Cloud-based network tool optimizers for server cloud networks

• US 9,467,385 B2
• Filed: 05/29/2014
• Issued: 10/11/2016
• Est. Priority Date: 05/29/2014
• Status: Active Grant

• Current Assignee: Keysight Technologies Singapore (Holdings) Pte. Limited. (Keysight Technologies, Inc.)
• Original Assignee: ANUE Systems (Keysight Technologies, Inc.)
• Inventors: Raney, Kristopher
• Primary Examiner(s): NDIAYE, CHEIKH T
• Application Number:
  US14/290,343
• Publication Number:
  US 20150350095A1
• Time in Patent Office: 866 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Network tool optimizers for server cloud networks and related methods are disclosed. In part, master filters are defined to segregate and control user traffic, and user filters are defined to forward the user traffic to cloud-based network tools or tool instances. A master user interface and user interfaces for each user are provided so that the master filters and user filters can be defined and managed. A filter rules compiler within the cloud-based network tool optimizer then combines the master filters with the user filters, resolves conflicts in favor of the master filters, and generates filter engine rules that are applied to filter engines within the network tool optimizer for the cloud network. The filter engines then forward packets received at input ports for the network tool optimizer to output ports for the network tool optimizer that are coupled to network tools or tool instances within the cloud network.

Claims

1. A method for configuring and operating a network tool optimizer for cloud-based networks, comprising:

allowing configuration of one or more master filters to determine how packets from a cloud network are forwarded to a plurality of virtual ports, each virtual port being associated with a different user of cloud resources within the cloud network;

allowing configuration of a plurality of sets of one or more user filters, each set of one or more user filters being associated with a different user of cloud resources within the cloud network and determining how packets from a virtual port associated with that user are forwarded to one or more output ports for the network tool optimizer;

generating rules for filter engines based upon the one or more master filters and the plurality of sets of one or more user filters with conflicts between the master filters and user filters being resolved in favor of the master filters;

applying the rules to the filter engines within the network tool optimizer;

receiving packets from the cloud network at one or more input ports for the network tool optimizer; and

forwarding the received packets to one or more output ports for the network tool optimizer using the filter engines so that packet traffic for each user is forwarded based at least in part upon the set of one or more user filters for that user;

wherein the allowing steps comprise providing a master user interface to allow configuration of the master filters and providing one or more user interfaces to allow configuration of the user filters, the one or more user interfaces comprising a separate user interface for each user; and

wherein the master user interface displays filter information only for master filters between one or more input ports and the plurality of virtual ports, and wherein the one or more user interfaces display filter information only for user filters between the plurality of virtual ports and one or more output ports.

2. The method of claim 1, further comprising forwarding packets from the one or more output ports to one or more network monitoring tools coupled to the one or more output ports.

3. The method of claim 1, further comprising forwarding packets from one or more output ports to one or more network monitoring tool instances created within a processing system platform coupled to the one or more output ports.

4. The method of claim 1, wherein the received packets comprise copies of packets output by one or more servers within the cloud network.

5. The method of claim 1, wherein the received packets comprise copies of packets output by one or more server instances created by a processing system platform within the cloud network.

6. The method of claim 1, further comprising displaying only information relating to each user in the user interface for that user.

7. The method of claim 1, wherein the filter engines comprise one or more ingress filter engines associated with input ports for the network tool optimizer and one or more egress filter engines associated with output ports for the network tool optimizer.

8. The method of claim 7, further comprising applying rules associated with the master filters to the one or more ingress filter engines and applying rules associated with the user filters to the one or more egress filter engines.

9. The method of claim 1, wherein the one or more master filters are configurable to separate network traffic for different users of the cloud resources using one or more network identifiers for user packets.

10. The method of claim 9, wherein the network identifiers comprise virtual local area network (VLAN) identifiers, virtual extensible local area network (VXLAN) identifiers, or both VLAN and VXLAN identifiers.

11. The method of claim 9, wherein the one or more network identifiers are not available for configuration of the plurality of sets of one or more user filters.

12. The method of claim 11, further comprising allowing configuration of one or more master filters to add one or more network identifiers to the user packets forwarded to the one or more output ports for the network tool optimizer.

13. A network tool optimizer for cloud-based networks, comprising:

a plurality of input ports to receive network packets;

a plurality of output ports to output network packets;

a packet switch having filter engines that determine how network packets are forwarded from the input ports to the output ports within the network tool optimizer;

a master user interface to allow configuration of one or more master filters that determine how packets from the input ports are forwarded to a plurality of virtual ports, each virtual port being associated with a different user of cloud resources within a cloud network;

one or more user interfaces to allow configuration of a plurality of sets of one or more user filters to determine how packets from a virtual port associated with a user are forwarded to one or more output ports for the network tool optimizer, each set of one or more user filters being associated with a different user of cloud resources within the cloud network, and the one or more user interfaces comprising a separate user interface for each user; and

a filter processor to generate rules for the filter engines based upon the one or more master filters and the plurality of sets of one or more user filters with conflicts between the master filters and user filters being resolved in favor of the master filters and to apply the rules to the filter engines to forward packet traffic for each user based at least in part upon the set of one or more user filters for that user;

wherein the master user interface is configured to display filter information only for master filters between one or more input ports and the plurality of virtual ports, and wherein the one or more user interfaces are configured to display filter information only for user filters between the plurality of virtual ports and one or more output ports.

14. The network tool optimizer of claim 13, wherein each user interface is configured to display only information relating to its user.

15. The network tool optimizer of claim 13, wherein the filter engines comprise one or more ingress filter engines associated with input ports for the network tool optimizer and one or more egress filter engines associated with output ports for the network tool optimizer.

16. The method of claim 15, wherein the filter processor is further configured to apply rules associated with the master filters to the one or more ingress filter engines and to apply rules associated with the user filters to the one or more egress filter engines.

17. The network tool optimizer of claim 13, wherein the one or more master filters are configurable to separate network traffic for different users of the cloud resources using one or more network identifiers for user packets.

18. The network tool optimizer of claim 17, wherein the network identifiers comprise virtual local area network (VLAN) identifiers, virtual extensible local area network (VXLAN) identifiers, or both VLAN and VXLAN identifiers.

19. The network tool optimizer of claim 17, wherein the one or more network identifiers are not available for configuration of the plurality of sets of one or more user filters.

20. The network tool optimizer of claim 19, wherein the master interface is further configured to allow configuration of one or more master filters to add one or more network identifiers to the user packets forwarded to the one or more output ports for the network tool optimizer.