

Claims

1. A method for redirecting client requests, by an intermediary device, to a horizontally deployed Wide Area Network (WAN) optimization device providing service to the client request, the method comprising:

(a) receiving via a first transport layer connection, by an intermediary device deployed between a plurality of clients and one or more servers, a first request from a first client of the plurality of clients to access a first server of the one or more servers, the first request modified by a first Wide Area Network (WAN) optimization device deployed between the client and the intermediary device to include information in a first option field of a transport layer header of the first request for processing by a second WAN optimization device;

(b) determining, by the intermediary device, responsive to a redirection policy, to send the first request to the second WAN optimization device instead of the server, the second WAN optimization device deployed horizontally to the intermediary device;

(c) establishing, by the intermediary device, a second transport layer connection with the second WAN optimization device; and

(d) transmitting, by the intermediary device, the first request to the second WAN optimization device via the second transport layer connection.

2. The method of claim 1, further comprising including the information in the first option field of the first request in a second option field of a transport layer header of the first request send via the second transport layer connection to the second WAN optimization device.

3. The method of claim 1, wherein the information included in the first option field of the first request for processing by the second WAN optimization device comprises information identifying the first WAN optimization device to the second WAN optimization device.

4. The method of claim 1, wherein the information included in the first option field of the first request comprises instructions to the second WAN optimization device for processing a payload of the first request.

5. The method of claim 1, wherein determining to send the first request to the second WAN optimization device instead of the server comprises identifying a presence of the information in the first option field of the first request.

6. The method of claim 1, wherein determining to send the first request to the second WAN optimization device instead of the server comprises comparing a source IP address of the first client to a predetermined IP address.

7. The method of claim 1, further comprising receiving, by the intermediary device from the second WAN optimization device, the first request processed by the second WAN optimization device to uncompress a payload of the first request.

8. The method of claim 1, further comprising receiving, by the intermediary device from the second WAN optimization device, the first request processed by the second WAN optimization device to form a second request and determining, by the intermediary device, to transmit the second request to the server identified by the first request, responsive to identifying that the second request is received after processing of the first request by the second WAN optimization device.

9. A method for redirecting a message between a client and server, by an intermediary device, to a horizontally deployed network device providing a predetermined service to the message, the method comprising:

(a) receiving via a first transport layer connection, by an intermediary device deployed between a plurality of clients and one or more servers, a message between a client of the plurality of clients and a server of the one or more servers, the message comprising a transport layer option recognizable by a second network device providing a predetermined service;

(b) determining, by a virtual server of the intermediary device, that the message comprises the transport layer option matching an expression of a policy of the virtual server, the policy identifying that the message is to be redirected to the second network device for further processing; and

(c) transmitting, by the virtual server via a second transport layer connection responsive to the determination, the message to the second network device, the second network device processing the message to provide the predetermined service; and

(d) receiving, by the intermediary device, the message processed by the second network device.

10. The method of claim 10, wherein step (a) further comprises receiving, by the intermediary device, the message comprising one of a request from the client to the server or one of a response from the server to the client.

11. The method of claim 10, wherein step (b) further comprises determining, by the virtual server, that one of a name or a value of the transport layer option in the message matches the expression of the policy.

12. The method of claim 10, wherein step (c) further comprises including, by the virtual server, in the message redirected to the second network device the transport layer option matching the policy.

13. The method of claim 10, wherein step (d) further comprises determining, by the intermediary device via the media access control (MAC) address of the processed message, that the processed message was transmitted by the second network device.

14. The method of claim 10, wherein step (d) further comprises determining, by the intermediary device, to transmit the processed message to one of the client or the server.

15. A system for redirecting a message between a client and server, by an intermediary device, to a horizontally deployed network device providing a predetermined service to the message, the system comprising:

an intermediary device deployed between a plurality of clients and one or more servers;

a second network device deployed horizontally to the intermediary device, the second network device providing a predetermined service;

wherein the intermediary device receives a message between a client of the plurality of clients and a server of the one or more servers, the message comprising a transport layer option recognizable by the second network device;

a virtual server of the intermediary device determines that the message comprises the transport layer option matching an expression of a policy of the virtual server, the policy identifying that the message is to be redirected to the second network device for further processing and transmits via a second transport layer connection responsive to the determination, the message to the second network device, the second network device processing the message to provide the predetermined service; and

wherein the intermediary device receives the message processed by the second network device.

16. The system of claim 15, wherein the intermediary device receives the message comprising one of a request from the client to the server or one of a response from the server to the client.

17. The system of claim 15, wherein the virtual server determines that one of a name or a value of the transport layer option in the message matches the expression of the policy.

18. The system of claim 15, wherein the virtual server includes in the request redirected to the second network device the transport layer option matching the policy.

19. The system of claim 15, wherein the intermediary device determines via the media access control (MAC) address of the processed message that the processed message was transmitted by the second network device.

20. The system of claim 15, wherein the intermediary device determines to transmit the processed message to one of the client or the server.