Hierarchical data traffic control in network environments

Abstract

Access control systems and methods herein successfully overcome ACL (access control list) group width limitations of existing designs by splitting an ACL group across different units, e.g., to create two ACL groups that each has a relatively smaller width. In one or more embodiments, availability of ACL space is increased by hierarchically splitting an ACL table to fit into different two networked devices and modifying certain fields carrying metadata in packets that are exchanged between the devices, such that one chipset may carry information about the lookup of another. In one or more embodiments, an ACL group for a port extender is created by selectively creating a sub-group with qualifiers that fit within an available group width, and moving the remaining qualifiers to a controlling bridge to achieve the desired functionality/action.

What is claimed is: 
     
         1 . A method comprising:
 receiving, at a second information handling system, data traffic from a first information handling system that is configured to add an indicator to the data traffic if the data traffic comprises data or has associated metadata that matches a first set of one or more qualifiers;   determining whether the data traffic from the first information handling system comprises data or has associated metadata that matches a second set of one or more qualifiers, in which the indicator is one of the qualifiers in the second set; and   responsive to the data traffic comprises data or has associated metadata that matches the second set of one or more qualifiers, performing an associated action for the data traffic at the second information handling system,   wherein the first set of one or more qualifiers and the second set of one or more qualifiers excluding the indicator qualifier, if formed into a single rule would exceed a threshold amount of memory.   
     
     
         2 . The method of  claim 1  wherein the data traffic is a packet. 
     
     
         3 . The method of  claim 2  wherein the indicator comprises a value from a plurality of possible values. 
     
     
         4 . The method of  claim 3 , wherein the indicator is a tag in a reserved field of the packet. 
     
     
         5 . The method of  claim 2  wherein the indicator comprises a header that is added to the packet. 
     
     
         6 . The method of  claim 1  wherein:
 adding the indicator to the data traffic if the data traffic comprises data or has associated metadata that matches the first set of one or more qualifiers represents a rule for the first information handling system; and 
 the first information handling system comprises a plurality of rules, in which each rule comprises its own set of one or more qualifiers and associated indicator. 
 
     
     
         7 . The method of  claim 1  wherein:
 performing the associated action to the data traffic if the data traffic comprises data or has associated metadata that matches the second set of one or more qualifiers represents a rule for the second information handling system; and 
 the second information handling system comprises a plurality of rules, in which each rule comprises its own set of one or more qualifiers and associated action or actions. 
 
     
     
         8 . An information handling system comprising:
 one or more processors; and   a non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
 receiving data traffic from a first information handling system which is configured to add an indicator to the data traffic if the data traffic comprises data or has associated metadata that matches a first set of one or more qualifiers; 
 determining whether that the data traffic from the first information handling system comprises data or has associated metadata that matches a second set of one or more qualifiers, in which the indicator is one of the qualifiers in the second set; and 
 responsive to the data traffic comprises data or has associated metadata that matches the second set of one or more qualifiers, performing an associated action for the data traffic at the information handling system, 
 wherein the first set of one or more qualifiers and the second set of one or more qualifiers excluding the indicator qualifier, if formed into a single rule would exceed a threshold amount of memory. 
   
     
     
         9 . The information handling system of  claim 8  wherein the data traffic is a packet. 
     
     
         10 . The information handling system of  claim 9  wherein the indicator represents a compression of the first set of one or more qualifiers. 
     
     
         11 . The information handling system of  claim 10 , wherein the indicator is a tag in a reserved field of the packet. 
     
     
         12 . The information handling system of  claim 9  wherein the indicator comprises a header that is added to the packet. 
     
     
         13 . The information handling system of  claim 8  wherein:
 performing the associated action to the data traffic if the data traffic comprises data or has associated metadata that matches the second set of one or more qualifiers represents a rule for the information handling system; and 
 the information handling system comprises a plurality of rules, in which each rule comprises its own set of one or more qualifiers and associated action or actions. 
 
     
     
         14 . A method comprising:
 receiving, at a second information handling system, data traffic from a first information handling system which is configured to add an indicator to the data traffic if the data traffic comprises data or has associated metadata that matches a first set of one or more qualifiers; and   responsive to determining that the data traffic received from the first information handling system comprises the indicator:
 determining whether the data traffic comprises data or has associated metadata that matches a second set of one or more qualifiers; and 
 responsive to the data traffic comprising data or has associated metadata that matches the second set of one or more qualifiers, performing an associated action for the data traffic at the second information handling system, 
   wherein the first set of one or more qualifiers and the second set of one or more qualifiers, if formed into a single rule would exceed a threshold amount of memory.   
     
     
         15 . The method of  claim 14  wherein the data traffic is a packet. 
     
     
         16 . The method of  claim 15  wherein the indicator comprises a value from plurality of possible values. 
     
     
         17 . The method of  claim 16 , wherein the indicator is a tag in a reserved field of the packet. 
     
     
         18 . The method of  claim 15  wherein the indicator comprises a header that is added to the packet. 
     
     
         19 . The method of  claim 14  wherein:
 performing the associated action to the data traffic if the data traffic comprises data or has associated metadata that matches the second set of one or more qualifiers represents a rule for the second information handling system; and 
 the second information handling system comprises a plurality of rules, in which each rule comprises its own set of one or more qualifiers and associated action or actions. 
 
     
     
         20 . The method of  claim 19  wherein at least the rule for the second information handling system is an Access Control List (ACL) rule.