Techniques for providing scalable application delivery controller services

Patent metadata

Field	Value
Publication number	US-9386085-B2
Application number	US-201313856679-A
Country	US
Kind code	B2
Filing date	Apr 4, 2013
Priority date	Apr 4, 2012
Publication date	Jul 5, 2016
Grant date	Jul 5, 2016

Abstract

A method for managing an application delivery controller (ADC) cluster operable in a software defined networking (SDN)-based network and including a plurality of ADC virtual appliances (VAs). The method comprises creating, by a central controller, a hash table including a plurality of buckets allocated to active VAs out of the plurality of VAs, each bucket is assigned to a range of a source internet protocol (IP) addresses of a client; and programming by the central controller at least one ingress network element connected to the ADC cluster and receive incoming traffic from clients to perform a balanced incoming traffic distribution among the plurality of VAs, wherein the traffic distribution is based in part on the allocation of the buckets to the plurality of VAs and the SIP addresses of the clients originating the incoming traffic. The plurality of VAs are virtual ADC instances operable i the plurality of physical devices.

First claim

What is claimed is:

1. A method for managing an application delivery controller (ADC) cluster in a software defined networking (SDN)-based network, wherein the method is performed by a central controller of the SDN-based network, the ADC cluster includes a plurality of physical devices, each of the plurality of physical devices includes a plurality of ADC virtual appliances (VAs), comprising:
creating, by the central controller, a hash table including a plurality of buckets allocated to active VAs out of the plurality of VAs, wherein each of the buckets is assigned to a range of a source internet protocol (IP) addresses of a client; and
programming by the central controller at least one ingress network element, connected to the ADC cluster and configured to receive incoming traffic from clients, to perform a balanced incoming traffic distribution among the plurality of VAs, wherein the traffic distribution is based in part on the allocation of the buckets to the plurality of VAs and the source IP addresses of the clients originating the incoming traffic.

2. The method of claim 1 , further comprising:
monitoring at least a processing load of the ADC cluster;
adding at least one VA to the ADC cluster when the processing load exceeds a first threshold, wherein the first threshold indicates a peak processing load for the ADC cluster; and
removing at least one VA from the ADC cluster when the processing load is below a second threshold, wherein the second threshold indicates a low processing load for the ADC cluster.

3. The method of claim 2 , wherein each of adding at least one VA from the ADC cluster and removing at least one VA from the ADC cluster further comprising:
updating the hash table to accommodate a new number of active VAs in the ADC cluster.

4. The method of claim 3 , wherein a first group of active VAs are allocated with a first number of buckets and a second group of VAs are allocated with a second number of buckets, wherein the first number of buckets allocated for each active VA in the first group is computed as the number of buckets in the hash table divided by the number of active VAs, truncated to a closest integer number; and wherein the second number of buckets allocated for each active VA in the second group is computed as the number of buckets in the hash table divided by the number of active VAs, truncated to a closest integer number plus one.

5. The method of claim 4 , wherein updating the number of buckets in the hash table further comprising:
first transferring at least one bucket allocated for each active VA in the second group to the newly added VA; and
transferring at least one bucket allocated for each active VA in the first group to the newly added VA, only when the number of buckets allocated to the new VA has not reached the first number, thereby minimizing the changes to the buckets allocation in the hash table.

6. The method of claim 5 , wherein updating the number of buckets in the hash table further comprising:
first transferring buckets allocated to the removed VA to active VAs in the first group, wherein each VA in the first group is allocated with one bucket; and
transferring remaining buckets, allocated to the removed VA, to active VAs in the second group, wherein each VA in the second group is allocated with one bucket, thereby minimizing the changes to the buckets allocation in the hash table.

7. The method of claim 3 , wherein the plurality of VAs are configured with different capacities and the allocation of buckets is proportional to the capacity of each active VA.

8. The method of claim 3 , wherein the number of buckets in the hash table is a function of the number of the plurality of VAs.

9. The method of claim 3 , further comprising:
programming each VA affected by changes to the ADC cluster with at least one persistency rule, thereby ensuring persistency in the processing of incoming and outgoing traffic by each of the affected VAs.

10. The method of claim 1 , wherein programming the at least one network element further comprising:
providing the least one network element with an instruction including at least a matching rule and an action rule, wherein the matching rule requires matching of a predefined number of lowest bits of the client's SIP address of an incoming packet against the hash function to find a bucket associated with the SIP address and a VA designated for the bucket; and wherein the action rule requires forwarding the incoming packet to the designated VA.

11. The method of claim 10 , further comprising:
programming at least one egress network element connected to the ADC cluster to direct an outgoing packet to a VA forwarded a respective incoming packet of the incoming traffic, wherein the outgoing packet is received from the server.

12. The method of claim 11 , wherein programming the at least one egress network element further comprising:
providing the least one egress network element with an instruction including a matching rule and an action rule, wherein the matching rule requires matching of a predefined number of lowest bits of a destination IP address of the outgoing packet against the hash table to find a bucket associated with the destination IP address and a VA designated for the bucket; and wherein the action rule requires forwarding the outgoing packet to the designated VA.

13. The method of claim 11 , wherein the central controller communicates with the least one ingress network element and at least one egress network element over an OpenFlow provisional protocol.

14. The method of claim 1 , further comprising:
monitoring an operational status of each of the plurality of VAs in the ADC cluster; and
changing a configuration of the ADC cluster by adding or removing one or more VAs in response to the monitored operational status.

15. A non-transitory computer readable medium containing instructions that when executed on the central controller performs the method of claim 1 .

16. A method for managing an application delivery controller (ADC) cluster including a plurality of ADC devices and operable in a software defined networking (SDN)-based network, wherein the method is performed by a central controller of the SDN-based network, comprising:
creating, by the central controller, a hash table including a plurality of buckets allocated for the plurality of ADC devices, wherein each of the buckets is assigned for a range of source internet protocol (IP) addresses of a client;
monitoring at least one of a processing load of the ADC cluster and an operation status of each of the ADC devices;
causing reconfiguration of the ADC cluster in response to the monitoring, wherein the reconfiguration of the ADC cluster includes at least one of: adding one of the ADC devices, removing one of the ADC devices, and updating the hash table; and
programming by the central controller at least one ingress network element connected to the ADC cluster to perform balanced traffic distribution among the plurality of ADC devices, wherein the traffic distribution is based in part on the allocation of the buckets to the plurality of ADC devices and source IP addresses of clients originating the traffic.

17. The method of claim 16 , wherein each of adding one of the ADC devices and removing one of the ADC devices further comprising:
updating the hash table to accommodate for a new number of active ADC devices in the ADC cluster.

18. The method of claim 17 , wherein a first group of active ADC devices are allocated with a first number of buckets and a second group of active ADC devices are

Assignees

• Radware Ltd

Inventors

• Doron Ehud
• Sekiguchi Masato

Classifications

• H04L67/1002 Primary

  Electricity · mapped topic

• H04L67/1023 Primary

  based on a hash applied to IP addresses or costs · CPC title

• H04L67/1001 Primary

  for accessing one among a plurality of replicated servers · CPC title