Abstract: A method and an apparatus for cross-service-zone communication, and a data center network. When a first virtual machine in a server sends a packet to a second virtual machine, the server determines, through searching, whether a routing table of a tenant to which the first virtual machine belongs exists on the server; when the routing table of the tenant to which the first virtual machine belongs does not exist on the server, send the packet to a gateway; receive the routing table of the tenant to which the first virtual machine belongs sent by the gateway through a service zone manager; and forward a subsequent packet of the first virtual machine according to the routing table; where the first virtual machine and the second virtual machine are located in different service zones.

Abstract: A source routing method and apparatus are provided. The method includes receiving a data packet that comprises a destination address, a source address, and a payload, determining a plurality of next-hops along a service chain path between the source address and the destination address, generating a source routed data packet that comprises the destination address, the source address, the plurality of next-hops, and the payload, setting the destination address of the source routed data packet to a first next-hop from the plurality of next-hops along the service chain path, and forwarding the source routed data packet in accordance with the destination address.

Abstract: A service description may be used in network virtualization in order to specify requirements of an application. In order to provide network virtualization for generic networking components, including legacy networking components, the service description is mapped to a logical network implementation and then subsequently mapped to a physical implementation.

Abstract: A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.

Abstract: An address resolution method, comprising obtaining an Internet Protocol (IP) address for a destination network node, computing a Media Access Control (MAC) address for the destination network node using a mapping function and the IP address for the destination network node, and sending data traffic using the MAC address computed for the destination network node.

Abstract: An embodiment method of loop suppression in a layer-two transit network with multiprotocol label switching (MPLS) encapsulation includes receiving a packet at a provider edge (PE) router for the layer-two transit network. The packet is stored in a non-transitory memory on the PE router. The packet is stored according to a packet data structure having an MPLS label field and a layer-two header. A time-to-live (TTL) attribute is then determined for the packet. The TTL attribute is written to the non-transitory memory in the MPLS label field. The packet is then routed according to information in the layer-two header.

Abstract: A source routing method and apparatus are provided. The method includes receiving a data packet that comprises a destination address, a source address, and a payload, determining a plurality of next-hops along a service chain path between the source address and the destination address, generating a source routed data packet that comprises the destination address, the source address, the plurality of next-hops, and the payload, setting the destination address of the source routed data packet to a first next-hop from the plurality of next-hops along the service chain path, and forwarding the source routed data packet in accordance with the destination address.

Abstract: A service chaining method comprising receiving a source routed data packet, wherein the source routed data packet comprises a destination address and identifies a plurality of next-hops along a service chain path, identifying a next-hop for the source routed data packet using the plurality of next-hops, determining whether the next-hop is source routing capable, setting the destination address of the source routed data packet in accordance with the determination, wherein the destination address is set to the next-hop when the next-hop is source routing capable, and wherein the destination address is set to a next downstream network node that is source routing capable when the next-hop is not source routing capable, and forwarding the source routed data packet to the next-hop.

Abstract: Routers using virtual routing and forwarding nodes to implement a service fabric of service chains. The router may configure M+1 virtual routing and forwarding instances, M being an integer representing a number of a plurality of service appliances in a data center network. Each virtual routing and forwarding instance may be associated with a routing table of routing rules to define various service chain routing paths. The routing rules are based on destination addresses in data packets.

Abstract: The devices, systems, and methods test network connectivity, where the physical network is used to provide one or more service chains connecting service appliances, including firewalls, intrusion detection systems, load balancers, network address translators, web servers, and so on. A service chain may involve multiple routing paths. The devices, systems, and methods test network connectivity test network connectivity by injecting customized echo request packets on each routing path and collecting customized echo reply packets in response. The customized echo reply packets are processed and aggregated to isolate network connectivity problems.

Abstract: A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.

Abstract: An embodiment method of loop suppression in a layer-two transit network with multiprotocol label switching (MPLS) encapsulation includes receiving a packet at a provider edge (PE) router for the layer-two transit network. The packet is stored in a non-transitory memory on the PE router. The packet is stored according to a packet data structure having an MPLS label field and a layer-two header. A time-to-live (TTL) attribute is then determined for the packet. The TTL attribute is written to the non-transitory memory in the MPLS label field. The packet is then routed according to information in the layer-two header.

Abstract: A service chaining method comprising receiving a source routed data packet, wherein the source routed data packet comprises a destination address and identifies a plurality of next-hops along a service chain path, identifying a next-hop for the source routed data packet using the plurality of next-hops, determining whether the next-hop is source routing capable, setting the destination address of the source routed data packet in accordance with the determination, wherein the destination address is set to the next-hop when the next-hop is source routing capable, and wherein the destination address is set to a next downstream network node that is source routing capable when the next-hop is not source routing capable, and forwarding the source routed data packet to the next-hop.

Abstract: An address resolution method, comprising obtaining an Internet Protocol (IP) address for a destination network node, computing a Media Access Control (MAC) address for the destination network node using a mapping function and the IP address for the destination network node, and sending data traffic using the MAC address computed for the destination network node.

Abstract: A method implemented by a hypervisor located in a first network device (ND), the method comprising sending to and receiving from a second ND a first type of packet, wherein each packet of the first type of packet comprises media access control (MAC) layer information of a client; and sending to and receiving from a third ND a second type of packet, wherein each packet of the second type of packet contains no client MAC layer information.

Abstract: The devices, systems, and methods test network connectivity, where the physical network is used to provide one or more service chains connecting service appliances, including firewalls, intrusion detection systems, load balancers, network address translators, web servers, and so on. A service chain may involve multiple routing paths. The devices, systems, and methods test network connectivity test network connectivity by injecting customized echo request packets on each routing path and collecting customized echo reply packets in response. The customized echo reply packets are processed and aggregated to isolate network connectivity problems.

Abstract: A virtual Internet Protocol (IP) address is assigned to a client device having a client IP address associated therewith. The virtual IP address is then mapped to the client IP address and to an identifier of a Secure Socket Layer (SSL) Virtual Private Network (VPN) tunnel. An incoming packet received through the SSL VPN tunnel and destined to a server device has the client IP address as its source address, which is in turn rewritten with the virtual IP address mapped to the client IP address, resulting in a modified incoming packet that is sent to the server device. An outgoing packet received from the server device for transmission to the client device has the virtual IP address as its destination address, which is in turn rewritten with the client IP address mapped to the virtual IP address, resulting in a modified outgoing packet that is forwarded into the tunnel.

Abstract: Routers using virtual routing and forwarding nodes to implement a service fabric of service chains. The router may configure M+1 virtual routing and forwarding instances, M being an integer representing a number of a plurality of service appliances in a data center network. Each virtual routing and forwarding instance may be associated with a routing table of routing rules to define various service chain routing paths. The routing rules are based on destination addresses in data packets.

Abstract: A service description may be used in network virtualization in order to specify requirements of an application. In order to provide network virtualization for generic networking components, including legacy networking components, the service description is mapped to a logical network implementation and then subsequently mapped to a physical implementation.

Abstract: An embodiment method of loop suppression in a layer-two transit network with multiprotocol label switching (MPLS) encapsulation includes receiving a packet at a provider edge (PE) router for the layer-two transit network. The packet is stored in a non-transitory memory on the PE router. The packet is stored according to a packet data structure having an MPLS label field and a layer-two header. A time-to-live (TTL) attribute is then determined for the packet. The TTL attribute is written to the non-transitory memory in the MPLS label field. The packet is then routed according to information in the layer-two header.