Highly scalable architecture for application network appliances

• US 7,921,686 B2
• Filed: 04/11/2008
• Issued: 04/12/2011
• Est. Priority Date: 08/28/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Patra, Abhijit, Prabhu, Kirti, Thakar, Anant, Bagepalli, Nagaraj, Gandhi, Prashant
• Primary Examiner(s): Jacobs; Lashonda T
• Application Number:
  US12/101,850
• Publication Number:
  US 20090063665A1
• Time in Patent Office: 1,096 Days
• Field of Search: 709/223, 709/224, 709/203, 709/217, 709/219, 370/352, 370/389, 370/401
• US Class Current: 70/223
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: Y10T 70/5827 Axially movable clutch

Abstract

A highly scalable application network appliance is described herein. According to one embodiment, a network element includes a switch fabric, a first service module coupled to the switch fabric, and a second service module coupled to the first service module over the switch fabric. In response to packets of a network transaction received from a client over a first network to access a server of a data center having multiple servers over a second network, the first service module is configured to perform a first portion of OSI (open system interconnection) compatible layers of network processes on the packets while the second service module is configured to perform a second portion of the OSI compatible layers of network processes on the packets. The first portion includes at least one OSI compatible layer that is not included in the second portion. Other methods and apparatuses are also described.

Claims

1. A network device comprising:

a switch fabric;

a first service module coupled to the switch fabric; and

a second service module coupled to the first service module over the switch fabric,

wherein in response to packets of a network transaction received from a client device over a first network to access a server of a data center having a plurality of servers over a second network, the first service module is configured to;

perform a first portion of OSI (open system interconnection) compatible layers of network processes on the packets;

wherein the second service module is configured to perform a second portion of the OSI compatible layers of network processes on the packets and

wherein the first portion includes at least one OSI compatible layer that is not included in the second portion.

2. The network device of claim 1, wherein the network device is configured to operate as a security gateway between the client device and any of the plurality of servers.

3. The network device of claim 1, wherein the switch fabric is a lossless switch fabric.

4. The network device of claim 1, wherein the first service module is implemented in a first service plane and the second service module is implemented in a second service plane coupled to the first service plane via a backplane.

5. The network device of claim 4, wherein the backplane includes at least a portion of connections to the switch fabric.

6. The network device of claim 1, wherein the first service module is configured to perform layer 2 to layer 5 (layers 2-5) of the network processes on the packets, and wherein the second service module is configured to perform layer 6 to layer 7 (layer 6-7) of the network processes on the packets.

7. The network device of claim 6, wherein after performing the layers 2-5 of the network processes, the first service module is configured to transmit a data stream to the second service module over the switch fabric.

8. The network device of claim 7, wherein the data stream represents the packets without header information associated with layers 2-5.

9. The network device of claim 1, wherein each of the first and second service modules is configured to perform anyone or more of OSI compatible layers of network processes.

10. The network device of claim 9, further comprising a memory configured to store information indicating which of the plurality of OSI compatible layers of network processes that the first and second service modules are to perform respectively.

11. A method comprising:

at a network device, receiving packets of a network transaction from a client device over a first network for accessing a server of a data center having a plurality of servers over a second network;

processing at a first service module of the network device a first portion of OSI (open system interconnection) compatible layers of network processes on the packets; and

processing at a second service module of the network device a second portion of OSI compatible layers of network processes on the packets, wherein the first portion includes at least one layer that is not included in the second portion.

12. The method of claim 11, wherein receiving comprises receiving the packets such that the network device operates as a security gateway between the client device and any of the plurality of servers.

13. The method of claim 11, wherein receiving comprises receiving the packets over a switch fabric, wherein the switch fabric is a lossless switch fabric.

14. The method of claim 11, wherein processing the first portion of layers comprises processing the first portion of layers on the packets in a first service plane and wherein processing the second portion of layers comprises processing the second portion of layers on the packets in a second service plane coupled to the first service plane via a backplane.

15. The method of claim 14, wherein processing the first portion of layers comprises performing layer 2 to layer 5 (layers 2-5) network processes on the packets, and wherein processing the second portion of layers comprises performing layer 6 to layer 7 (layer 6-7) network processes on the packets.

16. The method of claim 15, further comprising after performing the layers 2-5 of the network processes, the first service module transmitting a data stream after the layers 2-5 processing for the second portion of layer processing.

17. The method of claim 16, wherein transmitting comprises transmitting the data stream that represents the packets without header information associated with layers 2-5 processing.

18. A machine-readable storage medium having instructions stored therein, which when executed by a processor, cause the processor to:

receive packets of a network transaction at a network device from a client device over a first network for accessing a server of a data center having a plurality of servers over a second network;

process at a first service module of the network device a first portion of OSI (open system interconnection) compatible layers of network processes on the packets; and

process at a second service module of the network device a second portion of OSI compatible layers of network processes on the packets, wherein the first portion includes at least one layer that is not included in the second portion.

19. The machine-readable storage medium of claim 18, wherein instructions that cause the processor to receive the packets comprise instructions that cause the processor to receive the packets such that the network device operates as a security gateway between the client device and any of the plurality of servers.

20. The machine-readable storage medium of claim 18, wherein the instructions that cause the processor to receive the packets comprise instructions that cause the processor to receive the packets over a switch fabric, wherein the switch fabric is a lossless switch fabric.

21. The machine-readable storage medium of claim 18, wherein the instructions that cause the processor to process the first portion of layers comprise instructions that cause the processor to process the first portion of layers on the packets in the first service module a first service plane and wherein the instructions that cause the processor to process the second portion of layers comprise instructions that cause the processor to process the second portion of layers on the packets in the second service module second service plane coupled to the first service plane via a backplane.

22. The machine-readable storage medium of claim 18, wherein the instructions that cause the processor to process the first portion of layers comprise instructions that cause the processor to perform layer 2 to layer 5 (layers 2-5) processing on the packets, and wherein the instructions that cause the processor to process the second portion of layers comprise instructions that cause the processor to perform layer 6 to layer 7 (layers 6-7) processing on the packets.

23. The machine-readable storage medium of claim 22, further comprising instructions that cause the processor to generate a data stream after layers 2-5 processing for performing the second portion of layer processing.

24. The machine-readable storage medium of claim 23, wherein the instructions that cause the processor to generate the data stream comprise instructions that cause the processor to the data stream that represents the packets without header information associated with the layers 2-5 processing.