Abstract: Various embodiments are disclosed for increasing Layer-3 LPM (longest prefix match) routing database in a network platform. In some embodiments, chipsets in fabric modules (FMs) can be partitioned into multiple banks. Network traffic can be directed towards a corresponding bank in the FMs by using a LPM table on a line card (LC). Entries in the LPM table on the LC can be programmed either statically or dynamically based upon LPM routes that are dynamically learned.

Abstract: Various embodiments are disclosed for increasing Layer-3 LPM (longest prefix match) routing database in a network platform. In some embodiments, chipsets in fabric modules (FMs) can be partitioned into multiple banks. Network traffic can be directed towards a corresponding bank in the FMs by using a LPM table on a line card (LC). Entries in the LPM table on the LC can be programmed either statically or dynamically based upon LPM routes that are dynamically learned.

Abstract: Various embodiments are disclosed for increasing Layer-3 LPM (longest prefix match) routing database in a network platform. In some embodiments, chipsets in fabric modules (FMs) can be partitioned into multiple banks. Network traffic can be directed towards a corresponding bank in the FMs by using a LPM table on a line card (LC). Entries in the LPM table on the LC can be programmed either statically or dynamically based upon LPM routes that are dynamically learned.

Abstract: An example method for hierarchical programming of dual-stack switches in a network environment is provided and includes receiving packets from the network at a line card in the modular switch, a first portion of the packets being destined to Internet Protocol version 6 (IPv6) destination IP (DIP) addresses and a second portion of the packets being destined to IPv4 DIP addresses, and performing hierarchical lookups of the IPv6 DIP addresses and the IPv4 DIP addresses. Layer 3 (L3) lookups for the IPv6 DIP addresses are performed at the line card, and L3 lookups for IPv4 DIP addresses are performed at a fabric module in the modular switch. The line card and the fabric module are interconnected inside a chassis of the modular switch. In specific embodiments, the method further comprises inspecting the packets' destination Media Access Control (DMAC) addresses comprising router MAC addresses indicative of IPv6 or IPv4 address families.

Abstract: An example method for hierarchical programming of dual-stack switches in a network environment is provided and includes receiving packets from the network at a line card in the modular switch, a first portion of the packets being destined to Internet Protocol version 6 (IPv6) destination IP (DIP) addresses and a second portion of the packets being destined to IPv4 DIP addresses, and performing hierarchical lookups of the IPv6 DIP addresses and the IPv4 DIP addresses. Layer 3 (L3) lookups for the IPv6 DIP addresses are performed at the line card, and L3 lookups for IPv4 DIP addresses are performed at a fabric module in the modular switch. The line card and the fabric module are interconnected inside a chassis of the modular switch. In specific embodiments, the method further comprises inspecting the packets' destination Media Access Control (DMAC) addresses comprising router MAC addresses indicative of IPv6 or IPv4 address families.

Abstract: A method is provided in one example and includes receiving a first packet of a connection between a client and a server. The first packet is tagged with a tag comprising a member id of a service node in a service cluster that includes a plurality of nodes having distinct member ids. The method can also include mapping the member id to the service node in a tag-to-node map; receiving a second packet of the connection, where the second packet is tagged with the tag comprising the member id; determining the service node from the tag-to-node map; and forwarding the second packet to the service node.

Abstract: Various embodiments are disclosed for increasing Layer-3 LPM (longest prefix match) routing database in a network platform. In some embodiments, chipsets in fabric modules (FMs) can be partitioned into multiple banks. Network traffic can be directed towards a corresponding bank in the FMs by using a LPM table on a line card (LC). Entries in the LPM table on the LC can be programmed either statically or dynamically based upon LPM routes that are dynamically learned.

Abstract: A method is provided in one example and includes receiving a first packet of a connection between a client and a server. The first packet is tagged with a tag comprising a member id of a service node in a service cluster that includes a plurality of nodes having distinct member ids. The method can also include mapping the member id to the service node in a tag-to-node map; receiving a second packet of the connection, where the second packet is tagged with the tag comprising the member id; determining the service node from the tag-to-node map; and forwarding the second packet to the service node.

Abstract: Configuring an interface of a switch includes sending an authentication request requesting authentication for an endpoint from a switch to an authentication server. The switch comprises interfaces and is operable to access templates, where a template is operable to generate one or more interface commands for an interface. An instruction is received from the authentication server. The instruction instructs the switch to apply an identified template to an interface, where the identified template is identified by the authentication server as associated with the endpoint. The identified template is applied to configure the interface according to the instruction.

Abstract: Configuring an interface of a switch includes sending an authentication request requesting authentication for an endpoint from a switch to an authentication server. The switch comprises interfaces and is operable to access templates, where a template is operable to generate one or more interface commands for an interface. An instruction is received from the authentication server. The instruction instructs the switch to apply an identified template to an interface, where the identified template is identified by the authentication server as associated with the endpoint. The identified template is applied to configure the interface according to the instruction.

Abstract: Configuring an interface of a switch includes sending an authentication request requesting authentication for an endpoint from a switch to an authentication server. The switch comprises interfaces and is operable to access templates, where a template is operable to generate one or more interface commands for an interface. An instruction is received from the authentication server. The instruction instructs the switch to apply an identified template to an interface, where the identified template is identified by the authentication server as associated with the endpoint. The identified template is applied to configure the interface according to the instruction.

Abstract: A common security database is maintained by a RADIUS server based on the attributes the RADIUS server receives through accounting packets. When the common security database has conflicting entries, for example a MAC address and/or IP address appearing at two different network devices such as switches or routers, the RADIUS server can notify the associated network access devices to take corrective action.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for policy-based processing of packets, including mechanisms for managing the policies. A user is authenticated and its user group identifier is identified. A packet is received and is associated with the user group identifier, and one or more fields (typically other than the source address field) of the packet are used to identify a second group identifier. A lookup operation is then performed on a policy based on the first and second group identifiers to identify a packet processing action to be performed on the packet. These identifiers are typically not network addresses, which disassociates the policy from physical network addresses (which often are dynamically assigned and may also vary based on the access point into the network of a user), and allows a switching device to process packets based on a policy stated using group identifiers.