Distributed virtual appliance

• US 9,112,812 B2
• Filed: 09/22/2011
• Issued: 08/18/2015
• Est. Priority Date: 09/22/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Embrane, Inc. (Cisco Systems, Inc.)
• Inventors: Di Benedetto, Marco, Malagrino, Dante, Salvatori, Alessandro, Chang, Arthur Lihder, Chander, Vijay, Flynn, Thomas Vincent
• Primary Examiner(s): Moise, Emmanuel L
• Assistant Examiner(s): ABU ROUMI, MAHRAN Y
• Application Number:
  US13/240,020
• Publication Number:
  US 20130080638A1
• Time in Patent Office: 1,426 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation

Abstract

A distributed virtual appliance is disclosed, including: allocating network traffic to a plurality of compute units implementing a network service associated with the distributed virtual appliance; and dynamically adding or removing one or more compute units implementing the network service without disruption to the network traffic.

Claims

1. A method for a distributed virtual appliance, comprising:

implementing the distributed virtual appliance to perform a network service, wherein the distributed virtual application comprises a plurality of compute units to operate together to implement the network service, wherein the plurality of compute units associated with the distributed virtual appliance is provisioned by a management tool, wherein implementing the distributed virtual appliance to perform the network service comprises;

configuring a first set of the plurality of compute units as a set of data planes dispatcher compute units, wherein a data planes dispatcher compute unit is configured to;

receive a packet associated with a network traffic flow via a network interface associated with the distributed virtual appliance; and

distribute the packet associated with the network traffic flow to a data plane compute unit of a set of data plane compute units of the plurality of compute units;

configuring a second set of the plurality of compute units as a set of data planes manager compute units, wherein a data planes manager compute unit is configured to;

receive a set of configuration information from the management tool, wherein the set of configuration information describes the network service to be performed by the distributed virtual appliance; and

send at least a portion of the set of configuration information associated with a data plane compute unit role to the data plane compute unit;

configuring a third set of the plurality of compute units as the set of data plane compute units, wherein the data plane compute unit is configured to;

receive the at least portion of the set of configuration information associated with the data plane compute unit role from the data planes manager compute unit;

receive the packet associated with the network traffic flow from the data planes dispatcher compute unit; and

process the packet associated with the network traffic flow based at least in part on the at least portion of the set of configuration information associated with the data plane compute unit role; and

dynamically adding or removing, by the management tool, one or more data plane compute units associated with implementing the network service without disruption to network traffic associated with the distributed virtual appliance based at least in part on a set of policies associated with a layout associated with the distributed virtual appliance.

2. The method of claim 1, wherein each of the plurality of compute units is implemented using a virtual machine on a computer.

3. The method of claim 1, wherein the network service includes one or more of the following:

intrusion detection, firewall, virtual private network (VPN), and load balancing.

4. The method of claim 1, wherein the network service comprises services associated with network layers 2, 3, 4, and/or 7.

5. The method of claim 1, wherein the data planes dispatcher compute unit is configured to distribute a plurality of network traffic flows to at least a subset of the set of data plane compute units based at least in part on tunneling over a logical in-band bus.

6. The method of claim 5, wherein the data planes dispatcher compute unit is configured to distribute each of the plurality of network traffic flows consistently across the set of data plane compute units.

7. The method of claim 1, wherein the data planes dispatcher is configured to distribute a variable amount of network traffic to at least one of the set of data plane compute units.

8. The method of claim 1, wherein the set of data plane compute units includes at least a first data plane compute unit and a second data plane compute unit, and further comprising:

removing the first data plane compute unit from the distributed virtual appliance; and

automatically reallocating a portion of the network traffic from the first data plane to one or more other data plane compute units, including the second data plane compute unit, without disruption to the network traffic.

9. The method of claim 1, wherein the network traffic flow is consistently distributed to the data plane compute unit until the network traffic flow terminates.

10. The method of claim 1, further comprising:

receiving one or more input parameters at an application programming interface (API) associated with defining the distributed virtual appliance; and

translating the one or more input parameters into the set of policies associated with the layout associated with the distributed virtual appliance.

11. The method of claim 10, wherein the set of policies associated with the layout associated with the distributed virtual appliance includes one or more of the following:

a condition for when a new compute unit is to be added, a condition for when a compute unit is to be removed, bandwidth properties, throughput properties, latency properties, reliability characteristics properties, a number of data plane compute units to be allocated for the distributed virtual appliance, and a number of data planes dispatcher compute units to manage the allocated data plane compute units.

12. The method of claim 1, wherein the layout associated with the distributed virtual appliance is configured by the management tool.

13. The method of claim 1, wherein implementing the network service associated with the distributed virtual appliance is based at least in part on the set of configuration information associated with the distributed virtual appliance.

14. A distributed virtual appliance system, comprising:

a processor configured to;

implement the distributed virtual appliance to perform a network service, wherein the distributed virtual application comprises a plurality of compute units to operate together to implement the network service, wherein the plurality of compute units associated with the distributed virtual appliance is provisioned by a management tool, wherein to implement the distributed virtual appliance to perform the network service comprises to;

configure a first set of the plurality of compute units as a set of data planes dispatcher compute units, wherein a data planes dispatcher compute unit of the set of data planes dispatcher compute units is configured to;

receive a packet associated with a network traffic flow via a network interface associated with the distributed virtual appliance; and

distribute the packet associated with the network traffic flow to a data plane compute unit of a set of data plane compute units of the plurality of compute units;

configure a second set of the plurality of compute units as a set of data planes manager compute units, wherein a data planes manager compute unit is configured to;

receive a set of configuration information from the management tool, wherein the set of configuration information describes the network service to be performed by the distributed virtual appliance; and

send at least a portion of the set of configuration information associated with a data plane compute unit role to the data plane compute unit;

configure a third set of the plurality of compute units as the set of data plane compute units, wherein the data plane compute unit is configured to;

receive the at least portion of the set of configuration information associated with the data plane compute unit role from the data planes manager compute unit;

receive the packet associated with the network traffic flow from the data planes dispatcher compute unit; and

process the packet associated with the network traffic flow based at least in part on the at least portion of the set of configuration information associated with the data plane compute unit role; and

dynamically add or remove, by the management tool, one or more data plane compute units implementing the network service without disruption to network traffic associated with the distributed virtual appliance based at least in part on a set of policies associated with a layout associated with the distributed virtual appliance; and

a memory coupled to the processor and configured to provide the processor with instructions.

15. The system of claim 14, wherein the network service comprises services associated with network layers 2, 3, 4, and/or 7.

16. The system of claim 14, wherein the data planes dispatcher compute unit is configured to distribute a plurality of network traffic flows to at least a subset of the set of data plane compute units based at least in part on tunneling over a logical in-band bus.

17. The system of claim 14, wherein the data planes dispatcher compute unit is configured to distribute each of the plurality of network traffic flows consistently across the set of data plane compute units.

18. The system of claim 14, wherein the set of data plane compute units includes at least a first data plane compute unit and a second data plane compute unit, and wherein the processor is further configured to:

remove the first data plane compute unit from the distributed virtual appliance; and

automatically reallocate a portion of the network traffic from the first data plane to one or more other data plane compute units, including the second data plane compute unit, without disruption to the network traffic.

19. The system of claim 14, wherein the network traffic flow is consistently distributed to one of the data plane compute unit units until the network traffic flow terminates.

20. The system of claim 14, wherein the processor is further configured to:

receive one or more input parameters at an application programming interface (API) associated with defining the distributed virtual appliance; and

translate the one or more input parameters into the set of policies associated with the layout associated with the distributed virtual appliance.

21. The system of claim 20, wherein the set of policies associated with the layout associated with the distributed virtual appliance includes one or more of the following:

a condition for when a new compute unit is to be added, a condition for when a compute unit is to be removed, bandwidth properties, throughput properties, latency properties, reliability characteristics properties, a number of data plane compute units to be allocated for the distributed virtual appliance, and a number of data planes dispatcher compute units to manage the allocated data plane compute units.

22. A computer program product for a distributed virtual appliance, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:

implementing the distributed virtual appliance to perform a network service, wherein the distributed virtual application comprises a plurality of compute units to operate together to implement the network service, wherein the plurality of compute units associated with the distributed virtual appliance is provisioned by a management tool, wherein implementing the distributed virtual appliance to perform the network service comprises;

configuring a first set of the plurality of compute units as a set of data planes dispatcher compute units, wherein a data planes dispatcher compute unit is configured to;

receive a packet associated with a network traffic flow via a network interface associated with the distributed virtual appliance; and

distribute the packet associated with the network traffic flow to a data plane compute unit of a set of data plane compute units of the plurality of compute units;

configuring a second set of the plurality of compute units as a set of data planes manager compute units, wherein a data planes manager compute unit is configured to;

receive a set of configuration information from the management tool, wherein the set of configuration information describes the network service to be performed by the distributed virtual appliance; and

send at least a portion of the set of configuration information associated with a data plane compute unit role to the data plane compute unit;

configuring a third set of the plurality of compute units as the set of data plane compute units, wherein the data plane compute unit is configured to;

receive the at least portion of the set of configuration information associated with the data plane compute unit role from the data planes manager compute unit;

receive the packet associated with the network traffic flow from the data planes dispatcher compute unit; and

process the packet associated with the network traffic flow based at least in part on the at least portion of the set of configuration information associated with the data plane compute unit role; and

dynamically adding or removing, by the management tool, one or more data plane compute units implementing the network service without disruption to network traffic associated with the distributed virtual appliance based at least in part on a set of policies associated with a layout associated with the distributed virtual appliance.

23. A method for a distributed virtual appliance, comprising:

implementing the distributed virtual appliance to perform a network service, wherein the distributed virtual application comprises a plurality of compute units to operate together to implement the network service, wherein the plurality of compute units associated with the distributed virtual appliance is provisioned by a management tool, wherein each compute unit is implemented using a virtual machine executed on a computer, wherein implementing the distributed virtual appliance to perform the network service comprises;

configuring a first set of the plurality of compute units as a set of data planes dispatcher compute units, wherein a data planes dispatcher compute unit is configured to;

receive a packet associated with a network traffic flow via a network interface associated with the distributed virtual appliance; and

distribute the packet associated with the network traffic flow to a data plane compute unit of a set of data plane compute units of the plurality of compute units;

configuring a second set of the plurality of compute units as a set of data planes manager compute units, wherein a data planes manager compute unit is configured to;

receive a set of configuration information from the management tool, wherein the set of configuration information describes the network service to be performed by the distributed virtual appliance; and

send at least a portion of the set of configuration information associated with a data plane compute unit role to the data plane compute unit;

configuring a third set of the plurality of compute units as the set of data plane compute units, wherein the data plane compute unit is configured to;

receive the at least portion of the set of configuration information associated with the data plane compute unit role from the data planes manager compute unit;

receive the packet associated with the network traffic flow from the data planes dispatcher compute unit; and

process the packet associated with the network traffic flow based at least in part on the at least portion of the set of configuration information associated with the data plane compute unit role; and

adding, by a management tool, a new compute unit to the distributed virtual appliance based at least in part on a set of policies associated with a layout associated with the distributed virtual appliance, wherein the new compute unit is automatically self-configured for implementing the network service upon being added to the distributed virtual appliance, wherein the new compute unit is assigned a role within the distributed virtual appliance, wherein the new compute unit is configured to receive at least a portion of a set of configuration information associated with the distributed virtual appliance from the data planes manager compute unit, wherein the at least the portion of the set of configuration information received by the new compute unit is determined based at least in part on the role assigned to the new compute unit.

24. The method of claim 23, wherein the new compute unit is defined with the role prior to being added to the distributed virtual appliance.

25. The method of claim 23, wherein the at least portion of the set of configuration information associated with the distributed virtual appliance comprises a software image associated with the distributed virtual appliance and wherein the new compute unit is configured to run the software image.

26. The method of claim 23, further comprising using the data planes manager compute unit to send the at least portion of the set of configuration information to the new compute unit.

27. A distributed virtual appliance system, comprising:

a processor configured to;

implement the distributed virtual appliance to perform a network service, wherein the distributed virtual application comprises a plurality of compute units to operate together to implement the network service, wherein the plurality of compute units associated with the distributed virtual appliance is provisioned by a management tool, wherein each compute unit is implemented using a virtual machine executed on a computer, wherein to implement the distributed virtual appliance to perform the network service comprises to;

configure a first set of the plurality of compute units as a set of data planes dispatcher compute units, wherein a data planes dispatcher compute unit is configured to;

receive a packet associated with a network traffic flow via a network interface associated with the distributed virtual appliance; and

distribute the packet associated with the network traffic flow to a data plane compute unit of a set of data plane compute units of the plurality of compute units;

configure a second set of the plurality of compute units as a set of data planes manager compute units, wherein a data planes manager compute unit is configured to;

receive a set of configuration information from the management tool, wherein the set of configuration information describes the network service to be performed by the distributed virtual appliance; and

send at least a portion of the set of configuration information associated with a data plane compute unit role to the data plane compute unit;

configure a third set of the plurality of compute units as the set of data plane compute units, wherein the data plane compute unit is configured to;

receive the at least portion of the set of configuration information associated with the data plane compute unit role from the data planes manager compute unit;

receive the packet associated with the network traffic flow from the data planes dispatcher compute unit; and

process the packet associated with the network traffic flow based at least in part on the at least portion of the set of configuration information associated with the data plane compute unit role; and

add, by a management tool, a new compute unit to the distributed virtual appliance based at least in part on a set of policies associated with a layout associated with the distributed virtual appliance, wherein the new compute unit is automatically self-configured for implementing the network service upon being added to the distributed virtual appliance, wherein the new compute unit is assigned a role within the distributed virtual appliance, wherein the new compute unit is configured to receive at least a portion of a set of configuration information associated with the distributed virtual appliance from the data planes manager compute unit, wherein the at least the portion of the set of configuration information received by the new compute unit is determined based at least in part on the role assigned to the new compute unit; and

a memory coupled to the processor and configured to provide the processor with instructions.

28. The system of claim 27, wherein the new compute unit is defined with the role prior to being added to the distributed virtual appliance.

29. The system of claim 27, wherein the at least portion of the set of configuration information associated with the distributed virtual appliance comprises a software image associated with the distributed virtual appliance and wherein the new compute unit is configured to run the software image.

30. The system of claim 27, wherein the processor is further configured to use the data planes manager compute unit to send the at least portion of the set of configuration information to the new compute unit.

31. A computer program product for a distributed virtual appliance, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:

implementing the distributed virtual appliance to perform a network service, wherein the distributed virtual application comprises a plurality of compute units to operate together to implement the network service, wherein the plurality of compute units associated with the distributed virtual appliance is provisioned by a management tool, wherein each compute unit is implemented using a virtual machine executed on a computer, wherein implementing the distributed virtual appliance to perform the network service comprises;

configuring a first set of the plurality of compute units as a set of data planes dispatcher compute units, wherein a data planes dispatcher compute unit is configured to;

receive a packet associated with a network traffic flow via a network interface associated with the distributed virtual appliance; and

distribute the packet associated with the network traffic flow to a data plane compute unit of a set of data plane compute units of the plurality of compute units;

configuring a second set of the plurality of compute units as a set of data planes manager compute units, wherein a data planes manager compute unit is configured to;

receive a set of configuration information from the management tool, wherein the set of configuration information describes the network service to be performed by the distributed virtual appliance; and

send at least a portion of the set of configuration information associated with a data plane compute unit role to the data plane compute unit;

configuring a third set of the plurality of compute units as the set of data plane compute units, wherein the data plane compute unit is configured to;

receive the at least portion of the set of configuration information associated with the data plane compute unit role from the data planes manager compute unit;

receive the packet associated with the network traffic flow from the data planes dispatcher compute unit; and

process the packet associated with the network traffic flow based at least in part on the at least portion of the set of configuration information associated with the data plane compute unit role; and

adding, by a management tool, a new compute unit to the distributed virtual appliance based at least in part on a set of policies associated with a layout associated with the distributed virtual appliance, wherein the new compute unit is automatically self-configured for implementing the network service upon being added to the distributed virtual appliance, wherein the new compute unit is assigned a role within the distributed virtual appliance, wherein the new compute unit is configured to receive at least a portion of a set of configuration information associated with the distributed virtual appliance from the data planes manager compute unit, wherein the at least the portion of the set of configuration information received by the new compute unit is determined based at least in part on the role assigned to the new compute unit.