System and method for automated policy-based routing
A computing apparatus for providing an integrated service engine on a network switch, including: one or more logic elements comprising a protocol engine operable for providing a state machine, wherein states of the state machine include: an add-in-progress state operable for receiving an automated policy-based routing (APBR) add transaction, and to set an add-in-progress flag; an add-complete state operable for receiving an APBR add-complete transaction and to clear the add-in-progress flag; a delete-in-progress state operable to receive an APBR delete transaction and to set a delete-in-progress flag; and a delete-complete state operable to receive an APBR delete-complete transaction and to clear the delete-in-progress flag.
1. A computing apparatus for providing an integrated service engine on a network switch, comprising:
a communication interface configured to enable network communications;
one or more processors coupled with the communication interface; and
at least one non-transitory computer readable storage medium storing one or more logic elements comprising a protocol engine configured to provide virtual port channel (VPC) support, wherein two switches are connected in VPC mode, wherein each is connected to a service appliance, and the service appliance is configured to determine that it is in VPC mode and send a common automated policy-based routing (APBR) transaction to both switches, the protocol engine is further configured to provide a state machine, wherein states of the state machine comprise:
an add-in-progress state configured to receive an APBR add transaction, and to set an add-in-progress flag, wherein the APBR add transaction includes an Internet Protocol (IP) address and a port of a physical server for generating an access control list, wherein the access control list is incorporated into a route map, and the add-in-progress state is further configured to apply to an interface of the network switch that reaches the physical server;
an add-complete state configured to receive an APBR add-complete transaction and to clear the add-in-progress flag;
a delete-in-progress state configured to receive an APBR delete transaction and to set a delete-in-progress flag, wherein the APBR delete transaction includes removing the route map from the interface of the network switch that reaches the physical server and deleting the access control list; and
a delete-complete state configured to receive an APBR delete-complete transaction and to clear the delete-in-progress flag.
2. The computing apparatus of claim 1 , wherein the add-in-progress state is further configured to create the access control list (ACL) store in a data structure.
3. The computing apparatus of claim 1 , wherein the add-complete state is further configured to create the route map, associating the route map with an ACL, and storing an add state in a persistent storage.
4. The computing apparatus of claim 1 , wherein the delete-in-progress state is further configured to evaluate the APBR delete transaction, and determining that at least one operation may be skipped.
5. The computing apparatus of claim 1 , wherein the delete-complete state is further configured to delete at least one of an access control entry (ACE), an access control list (ACL), a route map, or all three, storing the state in the data structure, and storing the state in a persistent storage.
6. The computing apparatus of claim 1 , wherein the protocol engine is further configured to provide message-based transactions, wherein a message comprises the fields <operation mode; rs_ipaddress; rs_port; nexthop_ip; protocol; and vlan_id>.
7. One or more computer-readable tangible, non-transitory mediums having stored thereon executable instructions for providing an integrated service engine, the instructions configured to:
provide a protocol engine configured to provide virtual port channel (VPC) support, wherein two switches are connected in VPC mode, and wherein each is connected to a service appliance, and the service appliance configured to determine that it is in VPC mode and send a common automated policy-based routing (APBR) transaction to both switches, the protocol engine is further configured to provide a state machine, wherein states of the state machine comprise:
an add-in-progress state configured to receive an APBR add transaction, and to set an add-in-progress flag, wherein the APBR add transaction includes an Internet Protocol (IP) address and a port of a physical server for generating an access control list, wherein the access control list is incorporated into a route map, and the add-in-progress state is further configured to apply to an interface of the network switch that reaches the physical server;
an add-complete state configured to receive an APBR add-complete transaction and to clear the add-in-progress flag;
a delete-in-progress state configured to receive an APBR delete transaction and to set a delete-in-progress flag, wherein the APBR delete transaction includes removing the route map from the interface of the network switch that reaches the physical server and deleting the access control list; and
a delete-complete state configured to receive an APBR delete-complete transaction and to clear the delete-in-progress flag.
8. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the add-in-progress state is further configured to create the access control list (ACL) store in a data structure.
9. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the add-complete state is further configured to create the route map, associating the route map with an ACL, and storing an add state in a persistent storage.
10. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the delete-in-progress state is further configured to evaluate the APBR delete transaction, and determining that at least one operation may be skipped.
11. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the delete-complete state is further configured to delete at least one of an access control entry (ACE), an access control list (ACL), a route map, or all three, storing the state in the data structure, and storing the state in a persistent storage.
12. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the protocol engine is further configured to provide message-based transactions, wherein a message comprises the fields <operation mode; rs_ipaddress; rs_port; nexthop_ip; protocol; and vlan_id>.
13. A computer-implemented method of providing an integrated service engine, comprising:
providing a protocol engine configured to provide virtual port channel (VPC) support, wherein two switches are connected in VPC mode, and wherein each is connected to a service appliance, and the service appliance configured to determine that it is in VPC mode and send a common automated policy-based routing (APBR) transaction to both switches, the protocol engine is further configured to provide a state machine, wherein states of the state machine comprise:
an add-in-progress state configured to receive an APBR add transaction, and to set an add-in-progress flag, wherein the APBR add transaction includes an Internet Protocol (IP) address and a port of a physical server for generating an access control list, wherein the access control list is incorporated into a route map, and the add-in-progress state is further configured to apply to an interface of the network switch that reaches the physical server;
an add-complete state configured to receive an APBR add-complete transaction and to clear the add-in-progress flag;
a delete-in-progress state configured to receive an APBR delete transaction and to set a delete-in-progress flag, wherein the APBR delete transaction includes removing the route map from the interface of the network switch that reaches the physical server and deleting the access control list; and
a delete-complete state configured to receive an APBR delete-complete transaction and to clear the delete-in-progress flag.
14. The method of claim 13 , wherein the add-in-progress state is further configured to create the access control list (ACL) store in a data structure.
15. The method of claim 13 , wherein the add-complete state is further configured to create the route map, associating the route map with an ACL, and storing an add state in a persistent storage.
16. The method of claim 13 , wherein the delete-in-progress state is further configured to evaluate the APBR delete transaction, and determining that at least one operation may be skipped.
17. The method of claim 13 , wherein the delete-complete state is further configured to delete at least one of an access control entry (ACE), an access control list (ACL), a route map, or all three, storing the state in the data structure, and storing the state in a persistent storage.
18. The computing apparatus of claim 1 , wherein the add-in-progress state is further configured to assign a service appliance next hop IP address to the route map.
19. The one or more tangible, non-transitory computer-readable mediums of claim 7 , wherein the add-in-progress state is further configured to assign a service appliance next hop IP address to the route map.
20. The method of claim 13 , wherein the add-in-progress state is further configured to assign a service appliance next hop IP address to the route map.