Abstract: Providing a distributed network service includes: receiving network traffic at a first physical device; and executing a service engine to participate in the distributed network service. The distributed network service is provided to at least the first target application instance executing in a first VM on the first physical device, and a second target application instance executing in a second VM on a second physical device; and a shared state of the distributed network service is maintained with respect to the first physical device and the second physical device.

Abstract: Network session identification information is received. The network session identification information is associated with a destination IP address and a destination network port. An available source network port for a new session to be established for a source IP address is determined based on the destination IP address and the destination network port.

Abstract: A method for evaluating health of a distributed network service environment (DNSE) includes determining an application performance measurement (APM) based at least in part on performance metrics (PM) associated with sources, where the sources are associated with the DNSE. The sources include service engine(s) and servers. At least some of the servers are configured to provide a distributed application, and the service engine(s) are configured to provide the servers with a network service and collect at least a part of the PM. The method includes determining a health risk of the DNSE based at least in part on risk parameters obtained by the service engine(s). The method includes combining the APM and the health risk of the DNSE to determine a health indicator. If the indicator indicates a change of the DNSE, a notification of the change is generated. The method includes outputting the notification of the change.

Abstract: In a network with at least a first device already configured to provide a network service to a network application, scaling service capacity includes: configuring one or more second devices to provide the network service to the network application. In embodiments where an upstream network device supports Equal-Cost Multi-Path (ECMP) routing, the upstream network device is configured, including storing a plurality of paths to reach an address associated with a network application, wherein the plurality of paths are equal in cost. In embodiments where the upstream network device does not support ECMP routing, the second device is configured not to respond to an Address Resolution Protocol (ARP) request associated with an Internet Protocol (IP) address of the network application, and the first device is instructed to perform load balancing on network traffic destined for the network application among the first device and the one or more second devices.

Abstract: Network session identification information is received. The network session identification information is associated with a destination IP address and a destination network port. An available source network port for a new session to be established for a source IP address is determined based on the destination IP address and the destination network port.

Abstract: Managing network ports is disclosed. Network session identification information is received. The network session identification information is associated with a destination IP address and a destination network port. An available source network port is determined using a data structure that is based on the destination IP address and the destination network port.

Abstract: Migrating a network service that is currently being performed by a first device to be performed by a second device includes: instructing the second device to notify an upstream network device to forward traffic that is to be serviced by the network service to the second device instead of to the first device, the network service being associated with an Internet Protocol (IP) address; and instructing the first device to migrate the network service to the second device, wherein the migration includes moving or copying state information associated with an existing flow currently serviced by the first device to the second device; the existing flow being an existing flow between a client application and a network application.

Abstract: Migrating a network service that is currently being performed by a first device to be performed by a second device includes: instructing the second device to notify an upstream network device to forward traffic that is to be serviced by the network service to the second device instead of to the first device, the network service being associated with an Internet Protocol (IP) address; and instructing the first device to migrate the network service to the second device, wherein the migration includes moving or copying state information associated with an existing flow currently serviced by the first device to the second device; the existing flow being an existing flow between a client application and a network application.

Abstract: Load balancing includes receiving, from a client, a connection request to establish a connection with a server; determining load balancing state information based at least in part on the connection request; synchronizing the load balancing state information across a plurality of service engines using a distributed data store service, the distributed data store service being configured to: determine whether in a distributed data store there is an existing entry that corresponds to the load balancing state information; in the event that it is determined that in the distributed data store there is no existing entry that corresponds to the load balancing state information, atomically create a new entry based on the load balancing state information; and distributing the connection to a selected server among a plurality of servers, the selected server being selected based at least in part on the load balancing state information.

Abstract: In a network with at least a first device already configured to provide a network service to a network application, scaling service capacity includes: configuring one or more second devices to provide the network service to the network application. In embodiments where an upstream network device supports Equal-Cost Multi-Path (ECMP) routing, the upstream network device is configured, including storing a plurality of paths to reach an address associated with a network application, wherein the plurality of paths are equal in cost. In embodiments where the upstream network device does not support ECMP routing, the second device is configured not to respond to an Address Resolution Protocol (ARP) request associated with an Internet Protocol (IP) address of the network application, and the first device is instructed to perform load balancing on network traffic destined for the network application among the first device and the one or more second devices.

Abstract: Managing network ports is disclosed. Network session identification information is received. The network session identification information is associated with a destination IP address and a destination network port. An available source network port is determined using a data structure that is based on the destination IP address and the destination network port.

Abstract: In a network with at least a first device already configured to provide a network service to a network application, scaling service capacity includes: configuring one or more second devices to provide the network service to the network application. In embodiments where an upstream network device supports Equal-Cost Multi-Path (ECMP) routing, the upstream network device is configured, including storing a plurality of paths to reach an address associated with a network application, wherein the plurality of paths are equal in cost. In embodiments where the upstream network device does not support ECMP routing, the second device is configured not to respond to an Address Resolution Protocol (ARP) request associated with an Internet Protocol (IP) address of the network application, and the first device is instructed to perform load balancing on network traffic destined for the network application among the first device and the one or more second devices.

Abstract: Managing network ports is disclosed. Network session identification information is received. The network session identification information is associated with a destination IP address and a destination network port. An available source network port is determined using a data structure that is based on the destination IP address and the destination network port.

Abstract: Systems and methods for providing service virtualization endpoint (SVE) redundancy in a two-node, active-standby form. An active-standby pair of SVEs register with a cloud-centric-network control point (CCN-CP) as a single service node (SN) using a virtual IP address for both a control-plane and a data-plane. At any given time, only the active SVE is a host for the control-plane and the data-plane. When a failover happens, the hosting operation is taken over by the standby SVE, therefore the failover will be transparent to CCN-CP and the SN.

Abstract: Load balancing includes receiving, from a client, a connection request to establish a connection with a server; determining load balancing state information based at least in part on the connection request; synchronizing the load balancing state information across a plurality of service engines using a distributed data store service, the distributed data store service being configured to: determine whether in a distributed data store there is an existing entry that corresponds to the load balancing state information; in the event that it is determined that in the distributed data store there is no existing entry that corresponds to the load balancing state information, atomically create a new entry based on the load balancing state information; and distributing the connection to a selected server among a plurality of servers, the selected server being selected based at least in part on the load balancing state information.

Abstract: Providing a distributed network service includes: receiving network traffic at a first physical device; and executing a service engine to participate in the distributed network service. The distributed network service is provided to at least the first target application instance executing in a first VM on the first physical device, and a second target application instance executing in a second VM on a second physical device; and a shared state of the distributed network service is maintained with respect to the first physical device and the second physical device.

Abstract: Systems and methods for providing service virtualization endpoint (SVE) redundancy in a two-node, active-standby form. An active-standby pair of SVEs register with a cloud-centric-network control point (CCN-CP) as a single service node (SN) using a virtual IP address for both a control-plane and a data-plane. At any given time, only the active SVE is a host for the control-plane and the data-plane. When a failover happens, the hosting operation is taken over by the standby SVE, therefore the failover will be transparent to CCN-CP and the SN.

Abstract: Providing a distributed network service includes: receiving network traffic at a first physical device; and executing a service engine to participate in the distributed network service. The distributed network service is provided to at least the first target application instance executing in a first VM on the first physical device, and a second target application instance executing in a second VM on a second physical device; and a shared state of the distributed network service is maintained with respect to the first physical device and the second physical device.

Abstract: A distributed network service platform comprises: a logical data plane configured to process packets that are received by a plurality of physical devices, transmitted by the plurality of physical devices, or both, the logical data plane being physically distributed on the plurality of physical devices; and a logical control plane configured to manage and control the logical data plane, the logical control plane comprising one or more physical control planes operating on one or more physical devices.

Abstract: In one embodiment, the processing by a packet switching device of a received network-to-link-layer address resolution request message (e.g., Address Resolution Protocol [ARP] Request message, Neighbor Discovery Protocol [NDP] Neighbor Solicitation message) is dependent upon whether or not its target IP address corresponds to a network gateway packet switching device. When the target IP address of a received ARP Request/NDP Neighbor Solicitation message corresponds to a network gateway, then the packet switching device responds effectively on behalf of the network gateway, rather than forwarding the message to the network gateway. When the target IP address of a received ARP Request/NDP Neighbor Solicitation message does not correspond to a network gateway and the Media Access Control (MAC) address corresponding to the target IP address is known, then the packet switching device transforms then sends the broadcast or multicast frame into a unicast frame.