Abstract: A method for processing network data traffic includes obtaining a first distributed structure corresponding to a program based on a first storage structure, wherein the program is configured to process network data traffic; dividing a network device based on a second storage structure into a plurality of execution units, wherein the plurality of execution units is configured to execute the program; mapping the first distributed structure and the plurality of execution units to obtain a second distributed structure; and controlling the plurality of execution units to process network data traffic based on the second distributed structure.

Abstract: A data center system includes: at least two data center subsystems interconnected through a layer-2 network, each of the data center subsystems comprising a plurality of hosts, a plurality of layer-2 switches connected with the plurality of hosts, a firewall group connected with the layer-2 switches, and a layer-2 extension device connected with the layer-2 switches; wherein the firewall groups of the at least two data center subsystems are configured to transmit synchronization information to each other through a synchronization channel in a first virtual local area network; wherein the layer-2 extension devices of the at least two data center subsystems are configured to transmit service information through a service channel in a second virtual local area network; and wherein the first virtual local area network and the second virtual local area network are implemented in the layer-2 network.

Abstract: A processing system includes: a first service machine having a first service module; and a first service switch; wherein the first service machine and the first service switch are configured for logically coupling between virtual machines and a virtual switch; wherein the first service machine comprises a first communication interface and a second communication interface, the second communication interface configured for communication with the first service switch.

Abstract: A method for processing network data traffic includes obtaining a first distributed structure corresponding to a program based on a first storage structure, wherein the program is configured to process network data traffic; dividing a network device based on a second storage structure into a plurality of execution units, wherein the plurality of execution units is configured to execute the program; mapping the first distributed structure and the plurality of execution units to obtain a second distributed structure; and controlling the plurality of execution units to process network data traffic based on the second distributed structure.

Abstract: A processing system includes: a first service machine having a first service module; and a first service switch; wherein the first service machine and the first service switch are configured for logically coupling between virtual machines and a virtual switch; wherein the first service machine comprises a first communication interface and a second communication interface, the second communication interface configured for communication with the first service switch.

Abstract: This disclosure makes public a data flow forwarding method and device, and in this method, a second health state is acquired based on the first health state of one or more pieces of identifying information of the received data flow, wherein the first health state and second health state are associated with the access rights of the user and/or user device that sent the data flow; it employs firewall policy property sets to determine whether or not to forward the data flow, wherein the firewall policy property sets comprise: the second health state. The technical schemes based on this disclosure improve the ability of a firewall to identify network attacks or abnormal activities and reduce administration costs.

Abstract: A data center system includes: at least two data center subsystems interconnected through a layer-2 network, each of the data center subsystems comprising a plurality of hosts, a plurality of layer-2 switches connected with the plurality of hosts, a firewall group connected with the layer-2 switches, and a layer-2 extension device connected with the layer-2 switches; wherein the firewall groups of the at least two data center subsystems are configured to transmit synchronization information to each other through a synchronization channel in a first virtual local area network; wherein the layer-2 extension devices of the at least two data center subsystems are configured to transmit service information through a service channel in a second virtual local area network; and wherein the first virtual local area network and the second virtual local area network are implemented in the layer-2 network.

Abstract: This disclosure makes public a data flow forwarding method and device, and in this method, a second health state is acquired based on the first health state of one or more pieces of identifying information of the received data flow, wherein the first health state and second health state are associated with the access rights of the user and/or user device that sent the data flow; it employs firewall policy property sets to determine whether or not to forward the data flow, wherein the firewall policy property sets comprise: the second health state. The technical schemes based on this disclosure improve the ability of a firewall to identify network attacks or abnormal activities and reduce administration costs.

Abstract: A processing system includes: a first service machine having a first service module; and a first service switch; wherein the first service machine and the first service switch are configured for logically coupling between virtual machines and a virtual switch; wherein the first service machine comprises a first communication interface and a second communication interface, the second communication interface configured for communication with the first service switch.

Abstract: A method performed by a network appliance having a plurality of application processing units, includes: receiving a first packet at the network appliance; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a first application processing unit of the plurality of application processing units in the network appliance. A network appliance includes: a plurality of processing units that are communicatively connected to each other; wherein a first processing unit of the plurality of processing units is configured for: calculating a first value using a mathematical algorithm based on one or more information regarding a first packet; and using the calculated first value to identify a second processing unit of the plurality of processing units.

Abstract: A method performed by a network system having a plurality of processing units implemented using a plurality of respective virtual machines, includes: receiving a first packet at a first virtual machine of the plurality of virtual machines, wherein the first virtual machine is configured to receive the first packet from a network through an interface and has session processing capability; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a second virtual machine of the plurality of virtual machines in the network system.

Abstract: This disclosure makes public a data flow forwarding method and device, and in this method, a second health state is acquired based on the first health state of one or more pieces of identifying information of the received data flow, wherein the first health state and second health state are associated with the access rights of the user and/or user device that sent the data flow; it employs firewall policy property sets to determine whether or not to forward the data flow, wherein the firewall policy property sets comprise: the second health state. The technical schemes based on this disclosure improve the ability of a firewall to identify network attacks or abnormal activities and reduce administration costs.

Abstract: A method performed by a network appliance having a plurality of application processing units, includes: receiving a first packet at the network appliance; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a first application processing unit of the plurality of application processing units in the network appliance. A network appliance includes: a plurality of processing units that are communicatively connected to each other; wherein a first processing unit of the plurality of processing units is configured for: calculating a first value using a mathematical algorithm based on one or more information regarding a first packet; and using the calculated first value to identify a second processing unit of the plurality of processing units.