Abstract: Methods and devices are provided for implementing security groups in an enterprise network. The security groups include first network nodes that are subject to rules governing communications between the first network nodes and second network nodes. An indicator, referred to as a security group tag (SGT), identifies members of a security group. In some embodiments, the SGT is provided in a field of a data packet reserved for layer 3 information or a field reserved for higher layers. However, in other embodiments, the SGT is provided in a field reserved for layer 1 or layer 2. In some embodiments, the SGT is not provided in a field used by interswitch links or other network fabric devices for the purpose of making forwarding decisions.

Abstract: A technique is provided for implementing online mirroring of a volume in a storage area network. A first instance of the volume is instantiated at a first port of the fibre channel fabric for enabling I/O operations to be performed at the volume. One or more mirroring procedures may be performed at the volume. In at least one implementation, the first port is able to perform first I/O operations at the volume concurrently while the mirroring procedures are being performed at the first volume. In one implementation, the mirroring procedures may be implemented at a fabric switch of the storage area network. Additionally, in at least one implementation, multiple hosts may be provided with concurrent access to the volume during the mirroring operations without serializing the access to the volume.

Abstract: A technique is provided for facilitating information management in a storage area network. The storage area network may utilize a fibre channel fabric which includes a plurality of ports. The storage area network may also comprise a first volume which includes a first mirror copy and a second mirror copy. The storage area network may further comprise a mirror consistency data structure adapted to store mirror consistency information. A mirror consistency check procedure is performed to determine whether data of the first mirror copy is consistent with data of the second mirror copy. According to one implementation, the mirror consistency check procedure may be implemented using the consistency information stored at the mirror consistency data structure.

Abstract: The present invention provides methods and devices for implementing a Low Latency Ethernet (“LLE”) solution, also referred to herein as a Data Center Ethernet (“DCE”) solution, which simplifies the connectivity of data centers and provides a high bandwidth, low latency network for carrying Ethernet and storage traffic. Some aspects of the invention involve transforming FC frames into a format suitable for transport on an Ethernet. Some preferred implementations of the invention implement multiple virtual lanes (“VLs”) in a single physical connection of a data center or similar network. Some VLs are “drop” VLs, with Ethernet-like behavior, and others are “no-drop” lanes with FC-like behavior. Some preferred implementations of the invention provide guaranteed bandwidth based on credits and VL. Active buffer management allows for both high reliability and low latency while using small frame buffers. Preferably, the rules for active buffer management are different for drop and no drop VLs.

Abstract: Methods and apparatus for encapsulating a packet or frame for transmission in a storage area network are disclosed. A packet or frame compatible with a standard protocol employed in the storage area network is received or generated. The packet or frame is then encapsulated with a virtual storage area network identifier. The packet or frame may further be encapsulated with at least one of a TTL value, MPLS information, and a type of traffic to be carried by the packet or frame. For instance, the type of traffic to be carried by the packet or frame may include Ethernet, Fibre Channel, and Infiniband. Once encapsulated, the encapsulated packet or frame is sent over the storage area network. For instance, the encapsulated packet or frame may be generated as well as transmitted by a switch over an inter-switch link in the storage area network.

Abstract: A technique is provided for implementing online mirroring of a volume in a storage area network. A first instance of the volume is instantiated at a first port of the fibre channel fabric for enabling I/O operations to be performed at the volume. One or more mirroring procedures may be performed at the volume. In at least one implementation, the first port is able to perform first I/O operations at the volume concurrently while the mirroring procedures are being performed at the first volume. In one implementation, the mirroring procedures may be implemented at a fabric switch of the storage area network. Additionally, in at least one implementation, multiple hosts may be provided with concurrent access to the volume during the mirroring operations without serializing the access to the volume.

Abstract: Methods and devices are provided for implementing security groups in an enterprise network. The security groups include first network nodes that are subject to rules governing communications between the first network nodes and second network nodes. An indicator, referred to as a security group tag (SGT), identifies members of a security group. In some embodiments, the SGT is provided in a field of a data packet reserved for layer 3 information or a field reserved for higher layers. However, in other embodiments, the SGT is provided in a field reserved for layer 1 or layer 2. In some embodiments, the SGT is not provided in a field used by interswitch links or other network fabric devices for the purpose of making forwarding decisions.

Abstract: The present invention provides methods and devices for implementing a Low Latency Ethernet (“LLE”) solution, also referred to herein as a Data Center Ethernet (“DCE”) solution, which simplifies the connectivity of data centers and provides a high bandwidth, low latency network for carrying Ethernet and storage traffic. Some aspects of the invention involve transforming FC frames into a format suitable for transport on an Ethernet. Some preferred implementations of the invention implement multiple virtual lanes (“VLs”) in a single physical connection of a data center or similar network. Some VLs are “drop” VLs, with Ethernet-like behavior, and others are “no-drop” lanes with FC-like behavior. Some preferred implementations of the invention provide guaranteed bandwidth based on credits and VL. Active buffer management allows for both high reliability and low latency while using small frame buffers. Preferably, the rules for active buffer management are different for drop and no drop VLs.

Abstract: A way to assign flexible prefixes to Switches in Fibre Channel Fabrics while using the currently defined FC_ID address space. This allows end devices in different Fibre Channel Fabrics to communicate with one another, without requiring modifications to existing end devices, nor to perform Network Address Translation between Fabrics. The existing address space for each Switch includes a dynamically configurable number of host bits sufficient to address all the end devices coupled to the Switch and the Switch itself. The remaining bits, called the Switch prefix, are used to identify the Switch in the switching Fabric. In an alternative embodiment, the Switch prefix bits may be further configured into a first sub-set of bits used to identify a specific Fabric (Fabric prefix) and a second sub-set of bits used to identify the Switch in the Fabric (Switch_ID).

Abstract: A Fibre Channel Switch which enables end devices in different Fabrics to communicate with one another while retaining their unique Fibre Channel Domain_IDs. The Switch is coupled to a first fabric having a first set of end devices and a second fabric having a second set of end devices. The Switch is configured to enable communication by the first set of end devices associated with the first fabric with the second set of end devices associated with the second set of end devices using the unique Domain_IDs of each of the first set and the second set of end devices. In one embodiment of the invention, the first and second fabrics are first and second Virtual Storage Array Networks (VSANs) respectively. In an alternative embodiment, the first fabric and the second fabric are separate physical fabrics.

Abstract: A way to assign flexible prefixes to Switches in Fiber Channel Fabrics while using the currently defined FC_ID address space. This allows end devices in different Fiber Channel Fabrics to communicate with one another, without requiring modifications to existing end devices, nor to perform Network Address Translation between Fabrics. The existing address space for each Switch includes a dynamically configurable number of host bits sufficient to address all the end devices coupled to the Switch and the Switch itself. The remaining bits, called the Switch prefix, are used to identify the Switch in the switching Fabric. In an alternative embodiment, the Switch prefix bits may be further configured into a first sub-set of bits used to identify a specific Fabric (Fabric prefix) and a second sub-set of bits used to identify the Switch in the Fabric (Switch_ID).

Abstract: An Fibre Channel Switch which enables end devices in different Fabrics to communicate with one another while retaining their unique Fibre Channel Domain_IDs. The Switch is coupled to a first fabric having a first set of end devices and a second fabric having a second set of end devices. The Switch is configured to enable communication by the first set of end devices associated with the first fabric with the second set of end devices associated with the second set of end devices using the unique Domain_IDs of each of the first set and the second set of end devices. In one embodiment of the invention, the first and second fabrics are first and second Virtual Storage Array Networks (VSANs) respectively. In an alternative embodiment, the first fabric and the second fabric are separate physical fabrics.

Abstract: This document discusses, among other things, applying network policy at a network device. In an example embodiment fibre channel hard zoning information may be received that indicates whether a fibre channel frame is permitted to be communicated between two fibre channel ports. Some example embodiments include identifying a media access control addresses associated with the fibre channel ports. An example embodiment may include generating one or more access control entries based on the fibre channel identifications of the fibre channel ports and the zoning information. The access control entries may be distributes to an Ethernet port to be inserted into an existing access control list and used to enforce a zoning policy upon fibre channel over Ethernet frames.

Abstract: Methods and apparatus are provided for credit-based flow control. Techniques allow a receiver to provide buffer characteristic information to a sender using a single extended receiver ready signal. Multiple credits can be allocated using a single extended receiver ready signal as well. Counters and registers are used to allow for the accidental loss of extended receiver ready signals while still maintaining an accurate reflection of the types and numbers of buffers available.

Abstract: Methods and apparatus for implementing storage virtualization on a network device of a storage area network are disclosed. A frame or packet is received at a port of the network device. It is then determined that the frame or packet pertains to access of a virtual storage location of a virtual storage unit representing one or more physical storage locations on one or more physical storage units of the storage area network. A virtual-physical mapping between the one or more physical storage locations and the virtual storage location is then obtained. A new or modified frame or packet is then sent to an initiator or a target specified by the virtual-physical mapping.

Abstract: A fast, lightweight, reliable, packet-based protocol that operates independent of the type of networking protocol used by the underlying physical layer of the network is disclosed. More specifically, the packet based protocol operates independently of or is capable of encapsulating physical layer protocols such as but not limited to MAC, Ethernet, Ethernet II, HARD or IP. The protocol defines at least three different types of frames including Information frames, Supervisory frames, and Unnumbered frames. In various embodiments of the invention, the Information, Supervisory, and Unnumbered frames include DSAP and SSAP field with semantics which are sufficiently large to support the various physical layer protocols that may be used on the network. The Information frames, Supervisory frames, and Unnumbered frames also have the ability to support urgent data delivery and certain memory management functions.

Abstract: Methods and apparatus for implementing storage virtualization on a network device of a storage area network are disclosed. A frame or packet is received at a port of the network device. It is then determined that the frame or packet pertains to access of a virtual storage location of a virtual storage unit representing one or more physical storage locations on one or more physical storage units of the storage area network. A virtual-physical mapping between the one or more physical storage locations and the virtual storage location is then obtained. A new or modified frame or packet is then sent to an initiator or a target specified by the virtual-physical mapping.

Abstract: A system for rapidly switching at least one virtual local area network (VLAN) from a first loop-free topology to a second loop-free topology in response to a failure within the first loop-free topology. Each VLAN has one “logical” VLAN which represents the network entities organized into the VLAN and a set of “physical” VLANs each having its own VLAN designation. For each physical VLAN, a different loop-free topology is defined, although only one physical VLAN is “active” at any given time. Messages associated with the logical VLAN are tagged with the designation of the currently active physical VLAN, and forwarded along its loop-free topology. Upon detecting a failure in the loop-free topology, the logical VLAN is rapidly switched to the loop-free topology defined by a second, back-up physical VLAN. Following the switch, messages associated with the logical VLAN are tagged with the designation of this back-up VLAN and are forwarded along its loop-free topology.

Abstract: A network device is configured in a manner to prevent connectivity loops such as one way connectivity loops. A user configures a port of the network device to have an associated state. The state indicates that the port is for communication up the spanning tree towards a root network device, or down the spanning tree away from the root network device. The spanning tree protocol is then executed and determines a role for the port. The role determined by the spanning tree protocol is compared to the user selected state, and if there is an inconsistency, for example one that would indicate a one way connectivity loop, the port is blocked.

Abstract: A method for searching network messages for pre-defined regular expressions is disclosed. A plurality of pre-defined regular expressions are stored in a content-addressable memory (CAM). A network message or selected portion thereof is inputted to the CAM for comparison with all of the regular expressions stored therein, the comparison with all CAM entries being done at the same time. An output is returned from the CAM. In response to the output from the CAM, identifying an action to be applied to the given network message or portion thereof that corresponds to a CAM entry matching the inputted network message or selected portion thereof.