Methods, systems, and computer readable media for providing high availability support at a bypass switch

Patent metadata

Field	Value
Publication number	US-10237122-B2
Application number	US-201615169702-A
Country	US
Kind code	B2
Filing date	May 31, 2016
Priority date	May 31, 2016
Publication date	Mar 19, 2019
Grant date	Mar 19, 2019

Abstract

Methods, systems, and computer readable media for providing high availability support at a bypass switch are disclosed. One method occurs at a bypass switch. The method includes determining that an inline tool associated with a bypass switch is unavailable. The method also includes determining whether the inline tool is required or optional. The method further includes in response to determining that the inline tool is required, disabling at least one link associated with the bypass switch so as to trigger a switchover involving a second bypass switch.

First claim

What is claimed is:

1. A method for providing high availability support at a first bypass switch, the method comprising:
at the first bypass switch:
connecting between a network device separate from the first bypass switch and a plurality of inline network monitoring or security tools that receive and process traffic from the network device that is forwarded to the inline network monitoring or security tools through the first bypass switch, wherein receiving and processing the traffic includes inspecting the traffic for network monitoring or security purposes;

determining, by the first bypass switch, that a first inline network monitoring or security tool of the inline network monitoring or security tools connected to the first bypass switch is unavailable;
determining, by the first bypass switch, that the first inline network monitoring or security tool connected to the first bypass switch is required, and, in response to determining that the first inline network monitoring or security tool is unavailable and required, disabling at least one link connecting the first bypass switch to the network device, wherein the disabling of the at least one link triggers the network device to switch over to a second bypass switch connected to a second inline network monitoring or security tool that provides the same service as the first inline network monitoring or security tool and to forward traffic to the second inline network monitoring or security tool providing the same service as the first inline network monitoring or security tool through the second bypass switch; and
determining that a third inline network monitoring or security tool of the inline network monitoring or security tools connected to the first bypass switch is unavailable and optional, and, in response to determining that the third inline network monitoring or security tool is unavailable and optional, activating a bypass mode at the first bypass switch, wherein activating the bypass mode includes sending the network traffic destined for the third inline network monitoring or security tool to a fourth inline network monitoring or security tool of the inline network monitoring or security tools connected to the first bypass switch that is available and that provides the same service as the third inline network monitoring or security tool and such that network traffic traversing the first bypass switch and destined for the third inline network monitoring or security tool is sent back to the network without being sent to the third inline network monitoring or security tool.

2. The method of claim 1 wherein determining that the first inline network monitoring or security tool connected to the first bypass switch is unavailable includes determining that no communications from the inline network monitoring or security tool are received at the first bypass switch within a particular amount of time.

3. The method of claim 1 wherein determining that the first inline network monitoring or security tool is required includes querying a data structure associated with the first bypass switch, wherein the data structure includes tool related information indicating that the first inline network monitoring or security tool is required.

4. The method of claim 1 wherein the at least one link includes an egress link or an ingress link between the network device and the first bypass switch.

5. The method of claim 1 wherein the first inline network monitoring or security tool includes a metering device, a monitoring device, a billing system, a security device, an intrusion prevention system (IPS) device, a firewall, a wireless area network (WAN) optimization device, or a unified threat management system.

6. A system for providing high availability support at a first bypass switch, the system comprising:
the first bypass switch including:
a plurality of ports for connecting the first bypass switch between a network device separate from the first bypass switch and a plurality of inline network monitoring or security tools that receive and process traffic from the network device that is forwarded to the inline network monitoring or security tools through the first bypass switch, wherein receiving and processing the traffic includes inspecting the traffic for network monitoring or security purposes;
a memory;
a computing processor; and
a tool availability module (TAM) implemented using the computing processor and the memory, wherein the TAM is for providing high availability support at the first bypass switch, wherein providing high availability support at the first bypass switch includes:
determining, by the first bypass switch, that a first inline network monitoring or security tool of the inline network monitoring or security tools connected to the first bypass switch is unavailable; and
determining, by the first bypass switch, that the first inline network monitoring or security tool is required, and, in response to determining that the first inline network monitoring or security tool is unavailable and required, disabling at least one link connecting the first bypass switch to the network device, wherein the disabling of the at least one link triggers the network device to switch over to a second bypass switch connected to a second inline network monitoring or security tool that provides the same service as the first inline network monitoring or security tool and to forward traffic to the second inline network monitoring or security tool providing the same service as the first inline network monitoring or security tool through the second bypass switch, wherein the TAM is configured to activate, in response to determining that a third inline network monitoring or security tool of the inline network monitoring or security tools connected to the first bypass switch is unavailable and optional, a bypass mode at the first bypass switch such that network traffic traversing the first bypass switch and destined for the third inline network monitoring or security tool is sent to a fourth inline network monitoring or security tool connected to the first bypass switch that is available and that provides the same service as the third inline network monitoring or security tool and such that the network traffic traversing the first bypass switch is sent back to the network without being sent to the third inline network monitoring or security tool.

7. The system of claim 6 wherein the TAM is configured to determine that the first inline network monitoring or security tool connected to the first bypass switch is unavailable by determining that no communications from the first inline network monitoring or security tool are received by the first bypass switch within a particular amount of time.

8. The system of claim 6 wherein the TAM is configured to query a data structure associated with the first bypass switch, wherein the data structure includes tool related information indicating that the first inline network monitoring or security tool is required.

9. The system of claim 6 wherein the at least one link includes an egress link or an ingress link between the network device and the first bypass switch.

10. The system of claim 6 wherein the inline network monitoring or security tool includes a metering device, a monitoring device, a billing system, a security device, an intrusion prevention system (IPS) device, a firewall, a wireless area network (WAN) optimization device, or a unified threat management system.

11. A non-transitory computer readable medium comprising computer executable instructions embodied in the non-transitory computer readable medium that when executed by at least one processor of a computer perform steps comprising:
connecting a first bypass switch b

Assignees

• Ixia
• Keysight Tech Singapore Holdings Pte Ltd

Inventors

• Desdier Marcel Felix
• Quan Wenxing
• Rhodes Elaine
• Artzi Ophir Shmuel

Classifications

• H04L41/0663 Primary

  Performing the actions predefined by failover planning, e.g. switching to standby network elements · CPC title

• H04L43/0805

  by checking availability · CPC title