Abstract: Processing an ingress packet in a packet pipeline to determine a forwarding rule includes identifying a matching rule in each forwarding table in the pipeline. Prefix lengths of the respective matching rules are compared. The matching rule with the greatest prefix length serves as the basis for forwarding an egress packet.

Abstract: Techniques for ensuring that, in the context of network traffic load-balanced across a plurality of service devices connected to a network device, all of the bi-directional traffic between a given pair of hosts residing in different domains is sent to the same service device, where a “domain” is a group of one or more hosts/subnets that is reachable by a service device via an interface of that device. In one set of embodiments, these techniques can include (1) creating a load balancer group on the network device for each domain defined on the service devices, such that the load balancer group for a given domain D includes all of the service device interfaces mapped to D, (2) enabling symmetric hashing with respect to each load balancer group, and (3) synchronizing the hash tables of the load balancer groups such that a given hash bucket (across all hash tables) maps to an interface of a single service device.

Abstract: Processing an ingress packet in a packet pipeline to determine a forwarding rule includes identifying a matching rule in each forwarding table in the pipeline. Prefix lengths of the respective matching rules are compared. The matching rule with the greatest prefix length serves as the basis for forwarding an egress packet.

Abstract: Techniques for implementing history-based connection-server affinity on a network load balancer are provided. In one set of embodiments, the network load balancer can receive a network packet destined for a service, where the service is associated with a plurality of servers, and where the packet is part of a network connection between a client device and one of the plurality of servers. The network load balancer can further compute, using a portion of the packet, a bucket identifier of a bucket for the network connection, identify a first server in the plurality of servers that is currently mapped to the bucket identifier in a hash table, and send the packet to the first server. If the network load balancer receives the packet back from the first server, the network load balancer can determine, based on local history information, a second server that was previously mapped to the bucket identifier in the hash table and send the packet to that second server.

Abstract: Techniques for ensuring that, in the context of network traffic load-balanced across a plurality of service devices connected to a network device, all of the bi-directional traffic between a given pair of hosts residing in different domains is sent to the same service device, where a “domain” is a group of one or more hosts/subnets that is reachable by a service device via an interface of that device. In one set of embodiments, these techniques can include (1) creating a load balancer group on the network device for each domain defined on the service devices, such that the load balancer group for a given domain D includes all of the service device interfaces mapped to D, (2) enabling symmetric hashing with respect to each load balancer group, and (3) synchronizing the hash tables of the load balancer groups such that a given hash bucket (across all hash tables) maps to an interface of a single service device.

Abstract: Techniques for implementing resilient hashing with compression are provided. In some embodiments, a network device can maintain a compressed partition and an uncompressed partition for a logical hash table, where the logical hash table comprises a first set of mappings between bucket identifiers and active next-hop destinations, the compressed partition comprises a second set of mappings between compressed indices and the active next-hop destinations, and the uncompressed partition comprises a third set of mappings between uncompressed indices and the active next-hop destinations. The network device can compute a hash value using a portion of a packet. When the hash value is addressed by a compressed index, the packet is sent to a next-hop destination in the compressed partition. When the hash value is addressed by an uncompressed index, the packet is sent to a next-hop destination in the uncompressed partition.

Abstract: Techniques for implementing resilient hashing with multiple hashes are provided. In one set of embodiments, a network device can maintain a first hash table comprising mappings between a first set of hash indices and a set of bit values. The network device can also maintain a second hash table comprising mappings between a second set of hash indices and active next-hop destinations. Upon receiving a network packet, the network device can compute a first hash and can match the first hash value to a first mapping in the first hash table based on the first mapping's hash index. When the first mapping's bit value indicates that the first mapping's hash index corresponds to an active next-hop destination, the network device can further match the first hash value to a second mapping in the second hash table and send the network packet to the second mapping's active next-hop destination.

Abstract: Certain embodiments disclosed herein relate to method for egress maximum transmission unit (MTU) enforcement. The method may include receiving a protocol packet at an ingress interface of a network device; make a first determination of a protocol packet payload length; performing an ingress MTU identifier lookup in an ingress MTU identifier table using the protocol packet payload length to obtain an ingress MTU identifier; performing a packet propagation lookup to obtain an egress MTU identifier; performing an MTU enforcement lookup in an MTU enforcement table using the ingress MTU identifier and the egress MTU identifier to obtain an egress action; and performing the egress action.

Abstract: Certain embodiments disclosed herein relate to method for egress maximum transmission unit (MTU) enforcement. The method may include receiving a protocol packet at an ingress interface of a network device; make a first determination of a protocol packet payload length; performing an ingress MTU identifier lookup in an ingress MTU identifier table using the protocol packet payload length to obtain an ingress MTU identifier; performing a packet propagation lookup to obtain an egress MTU identifier; performing an MTU enforcement lookup in an MTU enforcement table using the ingress MTU identifier and the egress MTU identifier to obtain an egress action; and performing the egress action.

Abstract: Techniques for implementing resilient hashing with multiple hashes are provided. In one set of embodiments, a network device can maintain a first hash table comprising mappings between a first set of hash indices and a set of bit values. The network device can also maintain a second hash table comprising mappings between a second set of hash indices and active next-hop destinations. Upon receiving a network packet, the network device can compute a first hash and can match the first hash value to a first mapping in the first hash table based on the first mapping's hash index. When the first mapping's bit value indicates that the first mapping's hash index corresponds to an active next-hop destination, the network device can further match the first hash value to a second mapping in the second hash table and send the network packet to the second mapping's active next-hop destination.

Abstract: Techniques for implementing resilient hashing with compression are provided. In one set of embodiments, a network device can maintain a compressed partition and an uncompressed partition for a logical hash table, where (1) the logical hash table comprises a first set of mappings between bucket identifiers and active next-hop destinations, (2) the compressed partition comprises a second set of mappings between compressed indices and the active next-hop destinations, each compressed index in the second set addressing C consecutive bucket identifiers in the first set, and (3) the uncompressed partition comprises a third set of mappings between uncompressed indices and the active next-hop destinations, each uncompressed index in the third set addressing a single bucket identifier in the first set. Upon receiving a network packet, the network device can compute a hash value using a portion of the packet.

Abstract: Techniques for implementing history-based connection-server affinity on a network load balancer are provided. In one set of embodiments, the network load balancer can receive a network packet destined for a service, where the service is associated with a plurality of servers, and where the packet is part of a network connection between a client device and one of the plurality of servers. The network load balancer can further compute, using a portion of the packet, a bucket identifier of a bucket for the network connection, identify a first server in the plurality of servers that is currently mapped to the bucket identifier in a hash table, and send the packet to the first server. If the network load balancer receives the packet back from the first server, the network load balancer can determine, based on local history information, a second server that was previously mapped to the bucket identifier in the hash table and send the packet to that second server.

Abstract: A method is provided in one example embodiment and includes compiling a schema definition file associated with a non-native application into a command file, the non-native application being executable in connection with a network element; creating at least one parse chain for the non-native application; storing the at least one parse chain in a database; and receiving a first command associated with the non-native application from a network administrator. The method further includes parsing the received first command as specified by the at least one parse chain to extract data therefrom; and presenting the extracted data to the non-native application, in which the extracted data is formatted as specified in the associated schema definition file prior to the presenting.