Distributing packets among multiple tiers of network appliances

• US 6,891,839 B2
• Filed: 01/26/2001
• Issued: 05/10/2005
• Est. Priority Date: 07/01/1999
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Albert, Mark, Batz, Robert, O'Rourke, Chris, Gray, Richard, Tsang, Tzu-Ming, Tiwari, Pranav, Menditto, Louis, McGuire, Jacob Mark
• Primary Examiner(s): Nguyen, Brian
• Assistant Examiner(s): Moore, Ian N.
• Application Number:
  US09/771,232
• Publication Number:
  US 20020141401A1
• Time in Patent Office: 1,565 Days
• Field of Search: 370/392, 370/487, 370/401, 370/350, 370/389, 370/254, 370/252, 370/230, 370/395.1, 370/395.3, 370/395.32, 370/400, 370/402, 370/459, 370/467, 370/351, 370/339, 370/345.1, 370/345.3, 370/345.32, 370/469, 709/245, 709/225, 709/220, 709/229, 709/236, 713/201, 713/200, 713/162
• US Class Current: 370/401
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/243 using M+N parallel active paths
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 45/76 Routing in software-defined topologies, e.g. routing between virtual machines
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network is disclosed that includes a first tier of forwarding agents connected to a first tier of network devices. A second tier of forwarding agents is connected to a second tier of network devices. A service manager is configured to receive a packet from one of the forwarding agents; determine the tier of the forwarding agent; and send an instruction to the forwarding agent directing the forwarding agent to forward the packet to a network device connected to the tier of forwarding agents that includes the forwarding agent.

Claims

1. A network comprising:

a first tier of forwarding agents coupled to a client via a network, wherein the client is operable to generate a request that includes a packet;

a second tier of forwarding agents connected to a plurality of network devices; and

a service manager configured to;

receive the packet from a selected one of the forwarding agents included in the first tier of forwarding agents;

send a first tier instruction to the selected forwarding agent included in the first tier of forwarding agents directing the selected forwarding agent to forward the packet to a selected one of a plurality of firewalls that is coupled to the first and second tiers of forwarding agents and that is assigned by the service manager, wherein the selected firewall forwards the packet on to a selected one of the forwarding agents in the second tier;

receive the packet back from the selected forwarding agent in the second tier; and

respond to receiving the packet by providing a second tier instruction for the selected forwarding agent in the second tier to forward the packet on to a selected one of the plurality of network devices.

2. A network as recited in claim 1, wherein the service manager is further configured to:

determine whether the packet belongs to a connection that has already been assigned to a selected one of the firewalls; and

in the event that the connection has been assigned to the selected firewall, selecting the selected firewall to receive the packet.

3. A network as recited in claim 2, wherein the selected firewall is initially chosen by the service manager for the packet that requests the connection, and wherein the selected firewall is chosen for an additional packet that responds to the packet.

4. A network as recited in claim 1, wherein the first tier of forwarding agents is determined by a subnet of the first tier of forwarding agents.

5. A network as recited in claim 1, wherein the first tier of forwarding agents are determined by a port of the first tier of forwarding agents.

6. A network as recited in claim 1, wherein the first tier of forwarding agents are determined by an inclusion of IP addresses of the first tier of forwarding agents included in a list.

7. A network as recited in claim 1, wherein the second tier of forwarding agents are operable to communicate with the first tier of forwarding agents.

8. A service manager configured to distribute packets to multiple tiers of forwarding agents comprising:

a network interface configured

receive a packet from a selected one of a plurality of forwarding agents included in a first tier of forwarding agents, the packet being generated by a client that is coupled to the selected forwarding agent included in the first tier of forwarding agents;

send a first tier instruction to the selected forwarding agent included in the first tier of forwarding agents directing the selected forwarding agent to forward the packet to a selected one of a plurality of firewalls that is coupled to the first tier of forwarding agents, wherein the selected firewall forwards the packet on to a selected one of a plurality of forwarding agents included a second tier of forwarding agents;

receive the packet back from the selected forwarding agent in the second tier; and

respond to receiving the packet by providing a second tier instruction for the selected forwarding agent in the second tier to forward the packet on to a selected one of a plurality of network devices.

9. A service manager as recited in claim 8, wherein a processor is further configured to:

determine whether the packet belongs to a connection that has already been assigned to a selected one of the firewalls; and

in the event that the connection has been assigned to the selected firewalls, selecting the selected firewall to receive the packet.

10. A service manager as recited in claim 9, wherein the selected firewall is initially chosen by the service manager for the packet that requests the connection, and wherein the selected firewall is chosen for an additional packet that responds to the packet.

11. A service manager as recited in claim 8, wherein the first tier of forwarding agents is determined by a subnet of the first tier of forwarding agents.

12. A service manager as recited in claim 8, wherein the first tier of forwarding agents are determined by a port of the first tier of forwarding agents.

13. A service manager as recited in claim 8, wherein the first tier of forwarding agents are determined by an inclusion of IP addresses of the first tier of forwarding agents included in a list.

14. A method of distributing packets to multiple tiers of forwarding agents comprising:

receiving a packet from a selected one of a plurality of forwarding agents included in a first tier of forwarding agents, the packet being generated by a client that is coupled to the selected forwarding agent included in the first tier of forwarding agents;

sending a first tier instruction to the selected forwarding agent included in the first tier of forwarding agents directing the selected forwarding agent to forward the packet to a selected one of a plurality of firewalls that is coupled to the first tier of forwarding agents, wherein the selected firewall forwards the packet on to a selected one of a plurality of forwarding agents included a second tier of forwarding agents;

receiving the packet back from the selected forwarding agent in the second tier; and

responding to receiving the packet by providing a second tier instruction for the selected forwarding agent in the second tier to forward the packet on to a selected one of a plurality of network devices.

15. A computer program product for distributing packets to multiple tiers of forwarding agents, the computer program product being embodied in a computer readable medium and comprising computer code such that when executed is operable to:

receive a packet from a selected one of a plurality of forwarding agents included in a first tier of forwarding agents, the packet being generated by a client that is coupled to the selected forwarding agent included in the first tier of forwarding agents;

send a first tier instruction to the selected forwarding agent included in the first tier of forwarding agents directing the selected forwarding agent to forward the packet to a selected one of a plurality of firewalls that is coupled to the first tier of forwarding agents, wherein the selected firewall forwards the packet on to a selected one of a plurality of forwarding agents included a second tier of forwarding agents;

receive the packet back from the selected forwarding agent in the second tier; and

respond to receiving the packet by providing a second tier instruction for the selected forwarding agent in the second tier to forward the packet on to a selected one of a plurality of network devices.

16. A service manager configured to distribute packets to multiple tiers of forwarding agents comprising:

means for receiving a packet from a selected one of a plurality of forwarding agents included in a first tier of forwarding agents, the packet being generated by a client that is coupled to the selected forwarding agent included in the first tier of forwarding agents;

means for sending a first tier instruction to the selected forwarding agent included in the first tier of forwarding agents directing the selected forwarding agent to forward the packet to a selected one of a plurality of firewalls that is coupled to the first tier of forwarding agents, wherein the selected firewall forwards the packet on to a selected one of a plurality of forwarding agents included a second tier of forwarding agents;

means for receiving the packet back from the selected forwarding agent in the second tier; and

means for responding to receiving the packet by providing a second tier instruction for the selected forwarding agent in the second tier to forward the packet on to a selected one of a plurality of network devices.