Catalyst 6000 Family Accelerated Server Load Balancing

Transcription

1 WHITE PAPER Catalyst 6000 Family Accelerated Server Load Balancing The Catalyst 6000 family, which includes the Catalyst 6500 and the 6000 series, delivers high-performance, multilayer switching solutions for server aggregation, high-end wiring closet, and backbone networks. The Catalyst 6000 family was designed to address the increased requirements for gigabit density, scalability, high availability, and multilayer switching in backbone and server-aggregation environments. Together, the Catalyst family delivers a wide range of intelligent solutions, enabling network managers to build networks that scale for mission-critical applications. Among the numerous requirements that are inherent in the ability to building scalable networks is the need to support server load balancing (SLB). SLB is important not only for scaling of Web services, but also for servers providing traditional IP services such as Domain Naming System (DNS) resolution or File Transfer Protocol (FTP) services. This white paper concentrates on the particular aspect of scalable network design using SLB and illustrates how the Catalyst 6000, with its accelerated SLB capabilities utilizing server cache technology, provides network managers with the ability to balance services across numerous servers at speeds of millions of packets per second. To explain how accelerated SLB works in the Catalyst 6000 family, this paper provides an overview of the Catalyst 6000 family and its architecture, and then discusses traditional DNS methods of load-balancing and its shortcomings. It describes the Cisco approach to solving the load-balancing problem utilizing LocalDirector and how, when deployed with the Catalyst 6000, this solution allows Cisco to provide a solution of SLB scaling to millions of packets per second. Switch Overview The Catalyst 6000 family consists of the Catalyst 6000 and the 6500 series. Both series support six- and nine-slot versions, providing a wide range of configuration and price/performance options. Both Catalyst 6000 and 6500 series switches also support a wide range of interface types and densities to include support for up to /100 Ethernet, BaseFX Fast Ethernet, and up to 130 Gigabit Ethernet ports. Network managers can also aggregate up to eight physical Fast Ethernet or Gigabit Ethernet links using either Fast EtherChannel or Gigabit EtherChannel technology, respectively, for logical connections up to 16 Gbps. The Catalyst 6000 family delivers an industry-leading Gigabit Ethernet backbone solution to meet the requirements of today s fast-growing backbones. (See Figure 1 and Table 1.) The architecture of the Catalyst 6500 series supports scalable switching bandwidth up to 256 Gbps and scalable multilayer switching up to 150 Mpps. For network managers not requiring the performance of the Catalyst 6500 series, the Catalyst 6000 series provides a more cost-effective solution, with backplane bandwidth of 32 Gbps and multilayer switching scaling up to 15 Mpps. For investment protection, both switches support the same suite of Supervisor Engines, interface line cards, and power supplies, providing a wide range of price/performance options. Page 1 of 11

2 Figure 1 Catalyst 6000 Family Table 1: Catalyst 6000 Family Overview Catalyst Family Switches Catalyst 6000 Series Catalyst 6500 Series Slot Density Six or nine slots Six or nine slots Backplane Capacity 32 Gbps Scalable to 256 Gbps Multilayer Switching Scalable to 15 Mpps Scalable to 150 Mpps Redundant Supervisors Yes Yes Redundant Switch Fabrics No Yes Redundant Common Equipment Yes Yes Switch Architecture Both Catalyst 6000 and 6500 series switches employ a frame-based switching architecture using an input/output queuing model. Each slot is capable of supporting multiple transmit queues per port, all of which can support configurable thresholds and depths for maximum flexibility and support of mission-critical, unicast, and multicast/multimedia applications. Weighted Random Early Detection (WRED) and Weighted Round Robin (WRR) are also applied within each queuing complex to maximize utilization of available resources and minimize packet loss and delay, particularly for premium-class traffic for which users may be charged a premium. To ensure high system availability, the Catalyst 6000 family supports device-level fault tolerance, which includes redundant Supervisor Engines, power supplies, uplinks, and switch fabrics (Catalyst 6500 series only). All system elements including power supplies, fans, Supervisors, line-card modules, and switch fabrics (Catalyst 6500 series only) are also hot-swappable such that elements can be added, removed, or replaced without service interruption of unrelated traffic flows. In dual Supervisor configurations, Cisco Fast Switchover transfers switch control to the redundant Supervisor within seconds for mission-critical applications that require maximum network availability. All system elements are field-replaceable units, maximizing serviceability and minimizing network downtime. Load Balancing Load balancing has been traditionally assigned to a DNS server using a round robin algorithm to balance traffic. Without round robin, DNS maps host names to one IP address. With round robin, DNS randomly rotates through a list of several IP addresses, any one of which could be mapped to a DNS query for a Uniform Resource Locator (URL). As more server capacity is required, administrators can add IP addresses to the rotation while adding additional servers to the server farm. (See Figure 2.) The DNS round-robin method for load balancing has several limitations in a server-farm system made up of multiple servers: There is a level of system bias resulting from the rotation, which creates unequal and highly variable load distribution among individual servers. The result is that traffic is not being sent to the server that could most efficiently handle the load. The DNS round-robin method of scaling servers assumes mirrored data on each server. Page 2 of 11

3 DNS round robin also presents an availability problem because this method has no knowledge of the status of the Transmission Control Protocol (TCP) connection, server, or application. If a server crashes or is removed, DNS round robin continues to send client requests to that server and clients receive a server not available message. Cached information also presents a problem for DNS round-robin access to multiple servers. In an attempt to minimize redundancy and maximize efficiency, DNS uses a caching mechanism that allows it to remember data it has already retrieved. When a particular IP mapping has been removed from the rotation, several caches can continue to hold the information. Figure 2 Simple Load Balancing Using DNS DNS Server 1 Internet 2 Web Servers 3 Because of these basic limitations of DNS, newer techniques have been implemented to not only solve the load-balancing issues associated with round-robin DNS but also to provide more scalable and higher-availability solutions while providing mechanisms for server connection management and security. These solutions are commonly referred to as SLB products, and an example would be Cisco LocalDirector. Server Load Balancing with LocalDirector LocalDirector is an integrated solution that intelligently load balances TCP/IP traffic across multiple servers. (See Figure 3.) LocalDirector appears as one virtual server to the requesting clients. All traffic is directed toward a virtual IP address (virtual server) via DNS. Those requests are distributed over a series of real IP addresses on servers (real servers). The definition of a virtual IP address is an address that is in DNS and most likely has a domain name. A real IP address is physically located on a real server behind LocalDirector. LocalDirector provides the following benefits: High performance is achieved by distributing client requests across a cluster of servers. Administration of server applications is easier. Clients know only about virtual servers; no administration is required for real server changes. Security of the real server is provided because its address is never announced to the external network. Users are familiar only with the virtual IP address. Additionally, filtering of unwanted traffic can be based on both IP address and IP port numbers. Ease of maintenance with no downtime is achieved by allowing physical (real) servers to be transparently placed in or out of service. Page 3 of 11

4 Figure 3 LocalDirector Presents a Virtual Address and Load Balances the Traffic Across Multiple Servers Web Servers LocalDirector 1 Internet 2 3 Server Load Balancing The Details This section discusses how server load balancing works, with the following sections outlining how accelerated SLB works in conjunction with the Catalyst 6000 family of switches. SLB allows users to represent a group of network servers (a server farm) as a single server instance, balance the traffic to the servers, and limit traffic to individual servers. The single server instance that represents a server farm is referred to as a virtual server. The servers that comprise the server farm are referred to as real servers. (See Figure 4.) Figure 4 Mapping Virtual to Real Addresses Real Addresses Virtual Address In this environment, clients are configured to connect to the IP address of the virtual server. When a client initiates a connection to the virtual server, the SLB function chooses a real server for the connection based on a configured load-balancing algorithm. Representing server farms as virtual servers facilitates scalability and availability for the user. The addition of new servers and the removal/failure of existing servers can occur at any time without affecting the availability of the virtual server. LocalDirector can operate in one of two redirection modes: directed mode or dispatched mode. In directed mode, the virtual server can be assigned an IP address that is not known to any of the real servers. LocalDirector translates packets exchanged between a client and real server, translating the virtual server IP address to a real server address via Network Address Translation (NAT). In dispatched mode, the virtual server address is known to the real servers and LocalDirector just redirects packets to the real servers at the Media Access Control (MAC) layer. This is the mode that accelerated SLB is implementing for packet redirection. In this mode, the real servers must be Layer 2 adjacent to the device redirecting packets, or in other words, on the same subnet. Page 4 of 11

5 Advanced Server Algorithm Several algorithm choices may be used for load balancing or determining which server will receive a new connection request. The algorithm of choice is the least-connections algorithm (leastconns); however, advanced server load balancing allows any one of the following load-balancing algorithms to be specified. They are detailed here, as well as any design configurations that may be affected. Least connections The number of sessions is based on the number of current TCP connections. Network design impact With multiple servers implemented with equal hardware and software configurations, it is practical to load the servers as evenly as possible, all the time. The least-connections option is aware when sessions disconnect, and eliminates the round-robin problem when many users log off one server, regardless of the server connection count. Weighted percentage Based upon a weighting metric specified during configuration, the sessions are distributed accordingly. Network design impact Weighted percentage is used if server hardware varies from server to server, resulting in vast differences between CPU performance between the two. It should be noted that even if this situation occurs, the end user does not notice any difference in performance because of the weighting. Fastest The weighted-predictor option allows you to assign a performance weight to each server. Weighted load balancing is similar to least connections, but servers with a higher weight value receive a larger percentage of connections at any one time. Network design impact This algorithm is not used in many data centers because typically server configuration is standardized and the performance is equal among all servers. Round robin The round-robin predictor option directs the network connection to the next server and treats all servers as equals, regardless of the number of connections or the response time. Network design impact The basic problem with this option is that one server may, over time, have all active sessions while the others sit dormant because of long connections on one server and short sessions on the others. Connection Initiation and Decision Making It is important to understand how a Hypertext Transfer Protocol (HTTP) connection or, for that matter, any TCP connection is established to understand LocalDirector and how accelerated SLB works on the Catalyst 6000 family of switches. A short discussion follows. (See Figure 5.) Figure 5 TCP/IP Handshake SYN Client: This is my sequence number. SYN/ACK Server: I ack your sequence number and this is mine. ACK Client: I ack your sequence number. DATA Let's chat. ACK I ack your last message. RST RST Unexpected termination OR FIN/ACK Our conversation is over. Page 5 of 11

6 For a connection to be established or initialized, the two TCP hosts synchronize on each other's initial sequence numbers. This process is done in an exchange of connection-establishing frames carrying a control bit called SYN (for synchronize) and the initial sequence numbers. The synchronization requires each side to send its own initial sequence number and to receive a confirmation in acknowledgment from the other side. Each side must also receive the other side's initial sequence number and send a confirming acknowledgment. Because Step 2 can be combined in a single message, this scenario is referred to as a three-way (or three-message) handshake. Now the two hosts are ready to communicate and the World Wide Web (WWW) pages can be transferred. After the last ACK, the connection is terminated by either a reset (RST) or a finish flag (FIN/ACK) being sent. Figure 6 LocalDirector Balances Traffic between Servers Web Servers LocalDirector 1 Internet 2 3 LocalDirector Operation LocalDirector uses this handshake mechanism to identify the beginning and end of individual flows and, therefore, can make the appropriate decisions as the conversation progresses. The following discussion describes what happens in this sequence. The SYN is set in the first packet sent by the client to the IP address of the virtual server for which services are requested; in reality, this is the address of the LocalDirector in behalf of all the real servers, so the router sends the packet to LocalDirector. The LocalDirector maintains tables of all connections that are active and since this is a new connection (identified by source and destination IP address as well as port numbers), it creates a connection entry for this flow. The next step is to decide which real server will service this connection request, based on configuration of the particular load-balancing algorithm. After this decision has been made, LocalDirector then forwards the packet to the appropriate server by changing the destination MAC address to that of the real server and sending the packet out its second interface. The real server receives the packet, fetches the requested Web page, and sends the response back to LocalDirector, which then sends the packet out its first interface to the router. If multiple pages are requested by this user s session, then this process continues until the user asks for no more data and requests the TCP connection to be closed, as indicated by the RST/FIN flags being sent in the last packet. At this point, LocalDirector can flush its internal table of connection status for this particular session, and then calculate the server to receive the next new connection based on the deployed load-balancing algorithm. Accelerated SLB on the Catalyst 6000 family builds upon the basic scheme described above for generic LocalDirector deployment, but moves the data forwarding into wire-speed application-specific integrated circuits (ASICs). Perhaps a discussion of some terminology would be appropriate here, using the example of wire-speed Layer 3 switches. Two distinct requirements must be met for Layer 3 switching; first, is the forwarding of the packet, which requires a route lookup and then second, the actual routing or manipulation of the packet, which consists of the Time-to-Live (TTL) decrement, the MAC address rewrite, and the checksum calculation. Traditionally, both these functions have been Page 6 of 11

7 accomplished in software, but a new generation of switch routers has moved ahead and implemented the forwarding or packet manipulation in hardware ASICs while the routing protocols are achieved by software processes. By moving the packet manipulation into hardware, newer switches can now achieve Layer 3 routing at packet rates of millions of packets per second, as witnessed by the Catalyst 5000, 6000, and 8500 series of switches. If the same paradigm that has evolved with Layer 3 switches is applied to the Layer 4 services such as SLB, an equivalent analogy can be drawn. Much as software-based routing is in the control path of Layer 3 switches and is software based, the equivalent functionality can be thought of in the algorithm and decision process of server load balancing in LocalDirector. Once that intelligent decision has been made, why not let the advances in hardware accelerate the simple forwarding that takes place from that point on? Accelerated SLB on the Catalyst 6000 builds on this basis and uses the wire-speed capabilities of the Catalyst 6000 to achieve SLB forwarding rates at 15 Mpps. From a terminology point of view, consider the routing decision made by a Layer 3 switch or the SLB decision to map a real server from the address of the virtual server to be control-plane decisions. These decisions are more adaptable and flexible when implemented in software. Packet manipulation in routing or the switching of a TCP session to a particular real server is best served in hardware ASICs. This is the basis of accelerated SLB on the Catalyst 6000 platform. Accelerated SLB How does accelerated SLB work, both in the context of the LocalDirector as well as with the Catalyst 6000 family? As described earlier, the software component of making the decision of how to map a virtual server to a real server is still required, and to satisfy this requirement in Phase I, accelerated SLB utilizes an existing LocalDirector chassis in the network design. Figure 6 depicts a typical deployment of this equipment. Figure 7 Accelerated SLB with LocalDirector and the Catalyst 6000 LocalDirector 100/1000 Mbps GigE Uplinks to Access Network Catalyst /1000 Mbps Page 7 of 11

8 Accelerated SLB Operation Accelerated SLB takes advantage of both LocalDirector platform services and the wire-speed switching services of the Catalyst These platforms use the same handshake mechanism to identify the beginning and the end of individual flows (as did LocalDirector in standalone mode) and, therefore, can make the appropriate decisions as the conversation progresses. The following discussion describes the operation of LocalDirector and Catalyst 6000 accelerated SLB. The SYN is set in the first packet sent by the client to the IP address of the virtual server for which services are requested; in reality, this is the address of the LocalDirector, in behalf of all the real servers, so the router sends the packet to LocalDirector. The Catalyst 6000 hardware sees this packet as a potential session for acceleration and caches the flow information. LocalDirector continues to maintain tables of all connections that are active and, since this is a new connection (identified by source and destination IP address as well as Layer 4 port numbers), it creates a connection entry for this flow. The next step is to decide which real server will service this based on the configuration of the particular load-balancing algorithm. Once this decision has been made, LocalDirector then forwards the packet to the appropriate server by changing the destination MAC address to that of the real server and sending the packet out its second interface. At this point the Catalyst 6000 hardware sees this packet as a valid SLB flow because it has been received and transmitted by the LocalDirector, with a MAC address manipulation. All subsequent packets on the inbound direction will now be switched by the Catalyst 6000 without the intervention of the LocalDirector, with the exception of any packets that have either the RST or FIN bits set. The real server receives the packet, fetches the requested Web page, and sends the response back to LocalDirector, which then sends the packet out its first interface to the router. The Catalyst 6000 hardware sees this packet as a potential session in the reverse path for acceleration and caches the flow information. When LocalDirector sends the response packet on its first interface, this action triggers the Catalyst 6000 hardware to see this flow as valid for accelerated SLB, and all subsequent packets will be switched by the hardware without the intervention of the LocalDirector, with the exception of any packets that have the RST/FIN bits set. In summary, two flows are established for each connection, one inbound and one outbound. If multiple pages are requested by this user s session, then this process continues until the user requires no further data and requests the TCP connection be closed, as indicated by the RST/FIN flags being set in the last packet. As noted earlier, these bits indicate the end of a connection and these packets are sent to the LocalDirector directly. This scenario allows the LocalDirector to purge its connection cache for this particular flow and reevaluate its SLB algorithm for this particular server and subsequent flows. At this time the Catalyst 6000 also flushes its connection cache for both flows of this connection. Distributed Accelerated Server Load Balancing Cisco offers a complete solution to server load balancing by allowing DistributedDirector to work within the framework of accelerated SLB. DistributedDirector provides dynamic, transparent, and scalable Internet traffic load distribution between multiple geographically dispersed servers. Using routing table intelligence in the network infrastructure, DistributedDirector transparently redirects end-user service requests to the closest responsive server, as determined by client-to-server topological proximity or client-to-server link latencies. Once this intelligent decision has been made, and this high-priority traffic has been redirected, accelerated SLB guarantees high-performance delivery of content. Users need only a single subdomain name or URL-embedded hostname for accessing a distributed set of servers, thus providing the appearance of a single virtual server. Because DistributedDirector localizes traffic to Internet servers, end users benefit from improved access performance and reduced transmissions costs. Cache Capabilities and Aging The Catalyst 6000 hardware provides a cache table of 128,000 entries for flow identification; the entries are implemented as 16,000 hashed buckets with 8,000 pages per bucket. A flow is defined as a one-way conversation defined by the source and destination IP addresses, the protocol type (TCP/UDP), and the actual Layer 4 port number. Since a connection is a two-way conversation requiring two flows, this equates to a 64,000 session that can be accommodated by the switch if it is 100 percent efficient. From extensive simulations, Cisco expects the number of connections that can be serviced in hardware to be from 32,000 to 64,000 concurrent TCP/UDP connections. Please note that if the flow cannot be cached in hardware, the LocalDirector services the flow as it normally would in software. As described earlier, the presence of a packet with either the RST or FIN bits set forces the hardware to send the packet to the LocalDirector for software cache purging. The Catalyst 6000 hardware itself has three mechanisms for cache aging: Based on short-flow information DNS requests can be identified and purged very quickly. Page 8 of 11

9 Hardware-based FIN/RST recognition The hardware identifies which contain these fields and they are purged within seconds. Age on last-seen timestamp Old entries that did not terminate properly or have possibly timed out are removed. These algorithms provide aggressive cache purging, and they ensure that accelerated SLB will scale in terms of the number of flows that can be serviced by Catalyst 6000 hardware. Redundancy Ensures Uptime An important aspect of any network is that the design provides the redundancy that is required to ensure the uptime required by data centers. Accelerated SLB provides numerous features that will help ensure predictable uptime: Element Redundancy Router redundancy through Hot Standby Router Protocol (HSRP) Accelerated SLB benefits from HSRP by allowing redundant routers to source and sink packets to and from the LocalDirector. In the unlikely event that a router fails, a standby router takes over the tasks of the failed router, with no effect on users session traffic. Routers communicate via hello packets to indicate their health and in the absence of three hellos from the primary router, the secondary router takes over communications of all sessions. Recent improvements in HSRP have now provided switchovers in the subsecond range. Redundant LocalDirector The two LocalDirectors are configured identically, and are designated the primary and secondary units by an asymmetrical fail-over cable that connects them. This cable provides a communication path during normal operation over which the configuration information modified on the primary is echoed to the secondary. When a failure occurs, the secondary unit takes on the primary unit s MAC address, providing seamless fail-over. Fail-over between LocalDirectors is determined by: The power and operational status of the other unit communicated through the fail-over cable The secondary LocalDirector hardware checks for the presence and remote voltage of the primary via a cable between the two LocalDirectors. Fail-over communications This scheme is similar to HSRP in that it uses hello messages between LocalDirectors and if a secondary does not receive a specific number of hellos in a specific timeframe, it declares the primary as down and initiates service. Network activity Both LocalDirectors monitor hello packets as well as the link state of their own interfaces. The primary active monitors its link state and if either interface goes down, it communicates this event to the secondary, transferring control to it while becoming dormant. Switch and link redundancy As shown in Figure 7, redundancy can also be accomplished via dual homing the servers to redundant switches. This setup can be accomplished via either dual network interface cards in the servers or a dual physical interface on the network interface card transceiver. Dual Supervisor Engines in the Catalyst 6000 family The Catalyst 6000 family can be configured with dual Supervisor Engines, and in the unlikely event of a Supervisor failure, the backup Supervisor becomes primary and creates the cache entries that were previously cached on the primary. This fail-over mechanism ensures that any established sessions will not be lost, and this fail-over is transparent to the end user. Figure 8 Data-Center Redundancy Software Redundancy Routing protocols also provide redundant paths for traffic flows The Cisco router shown in Figure 7 can provide equal-path load sharing across six Layer 3 interfaces, and in the event of a failure can route around these failures in seconds. Page 9 of 11

10 Spanning tree In the event of a Layer 2 failure, the Spanning Tree Protocol can be used to reroute the traffic around failed links within seconds. Service Utilities Roadmap Data-center scaling can and must be accomplished via deployment of various technologies, platforms, and switch architectures. To date, network managers have successfully fulfilled their Layer 3 performance requirements with multilayer switches such as the Catalyst 5000 and 6000 families and in multiservice environments, platforms such the Catalyst 8500 have been deployed. As the Web becomes the primary tool for companies to communicate their products, plans, and vision both internally and externally, services associated with these Web-based servers must also scale. Accelerated SLB is the first of many enhancements to the existing Layer 3 scaling solutions that Cisco will deliver to provide accelerated services. Phase I provides the scaling of SLB on the Catalyst 6000 for packet load balancing at a rate of 15 Mpps. This is being delivered with the introduction of the Catalyst 6000 policy feature card (PFC) to be used with an existing Cisco LocalDirector. Phase II of the services roadmap incorporates the integration of the control plane functionality provided by the external LocalDirector as a software enhancement to the Catalyst 6000 multilayer switch feature card (MSFC). Phase II also introduces fixed-configuration platforms that provide Layer 3 switching as well as wire-speed SLB suitable for smaller installations. Finally, Phase III of the service utilities roadmap will enhance these platforms with content-aware switching, providing a switching mechanism from Layer 2 to Layer 5 (URL/cookie) as well as advanced features such as Web caching, firewalls, and quality of service (QoS), all at wire speed. Conclusion The Catalyst 6000 with its accelerated SLB capabilities utilizing server cache technology provides network managers with the ability to balance services across multiple servers at speeds of millions of packets per second. These capabilities, in addition to its high availability redundancy features, provide carrier-class design capabilities for network managers building the server farms of today as well as tomorrow. As articulated in the service utilities roadmap, Cisco will continue to provide enhanced services at wire speed on the Catalyst platforms. In conclusion, accelerated SLB provides the following key benefits and features: High performance The Catalyst 6000 provides server load balancing at rates of 15 Mpps. Intelligent software in LocalDirector coupled with ASIC switching provides wire-speed accelerated SLB while providing intelligent flexibility via software algorithms when making the SLB decision. High availability Cisco provides a complete solution for SLB by leveraging the redundancy features of Cisco IOS software as well as the hardware redundancy of the switches and LocalDirector. This redundancy, when used in conjunction with the stateful fail-over mechanisms of LocalDirector, eliminates all points of failure and enables configuration of robust, high-availability server farms. The hot standby configuration replication feature reduces administrative costs by automatically transferring the primary LocalDirector configuration to the secondary. Automatic detection and removal of failed applications improves overall server farm management and reliability. Web-application probing technology monitors servers for application availability, application health, and database connectivity, effectively routing and directing traffic only to available applications. Scalability Accelerated SLB scales to 15 Mpps using advanced Catalyst 6000 ASICs. LocalDirector supports a capacity of over 20,000 connections per second. If requirements grow beyond this capacity, additional LocalDirectors and switches can be added. Support for up to 64,000 virtual or real servers offers flexibility in domain names and network configuration. Server management Support for all common TCP/IP Internet services Web, FTP, Telnet, DNS, and Simple Mail Transfer Protocol (SMTP) accommodates a wide range of applications and communications needs. Page 10 of 11

11 Simple addition and removal of servers allows easy upgrade of applications servers. The ability to scale a server farm and direct traffic based on application allows configuration flexibility. LocalDirector ensures that license counts or applications are not overwhelmed by setting a maximum connection limit for a server. Server security LocalDirector offers robust traffic filtering based on source IP address or Layer 4 service. This capability, coupled with Cisco IOS firewall services and extended access list support embedded in Cisco IOS routers, enables a complete security solution that can be deployed in an accelerated SLB environment. Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax: European Headquarters Cisco Systems Europe s.a.r.l. Parc Evolic, Batiment L1/L2 16 Avenue du Quebec Villebon, BP Courtaboeuf Cedex France Tel: Fax: Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: Fax: Asia Headquarters Nihon Cisco Systems K.K. Fuji Building, 9th Floor Marunouchi Chiyoda-ku, Tokyo 100 Japan Tel: Fax: Cisco Systems has more than 200 offices in the following countries. Addresses, phone numbers, and fax numbers are listed on the Cisco Connection Online Web site at Argentina Australia Austria Belgium Brazil Canada Chile China Colombia Costa Rica Croatia Czech Republic Denmark Dubai, UAE Finland France Germany Greece Hong Kong Hungary India Indonesia Ireland Israel Italy Japan Korea Luxembourg Malaysia Mexico The Netherlands New Zealand Norway Peru Philippines Poland Portugal Puerto Rico Romania Russia Saudi Arabia Singapore Slovakia Slovenia South Africa Spain Sweden Switzerland Taiwan Thailand Turkey Ukraine United Kingdom United States Venezuela Copyright 1999 Cisco Systems, Inc. All rights reserved. Printed in the USA. Catalyst, Cisco, Cisco IOS, Cisco Systems, the Cisco Systems logo, and EtherChannnel are registered trademarks of Cisco Systems, Inc. in the U.S. and certain other countries. All other trademarks mentioned in this document are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any of its resellers. (9907R) 9/99 BW5338