Services controlled session based flow interceptor

• US 20130073743A1
• Filed: 09/19/2011
• Published: 03/21/2013
• Est. Priority Date: 09/19/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Ramasamy, Arivu, Cieslak, Martin, Ervin, Jim, Seils, Zach, Anand, Venkataraman, Black, Tom
• Granted Patent: US 9,319,459 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 67/1006 with static server selection, e.g. the same server being selected for a specific client
• CPC Class Codes: H04L 67/1027 Persistence of sessions during load balancing
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In one embodiment, a method includes receiving session information at a traffic interceptor in communication with a plurality of service devices, the session information transmitted from one of the service devices and identifying flows associated with a session and the service device associated with the session, storing the session information at the traffic interceptor, and transmitting traffic received at the traffic interceptor to the service device selected based on the session information. An apparatus is also disclosed.

Claims

1. A method comprising:

receiving session information at a traffic interceptor in communication with a plurality of service devices, said session information transmitted from one of the service devices and identifying flows associated with a session and the service device associated with the session;

storing said session information at the traffic interceptor; and

transmitting traffic received at the traffic interceptor to the service device selected based on said session information.

2. The method of claim 1 wherein storing said session information comprises storing a flow entry mapping the flows associated with the session to the service device transmitting the session information.

3. The method of claim 1 further comprising performing a lookup in a flow table containing said session information to select the service device.

4. The method of claim 1 wherein the session comprises an application session.

5. The method of claim 1 wherein said session information comprises three or more of a source address, a source port, a destination address, a destination port, and a protocol.

6. The method of claim 1 wherein the service devices are configured for wide area application services.

7. The method of claim 1 wherein the service devices are configured for firewall services.

8. The method of claim 1 wherein said session information identifies a flow before and after address translation.

9. The method of claim 1 wherein said session information comprises application level information.

10. An apparatus comprising:

an interface for communication with a plurality of service devices;

a processor for receiving session information transmitted from one of the service devices and identifying flows associated with a session and the service device associated with the session, and transmitting traffic to the service device selected based on said session information; and

memory for storing said session information.

11. The apparatus of claim 10 wherein said memory comprises a table for storing a flow entry mapping the flows associated with the session to the service device transmitting the session information.

12. The apparatus of claim 10 wherein the processor is further configured for performing a lookup in a flow table containing said session information to select the service device.

13. The apparatus of claim 10 wherein the session comprises an application session.

14. The apparatus of claim 10 wherein said session information comprises three or more of a source address, a source port, a destination address, a destination port, and a protocol.

15. The apparatus of claim 10 wherein the service devices are configured for wide area application services.

16. The apparatus of claim 10 wherein the service devices are configured for firewall services.

17. The apparatus of claim 10 wherein said session information identifies a flow before and after address translation.

18. The apparatus of claim 10 wherein said session information comprises application level information.

19. Logic encoded on one or more tangible computer readable media for execution and when executed operable to:

receive session information at a traffic interceptor in communication with a plurality of service devices, said session information transmitted from one of the service devices and identifying flows associated with a session and the service device associated with the session; and

search said session information for the flow corresponding to a received packet and identify the service device to transmit the packet based on said session information.

20. The logic of claim 19 wherein said session information comprises application level information.