Abstract: A method is provided in one example embodiment and includes determining an action to be performed with respect to a packet corresponding to a new flow received at a network device and determining whether a new entry comprising an indication of the determined action can be added to a flow table of the network device. The determination of whether a new entry can be added to the flow table is made with reference to reservation information specified in a port profile associated with the new flow. Responsive to a determination that the new entry can be added, the new entry is added to the flow table. In one embodiment, determining whether the new entry can be added comprises determining whether an existing entry can be aged out based on the reservation information specified in the associated port profile.

Abstract: An example method for co-operative load sharing and redundancy in distributed service chains is provided and includes deriving a service chain comprising a plurality of services in a distributed virtual switch (DVS) network environment, where a first service node provides a first portion of a specific service in the plurality of services to a packet traversing the network, and a second service node provides a second portion of the specific service to the packet, and configuring service forwarding tables at virtual Ethernet Modules associated with respective service nodes in the service chain. In a specific embodiment, the first service node and the second service node provide substantially identical service functions to the packet, wherein the specific service comprises the service functions. In various embodiments, each service node tags each packet to indicate a service completion history of service functions performed on the packet at the service node.

Abstract: A method is provided in one example embodiment and includes determining an action to be performed with respect to a packet corresponding to a new flow received at a network device and determining whether a new entry comprising an indication of the determined action can be added to a flow table of the network device. The determination of whether a new entry can be added to the flow table is made with reference to reservation information specified in a port profile associated with the new flow. Responsive to a determination that the new entry can be added, the new entry is added to the flow table. In one embodiment, determining whether the new entry can be added comprises determining whether an existing entry can be aged out based on the reservation information specified in the associated port profile.

Abstract: A network appliance that is part of a distributed virtual switch collects network flow information for network flows passing through the network appliance. The network flow information is encapsulated into packets as a data record for transport. Network flow exporter type information is added to the network flow records configured to indicate that the packets are from a distributed exporter. An option template is sent to the network flow data collectors that includes a device identifier that is configured to uniquely identify the network appliance. The packets are exported to the network flow data collector. The network flow data collector uses the network flow exporter type information and the device identifier to associate the network flow information with the distributed virtual switch.

Abstract: Techniques are described for identifying destinations in a virtual network by defining virtual entities such as a port profile as the destination for network policies, such as redirect or span to be a logical set of ports (i.e., ports belonging to a port-profile or a port group) where the members of the set of ports may be added/removed dynamically without requiring any changes to the network policy. Further, a network administrator (or other user) may predefine the destinations for a network policy even before some or all of the destinations are active on a given virtualized system. In such cases, the network policies may go into effect when the required entities become available.

Abstract: A method is provided in one example implementation and includes identifying a plurality of exporters that are authorized to communicate data to a collector on behalf of a secure domain; generating secure credentials for the secure domain; communicating the secure credentials to the collector; and authenticating the exporters using the secure credentials. In more particular implementations, the method can include receiving the secure credentials; receiving certain data that includes identifying information, which further includes an Internet protocol (IP) address of a source associated with the certain data; accepting the certain data if the secure credentials validate the identifying information; and rejecting the certain data if the secure credentials do not validate the identifying information.

Abstract: A method is provided in one example implementation and includes identifying a plurality of exporters that are authorized to communicate data to a collector on behalf of a secure domain; generating secure credentials for the secure domain; communicating the secure credentials to the collector; and authenticating the exporters using the secure credentials. In more particular implementations, the method can include receiving the secure credentials; receiving certain data that includes identifying information, which further includes an Internet protocol (IP) address of a source associated with the certain data; accepting the certain data if the secure credentials validate the identifying information; and rejecting the certain data if the secure credentials do not validate the identifying information.

Abstract: In one embodiment, ports of a network device are assigned to virtual service domains (VSDs). The ports are coupled to a virtual Ethernet module (VEM) of the network device. Each VSD is associated with one or more virtual service engines (VSEs) in a particular order. Each VSE is configured to apply a particular service to traffic traversing the VSE. Traffic received at a virtual Ethernet module (VEM) of the network device that is destined for a particular VSD, and is received on a port that has not been assigned to the particular VSD, is forwarded to the particular VSD via the one or more VSEs associated with the particular VSD such that the traffic traverses the one or more VSEs in the particular order.

Abstract: A network appliance that is part of a distributed virtual switch collects network flow information for network flows passing through the network appliance. The network flow information is encapsulated into packets as a data record for transport. Network flow exporter type information is added to the network flow records configured to indicate that the packets are from a distributed exporter. An option template is sent to the network flow data collectors that includes a device identifier that is configured to uniquely identify the network appliance. The packets are exported to the network flow data collector. The network flow data collector uses the network flow exporter type information and the device identifier to associate the network flow information with the distributed virtual switch.

Abstract: In one embodiment, a method includes receiving at a network device operating as a relay agent, a Dynamic Host Configuration Protocol (DHCP) request from an end host, inserting a group identifier into the DHCP request and forwarding the DHCP request to a DHCP server, the end host associated with a group identified by the group identifier, receiving a response from the DHCP server, and forwarding the response to the end host. The response includes configuration information for the end host, at least some of the configuration information selected based on the group identifier. An apparatus is also disclosed.

Abstract: In one embodiment, ports of a network device are assigned to virtual service domains (VSDs). The ports are coupled to a virtual Ethernet module (VEM) of the network device. Each VSD is associated with one or more virtual service engines (VSEs) in a particular order. Each VSE is configured to apply a particular service to traffic traversing the VSE. Traffic received at a virtual Ethernet module (VEM) of the network device that is destined for a particular VSD, and is received on a port that has not been assigned to the particular VSD, is forwarded to the particular VSD via the one or more VSEs associated with the particular VSD such that the traffic traverses the one or more VSEs in the particular order.

Abstract: In one embodiment, layer-2 (L2) ports of a network device may each be assigned to a particular virtual service domain (VSD). One or more virtual service engines (VSEs) may also be assigned in a particular order to each VSD, where each VSE is configured to apply a particular service to traffic traversing the VSE between ingress and egress service ports. Interconnecting the L2 ports and the ingress and egress service ports is an illustrative virtual Ethernet module (VEM), which directs traffic it receives according to rules as follows: a) into a destination VSD via the one or more correspondingly assigned VSEs in the particular order; b) out of a current VSD via the one or more correspondingly assigned VSEs in a reverse order from the particular order; or c) within a current VSD without redirection through a VSE.

Abstract: Techniques are described for identifying destinations in a virtual network by defining virtual entities such as a port profile as the destination for network policies, such as redirect or span to be a logical set of ports (i.e., ports belonging to a port-profile or a port group) where the members of the set of ports may be added/removed dynamically without requiring any changes to the network policy. Further, a network administrator (or other user) may predefine the destinations for a network policy even before some or all of the destinations are active on a given virtualized system. In such cases, the network policies may go into effect when the required entities become available.

Abstract: In one embodiment, layer-2 (L2) ports of a network device may each be assigned to a particular virtual service domain (VSD). One or more virtual service engines (VSEs) may also be assigned in a particular order to each VSD, where each VSE is configured to apply a particular service to traffic traversing the VSE between ingress and egress service ports. Interconnecting the L2 ports and the ingress and egress service ports is an illustrative virtual Ethernet module (VEM), which directs traffic it receives according to rules as follows: a) into a destination VSD via the one or more correspondingly assigned VSEs in the particular order; b) out of a current VSD via the one or more correspondingly assigned VSEs in a reverse order from the particular order; or c) within a current VSD without redirection through a VSE.