Switch management system and method

• US 8,069,233 B2
• Filed: 11/06/2006
• Issued: 11/29/2011
• Est. Priority Date: 09/13/2000
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Fortinet Inc.
• Inventors: Matthews, Abraham R., Berenberg, Anna
• Primary Examiner(s): Gillis, Brian J
• Application Number:
  US11/557,096
• Publication Number:
  US 20070083528A1
• Time in Patent Office: 1,849 Days
• Field of Search: 709/223, 709/249, 718/1, 718/104
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 45/10 Routing in connection-oriented networks, e.g. X.25 or ATM

Abstract

A system and method of managing a switch includes installing a switch having a plurality of processor elements, installing an operating system on each processor element, creating a system virtual router and configuring the processor elements from the system virtual router.

Claims

1. A method comprising:

providing a network operating system (NOS) on each processor element (PE) of a plurality of PEs of a switch in which software objects represent a basic unit of management, the NOS including an object manager (OM) having three layers, (i) an OM controller and database (OMCD) layer responsible for managing virtual private network (VPN) and virtual router (VR) configuration, (ii) an OM object routing and interface global (OMORIG) layer, running on a master control blade of a plurality of blades of the switch, responsible for managing global software object groups and software object configurations, and (iii) an OM object routing and interface (OMORI) layer, an instance of which executes on each blade of the plurality of blades of the switch, responsible for managing local software objects and groups as well as routing control information between address spaces based on locations of software objects and interfacing with the software objects via method invocation;

responsive to receiving a request to create a VR for a VPN on a control blade of the plurality of blades, the OMCD layer creating a unique VR descriptor for the VR within the context of the VPN and adding the VR to a list of VRs associated with the VPN;

the OMCD layer requesting the OMORIG layer to create a corresponding software object group to encompass a plurality of software objects which comprise the VR and which are located in different address spaces;

the OMORIG layer creating the corresponding software object group, identifying a plurality of OMORI layers running in the different address spaces that are capable of supporting the plurality of software objects, and requesting the capable OMORI layers to create the plurality of software objects; and

the capable OMORI layers creating object descriptors for the plurality of software objects, calling appropriate class constructors to create and initialize the plurality of software objects, and causing the plurality of software objects to be activated.

2. The method of claim 1, further comprising:

responsive to receiving a request to delete the VR, the OMCD layer looking up the VR descriptor and requesting the OMORIG layer to delete the corresponding software object group;

the OMORIG layer filtering the capable OMORI layers that have software objects to be destroyed and requesting the capable OMORI layers to destroy the plurality of software objects of the corresponding software object group; and

the capable OMORI layers causing the plurality of software objects to stop operating, causing all connections between the plurality of software objects and other software objects to be destroyed, and causing data structures associated with the plurality of software objects to be deallocated.

3. The method of claim 2, wherein the OMORIG layer and the OMORI layers communicate via a predefined channel of a dynamic messaging layer (DML) of the NOS.

4. The method of claim 2, wherein the switch provides a customer of a plurality of customers of a service provider operating the switch with discrete customized services by providing the customer with the ability to configure the plurality of software objects.

5. The method of claim 4, wherein the plurality of software objects represents network resources of the switch sufficient to provide the customer with network-based managed firewall services.

6. The method of claim 4, wherein the plurality of software objects represents network-based managed Internet Protocol (IP) services configured for the customer.

7. A switch comprising:

a plurality of processor elements upon which a network operating system (NOS), in which software objects represent a basic unit of management, is executing;

wherein the NOS comprises an object manager (OM) having three layers, including (i) an OM controller and database (OMCD) layer, (ii) an OM object routing and interface global (OMORIG) layer and (iii) an OM object routing and interface (OMORI) layer, the OMCD layer responsible for managing virtual private network (VPN) and virtual router (VR) configuration, the OMORIG layer, configured to run on a master control blade of a plurality of blades of the switch and responsible for managing global software object groups and software object configurations, the OMORI layer, an instance of which is configured to execute on each blade of the plurality of blades of the switch, responsible for managing local software objects and groups as well as routing control information between address spaces based on locations of software objects and interfacing with the software objects via method invocation;

a distributed message layer (DML) through which the OMORIG layer and OMORI layer communicate via a predefined channel;

wherein responsive to receiving a request to create a VR for a VPN on a control blade of the plurality of blades;

the OMCD layer creates a unique VR descriptor for the VR within the context of the VPN and adds the VR to a list of VRs associated with the VPN;

the OMCD layer requests the OMORIG layer to create a corresponding software object group to encompass a plurality of software objects which comprise the VR and which are located in different address spaces;

the OMORIG layer creates the corresponding software object group, identifying a plurality of OMORI layers running in the different address spaces that are capable of supporting the plurality of software objects, and requesting the capable OMORI layers to create the plurality of software objects; and

the capable OMORI layers create object descriptors for the plurality of software objects, calling appropriate class constructors to create and initialize the plurality of software objects, and causing the plurality of software objects to be activated.

8. The switch of claim 7, wherein responsive to receiving a request to delete the VR:

the OMCD layer looks up the VR descriptor and requests the OMORIG layer to delete the corresponding software object group;

the OMORIG layer filters the capable OMORI layers that have software objects to be destroyed and requests the capable OMORI layers to destroy the plurality of software objects of the corresponding software object group; and

the capable OMORI layers cause the plurality of software objects to stop operating, cause all connections between the plurality of software objects and other software objects to be destroyed, and cause data structures associated with the plurality of software objects to be deallocated.

9. The switch of claim 7, wherein the switch provides a customer of a plurality of customers of a service provider operating the switch with discrete customized services by providing the customer with the ability to configure the plurality of software objects and wherein the plurality of software objects represents network resources of the switch sufficient to provide the customer with network-based managed firewall services.

10. The switch of claim 7, wherein the switch provides a customer of a plurality of customers of a service provider operating the switch with discrete customized services by providing the customer with the ability to configure the plurality of software objects and wherein the plurality of software objects represents network-based managed Internet Protocol (IP) services configured for the customer.

11. A non-transitory computer-readable storage medium of a switch tangibly embodying a set of instructions representing a network operating system (NOS) for a plurality of processor elements (PEs) of the switch in which software objects represent a basic unit of management and which when executed by the plurality of PEs cause the PEs to perform a method comprising:

forming three layers within an object manager (OM) of the NOS, including (i) an OM controller and database (OMCD) layer responsible for managing virtual private network (VPN) and virtual router (VR) configuration, (ii) an OM object routing and interface global (OMORIG) layer, running on a master control blade of a plurality of blades of the switch, responsible for managing global software object groups and software object configurations, and (iii) an OM object routing and interface (OMORI) layer, an instance of which executes on each blade of the plurality of blades of the switch, responsible for managing local software objects and groups as well as routing control information between address spaces based on locations of software objects and interfacing with the software objects via method invocation;

responsive to receiving a request to create a VR for a VPN on a control blade of the plurality of blades, the OMCD layer creating a unique VR descriptor for the VR within the context of the VPN and adding the VR to a list of VRs associated with the VPN;

the OMCD layer requesting the OMORIG layer to create a corresponding software object group to encompass a plurality of software objects which comprise the VR and which are located in different address spaces;

the OMORIG layer creating the corresponding software object group, identifying a plurality of OMORI layers running in the different address spaces that are capable of supporting the plurality of software objects, and requesting the capable OMORI layers to create the plurality of software objects; and

the capable OMORI layers creating object descriptors for the plurality of software objects, calling appropriate class constructors to create and initialize the plurality of software objects, and causing the plurality of software objects to be activated.

12. The non-transitory computer-readable storage medium of claim 11, wherein the method further comprises:

responsive to receiving a request to delete the VR, the OMCD layer looking up the VR descriptor and requesting the OMORIG layer to delete the corresponding software object group;

the OMORIG layer filtering the capable OMORI layers that have software objects to be destroyed and requesting the capable OMORI layers to destroy the plurality of software objects of the corresponding software object group; and

the capable OMORI layers causing the plurality of software objects to stop operating, causing all connections between the plurality of software objects and other software objects to be destroyed, and causing data structures associated with the plurality of software objects to be deallocated.

13. The non-transitory computer-readable storage medium of claim 11, wherein the switch provides a customer of a plurality of customers of a service provider operating the switch with discrete customized services by providing the customer with the ability to configure the plurality of software objects.

14. The non-transitory computer-readable storage medium of claim 13, wherein the plurality of software objects represents network resources of the switch sufficient to provide the customer with network-based managed firewall services.

15. The non-transitory computer-readable storage medium of claim 13, wherein the plurality of software objects represents network-based managed Internet Protocol (IP) services configured for the customer.