Abstract:
System and method for using multiple global identification subnet prefix values in a network switch environment in a high performance computing environment. A packet is received from a network fabric by a first Host Channel Adapter (HCA). The packet has a header portion including a destination subnet prefix identifying a destination subnet of the network fabric. The network HCA is allowed to receive the first packet from a port of the network HCA by selectively determining a logical state of a flag and, selectively in accordance with a predetermined logical state of the flag, ignoring the destination subnet prefix identifying the destination subnet of the network fabric.
Abstract:
An integrated firewall provides security in a multi-tenant environment having a connection-based switched fabric directly connecting database servers which provide a plurality of database services with application servers hosting database service consumers each having a different database service consumer identity. The firewall functionality integrated into each database server provides access control by discarding communication packets which do not include a database service consumer identity and using the database service consumer identity in combination with an access control list to control access from the database service consumers to the database services. The access control includes address resolution access control, connection establishment access control, and data exchange access control based on said access control list. The integrated firewall enables direct connection of database servers and application servers via an InfiniBand network providing without requiring a separate intermediary firewall appliance or security node.
Abstract:
Systems and methods for initiating a forced migration of a virtual machine. An exemplary embodiment can provide a subnet manager (SM) and an active virtual machine registration cache, where the subnet manager can access the active virtual machine registration cache. The SM can record a first virtual machine incarnation number in the active virtual machine registration cache, where the virtual machine incarnation number is associated with an active virtual machine (VM). Upon receiving a request to register the active VM on a different host, the SM can evaluate a second virtual machine incarnation number with the first virtual machine incarnation number to determine the legality of the request. In accordance with an embodiment, if the second virtual machine incarnation number is evaluated as greater than the first virtual machine incarnation number, the SM determines the request is legal.
Abstract:
A system and method for supporting network isolation in a multi-tenant cluster environment. An exemplary method can support one or more tenants, and can associate each of the one or more tenants with a partition of a plurality of partitions, and can also associate each of the plurality of partitions with one or more nodes of a plurality of nodes, each of the plurality of nodes being associated with a leaf switch of a plurality of switches. The method can mark each of the plurality of partitions with a policy parameter. The method can assign each node of the plurality of nodes a partitioning order based on the marked on the partition associated with each node. Finally, the method can, based at least upon the marking of the partition of the plurality of partitions, generate one or more linear forwarding tables for use in the multi-tenant cluster environment.
Abstract:
Systems and methods are provided for supporting efficient reconfiguration of an interconnection network having a pre-existing routing comprising. An exemplary method can provide, a plurality of switches, the plurality switches comprising at least one leaf switch, wherein each of the one or more switches comprise a plurality of ports, and a plurality of end nodes, wherein the plurality of end nodes are interconnected via the one or more switches. The method can detect, by a subnet manager, a reconfiguration triggering event. The method can compute, by the subnet manager, a new routing for the interconnection network, wherein the computing by the subnet manager of the new routing for the interconnection network takes into consideration the pre-existing routing and selects the new routing for the interconnection network that is closest to the pre-existing routing. The method can reconfigure the interconnection network according to the new routing.
Abstract:
Systems and methods are provided for implementing a Virtual Switch (vSwitch) architecture that supports transparent virtualization and live migration. In an embodiment, a vSwitch with prepopulated Local Identifiers (LIDs). Another embodiment provides for vSwitch with dynamic LID assignment. Another embodiment provides for vSwitch with prepopulated LIDS and dynamic LID assignment Moreover, embodiments of the present invention provide scalable dynamic network reconfiguration methods which enable live migrations of VMs in network environments.
Abstract:
A system and method can support subnet management in a network environment, such as an engineered system for middleware and application execution or a middleware machine environment. A subnet manager (SM) can retrieve information for setting up a reliable connection (RC) between a subnet administrator (SA) and a client node in a subnet. Furthermore, the system can set up one or more connection states for a port associated with the SM node to establish the RC connection between the port associated with the SM node and a port associated with said client node. Then, the SM can activate the port associated with said client node.
Abstract:
An integrated firewall provides security in a multi-tenant environment having a connection-based switched fabric directly connecting database servers which provide a plurality of database services with application servers hosting database service consumers each having a different database service consumer identity. The firewall functionality integrated into each database server provides access control by discarding communication packets which do not include a database service consumer identity and using the database service consumer identity in combination with an access control list to control access from the database service consumers to the database services. The access control includes address resolution access control, connection establishment access control, and data exchange access control based on said access control list. The integrated firewall enables direct connection of database servers and application servers via an InfiniBand network providing without requiring a separate intermediary firewall appliance or security node.
Abstract:
A system and method can rout traffic between distinct subnets in a network environment. A router that connects the distinct subnets, such as InfiniBand (IB) subnets, can receive a list of destinations that the router is responsible for routing one or more packets to. Then, the router can generate a random number based on a source local identifier (LID) and a destination LID associated with the one or more packets, and use a modulo based hash to select one router port from a plurality of output router ports of the router.
Abstract:
A system and method can support data service address resolution in a network environment. An intermediate node can receive an incoming data packet from a source node, wherein the incoming data packet targets a destination node, and wherein the incoming data packet includes a global identifier for the destination node and a local identifier for the intermediate node. Furthermore, the intermediate node can obtain local addressing information for the destination node based on the global identifier for the destination node. Then, the intermediate node can send an outgoing data packet to the destination node based on the obtained local addressing information for the destination node.