# US 8,274,973 B2 · Virtual service domains

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,274,973 B2
- Document ID: US8274973B2
- Status: Granted
- Kind: B2
- Application number: 12/730,352
- Filed: 2010-03-24
- Published: 2011-09-29
- Granted: 2012-09-25
- Earliest claimed: 2010-03-24
- Assignees: Cisco Technology, Inc.
- Inventors: Srinivas Sardar; Udayakumar Srinivasan; Shankar Ramachandran; Chidambareswaran Raman; Ajit Sanzgiri; Michael R. Smith
- Web page: https://patentgrep.com/patent/US8274973B2

## CPC

- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L 67/63: Routing a service request depending on the request content or context
- H04L 45/04: {Interdomain routing, e.g. hierarchical routing}
- H04L 69/12: Protocol engines
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In one embodiment, layer-2 (L2) ports of a network device may each be assigned to a particular virtual service domain (VSD). One or more virtual service engines (VSEs) may also be assigned in a particular order to each VSD, where each VSE is configured to apply a particular service to traffic traversing the VSE between ingress and egress service ports. Interconnecting the L2 ports and the ingress and egress service ports is an illustrative virtual Ethernet module (VEM), which directs traffic it receives according to rules as follows: a) into a destination VSD via the one or more correspondingly assigned VSEs in the particular order; b) out of a current VSD via the one or more correspondingly assigned VSEs in a reverse order from the particular order; or c) within a current VSD without redirection through a VSE.

## Claims

### Claim 1

A method, comprising:
assigning each of one or more layer-2 (L2) ports of a network device to a particular virtual service domain (VSD), each L2 port interconnected with a virtual Ethernet module (VEM) of the device;
assigning to each VSD one or more virtual service engines (VSEs) in a particular order, each VSE configured to apply a particular service to traffic traversing the VSE between an ingress service port that does not face a corresponding VSD to which the VSE is assigned and an egress service port that does face the corresponding VSD, the ingress and egress service ports interconnected with the VEM; and
directing traffic received at the VEM according to a set of rules, comprising:
a) for traffic traversing into a destination VSD, directing the traffic via the one or more correspondingly assigned VSEs in the particular order;
b) for traffic traversing out of a current VSD, directing the traffic via the one or more correspondingly assigned VSEs in a reverse order from the particular order; and
c) for traffic remaining within a current VSD, directing the traffic without redirection through a VSE.

### Claim 2 (depends on 1)

The method as in claim 1, wherein assigning an L2 port to a VSD comprises:
receiving a manual port assignment for a particular L2 port.

### Claim 3 (depends on 1)

The method as in claim 1, wherein assigning an L2 port to a VSD comprises:
dynamically assigning a particular L2 port to a particular VSD.

### Claim 4 (depends on 3)

The method as in claim 3, wherein dynamically assigning comprises:
determining a port assignment for a particular L2 port based on port attributes of the particular L2 port.

### Claim 5 (depends on 1)

The method as in claim 1, wherein the traffic to be directed is selected from the group consisting of: unicast traffic, multicast traffic, and broadcast traffic.

### Claim 6 (depends on 1)

The method as in claim 1, further comprising:
preventing media access control (MAC) address learning on the ingress service port and egress service port of VSEs on the device.

### Claim 7 (depends on 1)

The method as in claim 1, wherein at least one L2 port is a physical port of the device.

### Claim 8 (depends on 1)

The method as in claim 1, wherein at least one L2 port is a virtual port of the device.

### Claim 9 (depends on 1)

The method as in claim 1, wherein L2 ports of the device that are not assigned to a VSD are considered to be within a default VSD without an assigned VSE.

### Claim 10 (depends on 1)

The method as in claim 1, wherein the egress service port of a particular VSE is within the corresponding VSD to which the particular VSE is assigned.

### Claim 11 (depends on 1)

The method as in claim 1, wherein the VSDs are non-overlapping.

### Claim 12 (depends on 1)

The method as in claim 1, further comprising:
chaining a plurality of VSDs, wherein to reach a second VSD, a first VSD and its assigned one or more VSEs must first be traversed.

### Claim 13 (depends on 1)

The method as in claim 1, further comprising:
adding a virtual machine to the device, the virtual machine having one or more virtual L2 ports; and
assigning each of the virtual L2 ports of the virtual machine to a particular VSD.

### Claim 14 (depends on 1)

The method as in claim 1, further comprising:
adding a VSE to the device;
assigning the added VSE to a particular VSD in a particular order with one or more other VSEs assigned to the particular VSD.

### Claim 15

An apparatus, comprising:
a processor adapted to execute one or more processes;
one or more layer-2 (L2) ports;
one or more virtual service engines (VSEs), each VSE configured to apply a particular service to traffic traversing the VSE between an ingress service port that does not face a corresponding virtual service domain (VSD) to which the VSE is assigned and an egress service port that does face the corresponding VSD;
a memory configured to store VSD assignments, wherein one or more of the L2 ports are assigned to a particular VSD and wherein each VSD is assigned one or more VSEs in a particular order; and
a virtual Ethernet module (VEM) interconnected with the L2 ports, the ingress service ports of the one or more VSEs, and the egress service ports of the one or more VSEs, the VEM configured to direct traffic received at the VEM according to a set of rules, comprising:
a) for traffic traversing into a destination VSD, directing the traffic via the one or more correspondingly assigned VSEs in the particular order;
b) for traffic traversing out of a current VSD, directing the traffic via the one or more correspondingly assigned VSEs in a reverse order from the particular order; and
c) for traffic remaining within a current VSD, directing the traffic without redirection through a VSE.

### Claim 16 (depends on 15)

The apparatus as in claim 15, further comprising:
a user interface to receive a manual port assignment that assigns an L2 port to a VSD.

### Claim 17 (depends on 15)

The apparatus as in claim 15, wherein the VEM is further configured to dynamically assign a particular L2 port to a particular VSD.

### Claim 18 (depends on 15)

The apparatus as in claim 15, wherein the one or more L2 ports are selected from a group consisting of: physical ports and virtual ports of the device.

### Claim 19 (depends on 15)

The apparatus as in claim 15, further comprising:
one or more virtual machines.

### Claim 20 (depends on 19)

The apparatus as in claim 19, wherein the virtual machines are selected from the group consisting of: a web server, an email server, a database server, and a storage server.

### Claim 21

A non-transitory computer-readable media having software encoded thereon, the software when executed on a device having one or more layer-2 (L2) ports operable to: determine, for at least one of the one or more layer-2 (L2) ports, to which particular virtual service domain (VSD) the at least one L2 port is assigned; determine one or more virtual service engines (VSEs) that are assigned to each VSD, the VSEs being assigned in a particular order, each VSE configured to apply a particular service to traffic traversing the VSE between an ingress service port that does not face a corresponding VSD to which the VSE is assigned and an egress service port that does face the corresponding VSD; and direct traffic within the device according to a set of rules, comprising: a) for traffic traversing into a destination VSD, directing the traffic via the one or more correspondingly assigned VSEs in the particular order; b) for traffic traversing out of a current VSD, directing the traffic via the one or more correspondingly assigned VSEs in a reverse order from the particular order; and c) for traffic remaining within a current VSD, directing the traffic without redirection through a VSE.