Abstract: Systems and methods for allowing continuous network traffic processing by an SDN appliance despite a lost or disrupted connection with an SDN controller are provided. According to one embodiment, a software-defined networking (SDN) appliance receives one or more policies/flows from an SDN controller. The policies/flows are locally stored by the SDN appliance within the SDN appliance. Responsive to receipt of a packet to be processed by the SDN appliance, the SDN appliance queries the SDN controller for an appropriate policy or flow for the packet. When a response to the query is not received from the SDN controller within a predefined or configurable timeout period, the SDN appliance processes the packet based on the locally stored one or more policies/flows.

Abstract: Systems and methods for an SDN switch that provides application-based conditional forwarding and session-aware load balancing are provided. According to one embodiment, a packet is received at an input port of a Software Defined Networking (SDN) switch. The packet is forwarded by the SDN switch to a first flow processing unit (FPU) of multiple FPUs of the SDN switch. The first FPU determines whether the packet is to be tracked. And, if so, the received packet is transmitted to a second FPU of the SDN switch; otherwise, the packet is transmitted to a third FPU of the SDN switch. When the packet is received at the second FPU, the packet is conditionally forwarded by the SDN switch to an application device. When the packet is received at the third FPU, the packet is conditionally forwarded to an output port or dropped.

Abstract: Systems and methods for allowing continuous network traffic processing by an SDN appliance despite a lost or disrupted connection with an SDN controller are provided. According to one embodiment, a software-defined networking (SDN) appliance receives one or more policies/flows from an SDN controller. The policies/flows are locally stored by the SDN appliance within the SDN appliance. Responsive to receipt of a packet to be processed by the SDN appliance, the SDN appliance queries the SDN controller for an appropriate policy or flow for the packet. When a response to the query is not received from the SDN controller within a predefined or configurable timeout period, the SDN appliance processes the packet based on the locally stored one or more policies/flows.

Abstract: Systems and methods for an SDN switch that provides service group chaining for sequentially serving multiple network security devices are provided. According to one embodiment, a packet received by the switch is processed by a first FPU based on a first set of rules and forwarded conditionally to a first security device. The packet is security processed, including dropping it or forwarding it to an egress port or forwarding it to a second FPU. When forwarded to the second FPU, the packet is processed based on a second set of rules by forwarding it to a second security device or dropping it or forwarding it to the egress port. When forwarded to the second security device, the packet is security processed, including dropping it or forwarding it to the egress port or conditionally forwarding it to a third FPU to be sequentially forwarded to a third security device.

Abstract: Systems and methods for an SDN switch that facilitates forwarding/differential routing decision determination are provided. A packet is received at an input port of the SDN switch. The switch includes a first and second set of flow processing units (FPUs). The packet is forwarded to a first FPU of the first set. Based on a flow table associated with the first FPU, it is determined whether the packet is to be forwarded to a network device or an output port. The packet is received from the network device at a second FPU of the second set. Based on a flow table associated with the second FPU, it is determined whether to execute one or more instructions to forward the packet to the input or output port, or to drop or default forward the packet to the input or output port.

Abstract: Systems and methods for scalable SDN devices having ports/network interfaces mapped to cardinal flow processing (CFP) units are provided. According to one embodiment, an incoming packet is received, at a software-defined networking (SDN) switch. An ingress port on which the incoming packet was received is determined. A cardinal direction to which the ingress port is mapped is determined. Based on the determined cardinal direction, the SDN switch identifies a cardinal flow processing (CFP) unit within the SDN switch with which the determined cardinal direction is associated. The SDN switch then causes the incoming packet to be processed by the identified CFP unit.

Abstract: Systems and methods for an SDN switch that provides service group chaining for sequentially serving multiple network security devices are provided. According to one embodiment, a packet received by the switch is processed by a first FPU based on a first set of rules and forwarded conditionally to a first security device. The packet is security processed, including dropping it or forwarding it to an egress port or forwarding it to a second FPU. When forwarded to the second FPU, the packet is processed based on a second set of rules by forwarding it to a second security device or dropping it or forwarding it to the egress port. When forwarded to the second security device, the packet is security processed, including dropping it or forwarding it to the egress port or conditionally forwarding it to a third FPU to be sequentially forwarded to a third security device.

Abstract: Systems and methods for an SDN switch that provides application-based conditional forwarding and session-aware load balancing are provided. According to one embodiment, a packet is received at an input port of a Software Defined Networking (SDN) switch. The packet is forwarded by the SDN switch to a first flow processing unit (FPU) of multiple FPUs of the SDN switch. The first FPU determines whether the packet is to be tracked. And, if so, the received packet is transmitted to a second FPU of the SDN switch; otherwise, the packet is transmitted to a third FPU of the SDN switch. When the packet is received at the second FPU, the packet is conditionally forwarded by the SDN switch to an application device. When the packet is received at the third FPU, the packet is conditionally forwarded to an output port or dropped.

Abstract: Systems and methods for an SDN switch that facilitates forwarding/differential routing decision determination are provided. A packet is received at an input port of the SDN switch. The switch includes a first and second set of flow processing units (FPUs). The packet is forwarded to a first FPU of the first set. Based on a flow table associated with the first FPU, it is determined whether the packet is to be forwarded to a network device or an output port. The packet is received from the network device at a second FPU of the second set. Based on a flow table associated with the second FPU, it is determined whether to execute one or more instructions to forward the packet to the input or output port, or to drop or default forward the packet to the input or output port.

Abstract: Methods and systems for implementing scalable SDN devices having a flexible data path pipeline having multiple flow tables and a hybrid memory approach are provided. According to one embodiment, an SDN switch performs a method of storing a flow table within a memory device most suitable for the type of rules contained within the flow table. A flow table for use in connection with determining how to process a packet received by the SDN switch is received by the SDN switch. The flow table is stored within a DRAM device of the SDN switch when rules contained within the flow table include keys against which exact matching is performed with fields of the packet. The flow table is stored within a TCAM device of the SDN switch when rules contained within the flow table include keys against which regular expression-based matching is performed with the fields of the packet.

Abstract: Systems and methods for scalable SDN devices having ports/network interfaces mapped to cardinal flow processing (CFP) units are provided. According to one embodiment, an incoming packet is received, at a software-defined networking (SDN) switch. An ingress port on which the incoming packet was received is determined. A cardinal direction to which the ingress port is mapped is determined. Based on the determined cardinal direction, the SDN switch identifies a cardinal flow processing (CFP) unit within the SDN switch with which the determined cardinal direction is associated. The SDN switch then causes the incoming packet to be processed by the identified CFP unit.