Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The present disclosure is directed to providing FTP data connections between a client and a server via a multi-core system. Both client-side and server-side data connections are allowed to be served on a core that is the same as a core that has processed the corresponding control connection using at least one of receive side scaling (RSS) filter rules and changes in port allocation logic. In a cluster where control connection and data connection can reach different nodes based on an RSS distribution, the node which has processed the control connection is also allowed to process the corresponding data connection using at least one of RSS filter rules, service registration, changes in port allocation logic and node-to-node (N2N) messages. The systems and methods discussed herein apply to active FTP, passive FTP, and active FTP with a random port in which the server initiates data connection from a non-standard FTP port.

Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The present disclosure is directed towards systems and methods of steering packets received by a multi-core device serving as a tunnel endpoint. A device including a plurality of cores identifies a core corresponding to a request to transmit to a destination via a tunnel. The tunnel is established between the first tunnel endpoint and a second tunnel endpoint. The device identifies, from a port allocation table, a source port based on the identified core, a first IP address of the first tunnel endpoint, a second IP address of the second tunnel endpoint and the destination port to steer a response to the request to the identified core. The device modifies a packet of the request to include in an outer header of the packet of the request, a first tuple identifying the first IP address, the second IP address, the destination port and the identified source port.

Abstract: The present disclosure relates to methods and systems for providing load balancing for layer 2 devices. A device intermediary to a plurality of clients and a plurality of servers and a plurality of layer 2 devices establishes, for each layer 2 device, a first traffic domain corresponding to ingress traffic received from the plurality of clients and a second traffic domain of the device corresponding to ingress traffic received from the plurality of clients. The device associates a first virtual local area network (VLAN) with the first traffic domain and a second VLAN with the second traffic domain. The device establishes a plurality of services. Each service corresponds to a layer 2 device and includes a corresponding subnet internet protocol (SNIP) address hosted on the device. The device establishes a virtual server to load balance the plurality of services corresponding to each of the plurality of layer 2 devices.

Abstract: Systems and methods for segmenting network traffic using virtual media access control (vMAC) addresses are disclosed. An intermediary device establishes a plurality of traffic domains to segment network traffic. The device generates a plurality of vMAC addresses to assign to the traffic domains. Each of the vMAC addresses includes an identifier of a traffic domain corresponding to the traffic domain to which the vMAC address is assigned. The device receives, from a second device, an ARP request to determine a MAC address to transmit data packets. The device selects, from the plurality of virtual MAC addresses, the virtual MAC address to use as the MAC address in a response based on an IP address identified via the ARP request. The device transmits, to the second device, a response to the request identifying, as the MAC address, the selected vMAC address of a traffic domain.

Abstract: The present disclosure is directed to providing FTP data connections between a client and a server via a multi-core system. Both client-side and server-side data connections are allowed to be served on a core that is the same as a core that has processed the corresponding control connection using at least one of receive side scaling (RSS) filter rules and changes in port allocation logic. In a cluster where control connection and data connection can reach different nodes based on an RSS distribution, the node which has processed the control connection is also allowed to process the corresponding data connection using at least one of RSS filter rules, service registration, changes in port allocation logic and node-to-node (N2N) messages. The systems and methods discussed herein apply to active FTP, passive FTP, and active FTP with a random port in which the server initiates data connection from a non-standard FTP port.

Abstract: The present disclosure is directed towards systems and methods of steering packets received by a multi-core device serving as a tunnel endpoint. A device including a plurality of cores identifies a core corresponding to a request to transmit to a destination via a tunnel. The tunnel is established between the first tunnel endpoint and a second tunnel endpoint. The device identifies, from a port allocation table, a source port based on the identified core, a first IP address of the first tunnel endpoint, a second IP address of the second tunnel endpoint and the destination port to steer a response to the request to the identified core. The device modifies a packet of the request to include in an outer header of the packet of the request, a first tuple identifying the first IP address, the second IP address, the destination port and the identified source port.

Abstract: The disclosure is directed towards systems and methods for segmenting network traffic using virtual media access control (vMAC) addresses. A device intermediary to a plurality of clients and a plurality of servers establishes a plurality of traffic domains to segment network traffic. The device generates a plurality of vMAC addresses to assign to the plurality of traffic domains. Each of the vMAC addresses can include an identifier of a traffic domain corresponding to the traffic domain to which the vMAC address is assigned. The device receives, from a second device, an address resolution protocol (ARP) request to determine a media access control (MAC) address to transmit data packets. The device selects, from the plurality of virtual MAC addresses, the virtual MAC address to use as the MAC address in a response based on an internet protocol (IP) address identified via the ARP request. The device then transmits, to the second device, a response to the request.

Abstract: Systems and methods of the present disclosure relate to allocating ports for packets distributed via a computer network. A packet engine on a core of a multicore device intermediary between a client and a server receives a first packet from the client. The first packet includes an outer header of an encapsulation protocol encapsulating a payload with an inner header. The first packet is directed by a packet distributor of the device to the first core selected based on a first tuple of the outer header. A port allocator of the packet engine determines a source port number to cause the packet distributor to identify the first core based on a second tuple of the inner header. The packet engine modifies the inner header of the payload to include the determined source port number. The device forwards the first packet including the modified inner header to the server.

Abstract: The disclosure is directed towards systems and methods for performing service tag switching. A device intermediary to a client and a server receives a packet including a virtual network device identifier tag that identifies a list of functions to be performed on the packet. The device tags the packet with a first service tag identifying a first functional entity of the device to which to route the packet. The device routes the packet to the first functional entity configured to perform a first function. Responsive to the first function being performed, the device selects a subsequent service tag identifying a subsequent functional entity to route the packet. The device tags the packet with the subsequent service tag and routes the packet to the subsequent functional entity. Once all of the list of functions to be performed on the packet have been performed, the device forwards the packet to its destination.

Abstract: The present disclosure relates to methods and systems for providing load balancing for layer 2 devices. A device intermediary to a plurality of clients and a plurality of servers and a plurality of layer 2 devices establishes, for each layer 2 device, a first traffic domain corresponding to ingress traffic received from the plurality of clients and a second traffic domain of the device corresponding to ingress traffic received from the plurality of clients. The device associates a first virtual local area network (VLAN) with the first traffic domain and a second VLAN with the second traffic domain. The device establishes a plurality of services. Each service corresponds to a layer 2 device and includes a corresponding subnet internet protocol (SNIP) address hosted on the device. The device establishes a virtual server to load balance the plurality of services corresponding to each of the plurality of layer 2 devices.