Distributed virtual appliance

• US 9,674,107 B2
• Filed: 03/12/2014
• Issued: 06/06/2017
• Est. Priority Date: 09/22/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Di Benedetto, Marco, Salvatori, Alessandro, Malagrino, Dante, Chang, Arthur Lihder, Chander, Vijay, Flynn, Thomas Vincent
• Primary Examiner(s): ABU ROUMI, MAHRAN Y
• Application Number:
  US14/206,579
• Publication Number:
  US 20140258541A1
• Time in Patent Office: 1,182 Days
• Field of Search: 709242
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation

Abstract

A distributed virtual appliance is disclosed, including: determining a classification type associated with the first flow; and determining an allocation of the first flow to the first data plane compute unit of the distributed virtual appliance based at least in part on the determined classification type and at least a subset of information of a first flow identifier, wherein the distributed virtual appliance includes a plurality of compute units, including the first data plane compute.

Claims

1. A method for allocating network traffic flows of a distributed virtual appliance, comprising:

determining a first classification type associated with a packet of a first network traffic flow;

selecting a distribution algorithm selection logic based on the first classification type, the distribution algorithm selection logic including a first hash function;

applying the first hash function on at least a first subset of information from an identifier of the packet of the first network traffic flow to select a distribution algorithm that includes a second hash function;

applying the second hash function on at least a second subset of information from the identifier of the packet of the first network traffic flow;

determining an allocation of the packet of the first network traffic flow to a first data plane compute unit of the distributed virtual appliance based on a result of the second hash function, wherein the distributed virtual appliance includes a plurality of compute units, including the first data plane compute unit;

at the first data plane compute unit, determining if the first network traffic flow is a new network traffic flow, an existing network traffic flow allocated to the first data plane compute unit, or an existing network traffic flow allocated to a data plane compute unit other than the first data plane compute unit;

determining a second classification type associated with a packet of a second network traffic flow, the second classification type being different from the first classification type;

selecting a designated distribution algorithm based on the second classification type;

dynamically adding a second data plane compute unit in addition to the first data plan compute unit to the distributed virtual appliance;

updating stored data for reallocation of network traffic flows to include the addition of the second data plane compute unit;

dynamically removing the second data plane compute unit; and

updating the stored data for reallocation of the network traffic flows to include the removal of the second data plane compute unit.

2. The method of claim 1, wherein the distributed virtual appliance includes a data planes dispatcher compute unit implemented using a virtual machine on a computer to carry out operations for allocating network traffic flows.

3. The method of claim 1, wherein the second classification type is associated with unknown data, wherein unknown data includes data for which neither a source Internet Protocol (IP) address nor a destination IP address is identifiable by the distributed virtual appliance.

4. The method of claim 3, wherein the designated distribution algorithm is at least in part a layer 3 hash.

5. The method of claim 1, wherein the first classification type is associated with known data.

6. The method of claim 5, wherein the known data includes one or more of the following:

non-IP traffic, traffic for which a source IP address and a source port are known, traffic for which a destination IP address is known, traffic for which a source IP address is known, or traffic for which a destination IP address and a destination port are known.

7. The method of claim 1, wherein the information from the identifier of the packet of the first network traffic flow includes at least a source Internet Protocol (IP), a source port, a destination IP, and a destination port.

8. The method of claim 1, further comprising allocating one or more network traffic flows to the second data plane compute unit.

9. The method of claim 8, wherein the second data plane compute unit is configured to punt a received packet of a network traffic flow that is associated with the first data plane compute unit to the first data plane compute unit.

10. The method of claim 1, further comprising allocating a new network traffic flow to a data plane compute unit other than the second data plane compute unit.

11. The method of claim 1, wherein one or more compute units are dynamically added or removed from the distributed virtual appliance without disruption to network traffic.

12. The method of claim 1, wherein in the event that it is determined that the first network traffic flow is an existing network traffic flow allocated to a data plane compute unit other than the first data plane compute unit, the first data plane compute unit is configured to punt the packet of the first network traffic flow to the other data plane compute unit.

13. The method of claim 1, wherein determining the allocation of the packet of the first network traffic flow to the first data plane compute unit includes distributing the packet of the first network traffic flow directly to the first data plane compute unit.

14. The method of claim 1, wherein determining the allocation of the packet of the first network traffic flow to the first data plane compute unit includes first distributing a packet associated with the first network traffic flow to the first data plane compute unit and wherein the first data plane compute unit is configured to determine that the packet is associated with the second data plane compute unit, wherein the first data plane compute unit is configured to punt the packet to the second data plane compute unit.

15. A system for allocating network traffic flows of a distributed virtual appliance, comprising:

a processor configured to;

determine a first classification type associated with a packet of a first network traffic flow;

select a distribution algorithm selection logic based on the first classification type, the distribution algorithm selection logic including a first hash function;

apply the first hash function on at least a first subset of information from an identifier of the packet of the first network traffic flow to select a distribution algorithm that includes a second hash function;

apply the second hash function on at least a second subset of information from the identifier of the packet of the first network traffic flow;

determine an allocation of the packet of the first network traffic flow to a first data plane compute unit of the distributed virtual appliance on a result of the second hash function, wherein the distributed virtual appliance includes a plurality of compute units, including the first data plane compute unit;

determine, at the first data plane compute unit, if the first network traffic flow is a new network traffic flow, an existing network traffic flow allocated to the first data plane compute unit, or an existing network traffic flow allocated to a data plane compute unit other than the first data plane compute unit;

determine a second classification type associated with a packet of a second network traffic flow, the second classification type being different from the first classification type;

select a designated distribution algorithm based on the second classification type;

dynamically add a second data plane compute unit in addition to the first data plane compute unit;

update stored data for reallocation of network traffic flows to include the addition of the second data plane compute unit;

dynamically remove the second data plane compute unit;

update the stored data for reallocation of the network traffic flows to include the removal of the second data plane compute unit; and

a memory coupled to the processor and configured to provide the processor with instructions.

16. The system of claim 15, wherein the distributed virtual appliance includes a data planes dispatcher compute unit implemented using a virtual machine on a computer to carry out operations for allocating network traffic flows.

17. The system of claim 15, wherein the second classification type is associated with unknown data, wherein unknown data includes data for which neither a source Internet Protocol (IP) address nor a destination IP address is identifiable by the distributed virtual appliance.

18. The system of claim 17, wherein the designated distribution algorithm is at least in part a layer 3 hash.

19. The system of claim 15, wherein the first classification type is associated with known data.

20. The system of claim 19, wherein the known data includes one or more of the following:

non-IP traffic, traffic for which a source IP address and a source port are known, traffic for which a destination IP address is known, traffic for which a source IP address is known, or traffic for which a destination IP address and a destination port are known.

21. The system of claim 15, wherein the information from the identifier of the packet of the first network traffic flow includes at least a source IP, a source port, a destination IP, and a destination port.

22. The system of claim 15, wherein the processor is further configured to allocate one or more network traffic flows to the second data plane compute unit.

23. The system of claim 22, wherein the second data plane compute unit is configured to punt a received packet of a network traffic flow that is associated with the first data plane compute unit to the first data plane compute unit.

24. The system of claim 15, wherein the processor is further configured to allocate a new network traffic flow to a data plane compute unit other than the second data plane compute unit.

25. The system of claim 15, wherein one or more compute units are dynamically added or removed from the distributed virtual appliance without disruption to network traffic.

26. The system of claim 15, wherein in the event that it is determined that the first network traffic flow is an existing flow allocated to a data plane compute unit other than the first data plane compute unit, the first data plane compute unit is configured to punt the packet of the first network traffic flow to the other data plane compute unit.

27. The system of claim 15, wherein to determine the allocation of the first network traffic flow to the first data plane compute unit includes distributing the packet of a first network traffic flow directly to the first data plane compute unit.

28. The system of claim 15, wherein to determine the allocation of the packet of the first network traffic flow to the first data plane compute unit includes distributing a packet associated with the first network traffic flow to the first data plane compute unit and wherein the first data plane compute unit is configured to determine that the packet is associated with the second data plane compute unit, the first data plane compute unit is configured to punt the packet to the second data plane compute unit.

29. A computer program product for allocating network traffic flows of a distributed virtual appliance, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:

determining a classification type associated with a packet of a first network traffic flow;

selecting a distribution algorithm selection logic based on the first classification type, the distribution algorithm selection logic including a first hash function;

applying the first hash function on at least a first subset of information from an identifier of the packet of the first network traffic flow to select a distribution algorithm that includes a second hash function;

applying the second hash function on at least a second subset of information from the identifier of the packet of the first network traffic flow;

determining an allocation of the packet of the first network traffic flow to a first data plane compute unit of the distributed virtual appliance based on a result of the second hash function, wherein the distributed virtual appliance includes a plurality of compute units, including the first data plane compute unit;

determining, at the first data plane compute unit, if the first network traffic flow is a new network traffic flow, an existing network traffic flow allocated to the first data plane compute unit, or an existing network traffic flow allocated to a data plane compute unit other than the first data plane compute unit;

determining a second classification type associated with a packet of a second network traffic flow, the second classification type being different from the first classification type;

selecting a designated distribution algorithm based on the second classification type;

dynamically adding a second data plane compute unit in addition to the first data plan compute unit to the distributed virtual appliance;

updating stored data for reallocation of network traffic flows to include the addition of the second data plane compute unit;

dynamically removing the second data plane compute unit; and

updating the stored data for reallocation of the network traffic flows to include the removal of the second data plane compute unit.

30. The computer program product of claim 29, wherein the distributed virtual appliance includes a data planes dispatcher compute unit implemented using a virtual machine on a computer to carry out operations for allocating network traffic flows.

31. The computer program product of claim 29, wherein the second classification type is associated with unknown data, wherein unknown data includes data for which neither a source Internet Protocol (IP) address nor a destination IP address is identifiable by the distributed virtual appliance.

32. The computer program product of claim 30, wherein the designated distribution algorithm is at least in part a layer 3 hash.

33. The computer program product of claim 29, wherein the first classification type is associated with known data.

34. The computer program product of claim 33, wherein the known data includes one or more of the following:

non-IP traffic, traffic for which a source IP address and a source port are known, traffic for which a destination IP address is known, traffic for which a source IP address is known, or traffic for which a destination IP address and a destination port are known.

35. The computer program product of claim 29, further comprising computer instructions for allocating one or more network traffic flows to the second data plane compute unit.

36. The computer program product of claim 35, further comprising computer instructions for punting a received packet of a network traffic flow that is associated with the first data plane compute unit from the second data plane compute unit to the first data plane compute unit.

37. The computer program product of claim 29, further comprising instructions, for in the event that it is determined that the first network traffic flow is an existing network traffic flow allocated to a data plane compute unit other than the first data plane compute unit, punting the packet of the first network traffic flow from the first data plane compute unit to the other data plane compute unit.

38. The computer program product of claim 29, wherein the instructions for determining the allocation of the packet of the first network traffic flow to the first data plane compute unit includes instructions for first distributing a packet associated with the first network traffic flow to the first data plane compute unit and to punt the packet to the second data plane compute unit when the first data plane compute unit determines that the packet is associated with the second data plane compute unit.