Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: Systems and methods of the present disclosure relate to allocating ports for packets distributed via a computer network. A packet engine on a core of a multicore device intermediary between a client and a server receives a first packet from the client. The first packet includes an outer header of an encapsulation protocol encapsulating a payload with an inner header. The first packet is directed by a packet distributor of the device to the first core selected based on a first tuple of the outer header. A port allocator of the packet engine determines a source port number to cause the packet distributor to identify the first core based on a second tuple of the inner header. The packet engine modifies the inner header of the payload to include the determined source port number. The device forwards the first packet including the modified inner header to the server.

Abstract: The present disclosure is directed towards systems and methods of steering packets received by a multi-core device serving as a tunnel endpoint. A device including a plurality of cores identifies a core corresponding to a request to transmit to a destination via a tunnel. The tunnel is established between the first tunnel endpoint and a second tunnel endpoint. The device identifies, from a port allocation table, a source port based on the identified core, a first IP address of the first tunnel endpoint, a second IP address of the second tunnel endpoint and the destination port to steer a response to the request to the identified core. The device modifies a packet of the request to include in an outer header of the packet of the request, a first tuple identifying the first IP address, the second IP address, the destination port and the identified source port.

Abstract: The present disclosure is directed towards systems and methods of steering packets received by a multi-core device serving as a tunnel endpoint. A device including a plurality of cores identifies a core corresponding to a request to transmit to a destination via a tunnel. The tunnel is established between the first tunnel endpoint and a second tunnel endpoint. The device identifies, from a port allocation table, a source port based on the identified core, a first IP address of the first tunnel endpoint, a second IP address of the second tunnel endpoint and the destination port to steer a response to the request to the identified core. The device modifies a packet of the request to include in an outer header of the packet of the request, a first tuple identifying the first IP address, the second IP address, the destination port and the identified source port.

Abstract: While each node in a cluster of nodes sources connections with the same IP if each node allocates a port on this IP independently, there may be port clashes. Also, the return traffic is not guaranteed to hit the originating node. These issues are addressed by allocating a port in such a way that the response traffic hashes back to the originating node. A good hash is chosen such that the ports are equally divided among the nodes. When a node leaves, the other nodes take over the port range used by this node. When a node joins, the node takes back its share of ports.

Abstract: In a cluster environment, nodes participating in the cluster may generate packets with the same source IP to the same destination IP. If those packets get fragmented down stream, then reassembling this packets depends on the source IP, destination IP, protocol and the IP identifier field (IPID) of the IP packet. As the source IP, destination IP and protocol may be fixed, the IPID generation is coordinated across the nodes to support reassembly down stream and avoid tuple collision. The IPID space may be equally split among the nodes in the cluster. Each node generates IPID within its range to avoid a collision with an IPID generated from another node.

Abstract: The present application is directed towards sharing data link layer information of network traffic distributed across a cluster of intermediary devices. A method for sharing data link layer information across a cluster includes receiving a request packet at a first intermediary device. The first intermediary device identifies a first set of data link layer information from a data link layer of the request packet. The first intermediary device modifies the request packet for transmission on a common data backplane of the cluster to include the first set of data link layer information in the request packet. The modified request packet includes a second set of data link layer information that differs from the first set of data link layer information at the data link layer. The first intermediary device transmits the modified request packet on the common data backplane of the cluster to other devices of the cluster.

Abstract: Systems and methods of the present disclosure relate to allocating ports for packets distributed via a computer network. A packet engine on a core of a multicore device intermediary between a client and a server receives a first packet from the client. The first packet includes an outer header of an encapsulation protocol encapsulating a payload with an inner header. The first packet is directed by a packet distributor of the device to the first core selected based on a first tuple of the outer header. A port allocator of the packet engine determines a source port number to cause the packet distributor to identify the first core based on a second tuple of the inner header. The packet engine modifies the inner header of the payload to include the determined source port number. The device forwards the first packet including the modified inner header to the server.

Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The present application is directed towards systems and methods for handling fragmented packets in a cluster environment. Fragments received by the cluster may be hashed based on a tuple of network layer information, such as source and destination IP addresses. The tuple of network layer information may be used to identify a device of the cluster as a “fragment owner” or node responsible for assembling the fragments of the packet. The fragment may be transmitted or steered to the fragment owner for accumulation and assembly. Once all fragments of the packet have been received by the fragment owner, the packet may be assembled and a second hash may be calculated based on a four-tuple of network and transport layer information, such as source and destination IP addresses and port numbers. The packet may then be steered or transmitted to the “packet owner” or node responsible for processing the packet.

Abstract: While each node in a cluster of nodes sources connections with the same IP if each node allocates a port on this IP independently, there may be port clashes. Also, the return traffic is not guaranteed to hit the originating node. These issues are addressed by allocating a port in such a way that the response traffic hashes back to the originating node. A good hash is chosen such that the ports are equally divided among the nodes. When a node leaves, the other nodes take over the port range used by this node. When a node joins, the node takes back its share of ports.

Abstract: The present application is directed towards sharing data link layer information of network traffic distributed across a cluster of intermediary devices. A method for sharing data link layer information across a cluster includes receiving a request packet at a first intermediary device. The first intermediary device identifies a first set of data link layer information from a data link layer of the request packet. The first intermediary device modifies the request packet for transmission on a common data backplane of the cluster to include the first set of data link layer information in the request packet. The modified request packet includes a second set of data link layer information that differs from the first set of data link layer information at the data link layer. The first intermediary device transmits the modified request packet on the common data backplane of the cluster to other devices of the cluster.

Abstract: In a cluster environment, nodes participating in the cluster may generate packets with the same source IP to the same destination IP. If those packets get fragmented down stream, then reassembling this packets depends on the source IP, destination IP, protocol and the IP identifier field (IPID) of the IP packet. As the source IP, destination IP and protocol may be fixed, the IPID generation is coordinated across the nodes to support reassembly down stream and avoid tuple collision. The IPID space may be equally split among the nodes in the cluster. Each node generates IPID within its range to avoid a collision with an IPID generated from another node.

Abstract: The present application is directed towards systems and methods for handling fragmented packets in a cluster environment. Fragments received by the cluster may be hashed based on a tuple of network layer information, such as source and destination IP addresses. The tuple of network layer information may be used to identify a device of the cluster as a “fragment owner” or node responsible for assembling the fragments of the packet. The fragment may be transmitted or steered to the fragment owner for accumulation and assembly. Once all fragments of the packet have been received by the fragment owner, the packet may be assembled and a second hash may be calculated based on a four-tuple of network and transport layer information, such as source and destination IP addresses and port numbers. The packet may then be steered or transmitted to the “packet owner” or node responsible for processing the packet.