Abstract: In one embodiment, a list of source identifiers is maintained at a virtual switch. These source identifiers are allowed to send packets through the virtual switch to ports in a private virtual local area network (PVLAN). When a packet is received at the virtual switch from a particular source destined for a particular port in the PVLAN, the virtual switch determines whether a particular identifier associated with the particular source matches one of the source identifiers in the list. If that particular source identifier is not on the list, the packet is prevented from being forwarded to the particular port in the PVLAN.

Abstract: Methods and apparatus for providing a device for forwarding packets in a network are disclosed. A first router and a second router having a shared set of interfaces are provided, enabling the first router and the second router to share forwarding data for forwarding packets on the shared set of interfaces.

Abstract: In one embodiment, an apparatus can include a service broker configured to: (i) register a service classifier, and to provide context information to the service classifier; and (ii) register a plurality of service nodes. The service broker can also receive capability and service requests from the service classifier. Further, the context information can include a service header, a reachability indication, and an encapsulation, where the service header and the encapsulation may be attached or related to a packet in the service classifier. In addition, the service classifier can use this information to redirect the packet to a first service node.

Abstract: In one embodiment, an apparatus includes a port profile manager for receiving a port configuration policy and creating a port profile for the port configuration policy. The apparatus further includes a management interface for transmitting the port profile to a management station operable to receive input mapping the port profile to one or more interfaces associated with virtual machines. The port profile manager receives and stores the mapping input at the management station, for use in configuring the interfaces according to the port configuration policy. A method for policy based configuration of interfaces in a virtual machine environment is also disclosed.

Abstract: A blade router for increased interface scalability is provided. The blade router may address interface scalability by having each of the linecards manage its interfaces locally and may use the concept of virtual and local interfaces for intelligent forwarding. The blade router may appear as a single router from the customer perspective during configuration. For some embodiments, two virtual interfaces may be used, one for regular interface traffic and another for Network Address Translation (NAT)-enabled interface traffic.

Abstract: In one embodiment, an apparatus includes a port profile manager for receiving a port configuration policy and creating a port profile for the port configuration policy. The apparatus further includes a management interface for transmitting the port profile to a management station operable to receive input mapping the port profile to one or more interfaces associated with virtual machines. The port profile manager receives and stores the mapping input at the management station, for use in configuring the interfaces according to the port configuration policy. A method for policy based configuration of interfaces in a virtual machine environment is also disclosed.

Abstract: A blade switch for increased interface scalability is provided. The blade switch may address interface scalability by having each of the switch linecards manage its interfaces locally and may use the concept of virtual and local interfaces for intelligent forwarding. The blade switch may appear as a single network switch having a single bridge ID from the network perspective during operation and from the customer perspective during configuration.

Abstract: In one embodiment, a list of source identifiers is maintained at a virtual switch. These source identifiers are allowed to send packets through the virtual switch to ports in a private virtual local area network (PVLAN). When a packet is received at the virtual switch from a particular source destined for a particular port in the PVLAN, the virtual switch determines whether a particular identifier associated with the particular source matches one of the source identifiers in the list. If that particular source identifier is not on the list, the packet is prevented from being forwarded to the particular port in the PVLAN.

Abstract: A method is disclosed for performing message payload processing functions in a network element on behalf of an application. According to one aspect, a network element intercepts data packets comprising network layer or transport layer headers having an address of a destination which destination differs from the network element. The network element determines whether information contained in layer 2-4 headers of the data packet satisfies specified criteria. If the information satisfies the specified criteria, the network element directs the data packets to a blade of the network element that performs processing based on an application layer message at least partially contained in the data packets. If the information does not satisfy the specified criteria, the network element forwards the data packets towards the destination without sending them to the blade.

Abstract: In one embodiment, a method includes identifying virtual machines operating at a network device and virtual local area networks associated with the virtual machines, creating an allowed list of virtual local area networks at the network device based on the virtual machines operating at the network device, and updating the allowed list in response to changes in the virtual machines at the network device. The network device is configured to forward traffic received from the virtual local area networks on the allowed list to a virtual switch at the network device, and drop traffic received from a virtual local area network not on the allowed list. An apparatus and logic are also disclosed.

Abstract: Methods and apparatus for providing a device for forwarding packets in a network are disclosed. A first router and a second router having a shared set of interfaces are provided, enabling the first router and the second router to share forwarding data for forwarding packets on the shared set of interfaces.

Abstract: Methods and apparatus for providing a device for forwarding packets in a network are disclosed. A first router and a second router having a shared set of interfaces are provided, enabling the first router and the second router to share forwarding data for forwarding packets on the shared set of interfaces.

Abstract: In a virtual infrastructure, a single appliance is provided that hosts a centralized virtual machine monitor (VMM) control plane to effectively establish a single virtual switch across all virtual machines within one or more clusters of servers, thereby reducing the number of management points for the network administrator and facilitating easier VM migration.

Abstract: A method is disclosed for performing message payload processing functions in a network element on behalf of an application. According to one aspect, a network element intercepts data packets comprising network layer or transport layer headers having an address of a destination which destination differs from the network element. The network element determines whether information contained in layer 2-4 headers of the data packet satisfies specified criteria. If the information satisfies the specified criteria, the network element directs the data packets to a blade of the network element that performs processing based on an application layer message at least partially contained in the data packets. If the information does not satisfy the specified criteria, the network element forwards the data packets towards the destination without sending them to the blade.

Abstract: A method is disclosed for performing message payload processing functions in a network element on behalf of an application. According to one aspect, a network element receives user-specified input that indicates a particular message classification. The network element also receives one or more data packets. Based on the data packets, the network element determines that an application layer message, which is collectively contained in payload portions of the data packets, matches the particular message classification. The network element processes at least a portion of the message by performing, on behalf of the application to which the message is directed, and relative to at least the portion of the message, one or more actions that are (a) specified in the user-specified input and (b) associated with the particular message classification.

Abstract: Method and system for providing access layer satellite architecture in a data network including receiving a data packet from an access layer network device, the data packet including a Virtual Local Area Network (VLAN) identifier associated with a port on the access layer network device, performing a route lookup procedure based on the received data packet to determine a destination of the data packet, updating an ARP table with a Media Access Control (MAC) address associated with the VLAN identifier and the port of the received data packet, and transmitting the data packet to a destination network device, is disclosed.

Abstract: In a virtual infrastructure, a single appliance is provided that hosts a centralized virtual machine monitor (VMM) control plane to effectively establish a single virtual switch across all virtual machines within one or more clusters of servers, thereby reducing the number of management points for the network administrator and facilitating easier VM migration.

Abstract: A blade router for increased interface scalability is provided. The blade router may address interface scalability by having each of the linecards manage its interfaces locally and may use the concept of virtual and local interfaces for intelligent forwarding. The blade router may appear as a single router from the customer perspective during configuration. For some embodiments, two virtual interfaces may be used, one for regular interface traffic and another for Network Address Translation (NAT)-enabled interface traffic.

Abstract: A blade switch for increased interface scalability is provided. The blade switch may address interface scalability by having each of the switch linecards manage its interfaces locally and may use the concept of virtual and local interfaces for intelligent forwarding. The blade switch may appear as a single network switch having a single bridge ID from the network perspective during operation and from the customer perspective during configuration.

Abstract: Method and system for providing access layer satellite architecture in a data network including receiving a data packet from an access layer network device, the data packet including a Virtual Local Area Network (VLAN) identifier associated with a port on the access layer network device, performing a route lookup procedure based on the received data packet to determine a destination of the data packet, updating an ARP table with a Media Access Control (MAC) address associated with the VLAN identifier and the port of the received data packet, and transmitting the data packet to a destination network device, is disclosed.