Application-aware firewall policy enforcement by data center controller
US-2019245830-A1 · Aug 8, 2019 · US
US11044193B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-11044193-B2 |
| Application number | US-201916550132-A |
| Country | US |
| Kind code | B2 |
| Filing date | Aug 23, 2019 |
| Priority date | Aug 23, 2019 |
| Publication date | Jun 22, 2021 |
| Grant date | Jun 22, 2021 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
Some embodiments provide a novel method for adjusting a path for a packet flow from a source machine to a destination machine in a network. The method of some embodiments identifies a condition at a first forwarding element along a first path traversed by the packet flow through the network. The first path traverses through a hardware, second forwarding element before the first forwarding element. In some embodiments, the second forwarding element includes a programmable data plane circuit. The method, in some embodiments, uses an application programming interface (API) of the programmable data plane circuit to provide a set of parameters to the data plane circuit that cause the data plane circuit to forego selecting the first path to forward the packets of the packet flow to the destination machine and instead to select a second path, not traversing the first forwarding element, to the destination machine.
Opening claim text (preview).
We claim: 1. A method for adjusting a path for a packet flow from a source machine to a destination machine in a network, the method comprising: at a computer, identifying a condition at a first forwarding element along a first path traversed by the packet flow through the network, said first path traversing through a hardware, second forwarding element before the first forwarding element, said second forwarding element comprising a programmable data plane circuit; using an application programming interface (API) command of the programmable data plane circuit to provide a set of parameters to the data plane circuit that cause the data plane circuit to forego selecting the first path to forward the packets of the packet flow to the destination machine and instead to select a second path to forward the packets of the packet flow to the destination machine, said second path not traversing the first forwarding element. 2. The method of claim 1 , wherein the source machine is not in the network and the second forwarding element is a gateway forwarding element of the network. 3. The method of claim 1 , wherein the source machine is in the network and the second forwarding element is not a gateway forwarding element. 4. The method of claim 3 , wherein neither the first nor the second path traverses a gateway forwarding element of the network. 5. The method of claim 1 , wherein the computer is a controller computer that collects usage data for a set of forwarding elements comprising the first forwarding element and the set of parameters is generated based on the collected usage data. 6. The method of claim 5 , wherein the usage data for the first forwarding element indicates congestion at the first forwarding element and the set of parameters reduces the congestion at the first forwarding element. 7. The method of claim 6 , wherein the first forwarding element executes on a host computer along with compute machines, wherein the compute machines use resources shared by the first forwarding element, wherein the congestion is based on the use of resources by the compute machines. 8. The method of claim 6 , wherein the first forwarding element is a forwarding element executing on a dedicated host computer. 9. The method of claim 5 , wherein the parameter set comprises a set of weights that provide different weight values for at least two different data plane circuit ports that connect to at least two different paths to the destination machine. 10. The method of claim 5 , wherein the usage data comprises a set of statistics related to at least one of forwarding element characteristics, network interface controller (NIC) characteristics, and characteristics of a host computer on which a forwarding element executes. 11. The method of claim 10 , wherein the forwarding element characteristics comprise at least one of a number of virtual central processing units (vCPUs) and a number of layer 2 hops between the programmable data plane circuit and the forwarding element. 12. The method of claim 10 , wherein the NIC characteristics comprise at least one of a speed of the NIC and a utilization of the NIC. 13. The method of claim 10 , wherein the host computer characteristics comprise at least one of a number of central processing unit (CPU) cores on the host computer, a speed of the CPUs of the host computer, a utilization of the CPUs of the host computer, and a memory utilization. 14. A non-transitory machine readable medium for execution by a set of processing units of a computer, the program for adjusting a path for a packet flow from a source machine to a destination machine in a network, the program comprising a set of instructions for: identifying a condition at a first forwarding element along a first path traversed by the packet flow through the network, said first path traversing through a hardware, second forwarding element before the first forwarding element, said second forwarding element comprising a programmable data plane circuit; using an application programming interface (API) command of the programmable data plane circuit to provide a set of parameters generated at least partly based on the condition at the first forwarding element to the data plane circuit that cause the data plane circuit to forego selecting the first path to forward the packets of the packet flow to the destination machine and instead to select a second path to forward the packets of the packet flow to the destination machine, said second path not traversing the first forwarding element. 15. The non-transitory machine readable medium of claim 14 , wherein the computer is a management plane controller computer and the identified condition comprises an upcoming network event. 16. The non-transitory machine readable medium of claim 15 , wherein the upcoming network event is at least one of an upgrade, a member being added to a set of forwarding elements that connect to the destination machine, and a member being removed from the set of forwarding elements that connect to the destination machine. 17. The non-transitory machine readable medium of claim 14 , wherein the computer is a load monitor computer, that collects usage data for a set of forwarding elements comprising the first forwarding element and the set of parameters is generated based on the collected usage data. 18. The non-transitory machine readable medium of claim 17 , wherein the set of instructions for collecting the usage data comprises a set of instructions for collecting, from each of a plurality of forwarding elements, a set of usage data regarding the forwarding element. 19. The non-transitory machine readable medium of claim 17 , wherein the set of instructions for collecting the usage data comprises a set of instructions for collecting, from a controller computer, a set of usage data for each of a plurality of forwarding elements. 20. The non-transitory machine readable medium of claim 17 , wherein the collected set of usage data is based on a current state of the forwarding elements. 21. The non-transitory machine readable medium of claim 17 , wherein the set of instructions for collecting the usage data and providing the set of parameters is executed periodically.
Related publications grouped by family.
Answers are generated from the same data shown on this page.