Method of implementing L3 switching, network address port translation, and ALG support using a combination of hardware and firmware

• US 20050063398A1
• Filed: 07/02/2004
• Published: 03/24/2005
• Est. Priority Date: 07/03/2003
• Status: Abandoned Application

• Current Assignee: SiNett Corp.
• Original Assignee: SiNett Corp.
• Inventors: Ambe, Shekhar, Kayalackakom, Mathew, Choudhury, Abhijit K., Chin, Ken C.K.
• Application Number:
  US10/883,978
• Publication Number:
  US 20050063398A1
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 49/602 Multilayer or multiprotocol switching, e.g. IP switching
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/12 Access point controller devices

Abstract

An apparatus provides a hardware-based solution to enable support for L3 switching, network address port translation and application level gateways. The architecture involved in this hardware approach is such that it is scalable for implementation in a variety networking products that fulfill enterprise security and all possible combinations of wired and wireless networking needs, such as access points, access point concentrators, wireless-ready wiring closet or edge switches, and wireless co-processors.

Claims

1. An apparatus for application in a wired and/or wireless network comprising:

a scalable ingress path;

a scalable egress path;

an aggregator configured to receive packets from ports, configured to provide a stream for the ingress path, configured to receive a stream from the egress path, and configured to output packet data to the ports;

a switching table configured to support network address translation.

2. The apparatus of claim 1, the switching table is further configured to support packet encapsulation.

3. The apparatus of claim 2 the switching table further configured to support one entry per packet direction.

4. The apparatus of claim 3, wherein the switching table is indexed corresponding to locations of a source address and a destination address.

5. The apparatus of claim 4, wherein the scalable ingress path is further configured to determine whether the stream for the ingress path has to undergo authentication.

6. The apparatus of claim 4, further comprises:

a packet memory configured to store data from the stream for the ingress path and to the data stream for the egress path.

7. The apparatus of claim 6, further comprises:

a packet memory scheduler configured to schedule the data from the packet memory to the data stream for the egress path.

8. The apparatus of claim 7, wherein the scalable egress path is further configured to determine whether the stream for the egress path has to undergo encryption.

9. The apparatus of claim 8, wherein the scalable egress path is further configured to request that the encryptor block encrypt the stream for the egress path.

10. The apparatus of claim 9, wherein the decryptor block or the encryptor block supports IPSec, L2TP with IPSec, PPTP, or SSL Encryption algorithms.

11. The apparatus of claim 10, wherein the decryptor block or the encryptor block supports IPSec, L2TP with IPSec, PPTP, or SSL authentication algorithms.

12. The apparatus of claim 9, wherein the egress path or the ingress path further comprises:

access control logic configured to forward packets based an entry in an access control list.

13. The apparatus of claim 12, wherein the access control logic is further configured to:

drop packets based the entry on the access control list.

14. The apparatus of claim 13, wherein the access control logic is further configured to:

redirect packets based the entry on the access control list.

15. The apparatus of claim 14, wherein the packet is redirected to a port.

16. The apparatus of claim 13, wherein the access control logic is further configured to:

modify packets based the entry on the access control list.

17. The apparatus of claim 16, wherein the access control logic modifies 802.11 p or DiffServ Code Point (DSCP) fields of the packet.

18. The apparatus of claim 13, wherein the access control logic is further configured to:

send the packet to a central processing unit (CPU) or Embedded Processing Engine (EPE) based the entry on the access control list.

19. The apparatus of claim 13, wherein the access control logic is further configured to:

update a counter based the entry on the access control list.

20. The apparatus of claim 13, wherein the access control logic is further configured to:

assign a queue identifier to the packet based the entry on the access control list.

21. An method of processing data packets in a wired and/or wireless network comprising:

receiving a packet stream from one or more ports;

providing the packet stream to a scalable ingress path;

storing the packet stream;

outputting the packet stream to the one or more ports via a scalable egress path;

supporting network address translation using a switching table.

22. The method of claim 21, the switching table is further configured to support packet encapsulation.

23. The method of claim 22 the switching table further configured to support one entry per packet direction.

24. The method of claim 23, wherein the switching table is indexed corresponding to locations of a source address and a destination address.

25. The method of claim 24 further comprising:

authenticating the packet stream received from one or more ports when the packet stream requires authentication.

26. The method of claim 25, further comprises:

scheduling the output of the packet stream to the one or more ports via a scalable egress path.

27. The method of claim 26, further comprises:

determining whether the packet stream in the scalable egress path has to undergo encryption.

28. The method of claim 27 further comprising:

encrypting the packet stream when the packet stream in the scalable egress path has to undergo encryption.

29. The method of claim 28, wherein the encryption encryption is as per 802.11i, IPSec, L2TP with IPSec, PPTP, or SSL algorithms.

30. The method of claim 29, wherein the authentication encryption is as per 802.11i, IPSec, L2TP with IPSec, PPTP, or SSL Authentication algorithm.

31. The method of claim 28, further comprising:

forwarding packets based an entry in an access control list.

32. The method of claim 31, further comprising:

dropping packets based the entry on the access control list.

33. The method of claim 32, further comprising:

redirecting packets based the entry on the access control list.

34. The method of claim 33, wherein the packet is redirected to a port.

35. The method of claim 32, further comprising:

modifying packets based the entry on the access control list.

36. The method of claim 35, wherein 802.11p or DiffServ Code Point (DSCP) fields of the packet are modified.

37. The method of claim 32, further comprising:

sending the packet to a central processing unit (CPU) or Embedded Processing Engine (EPE) based the entry on the access control list.

38. The method of claim 32 further comprising:

updating a counter based the entry on the access control list.

39. The method of claim 32 further comprising:

assigning a queue identifer to the packet based the entry on the access control list.

40. A computer-readable medium, encoded with data and instructions, such that when executed by a computer, the instructions causes the computer to:

receive a packet stream from one or more ports;

provide the packet stream to a scalable ingress path;

store the packet stream;

output the packet stream to the one or more ports via a scalable egress path;

support network address translation using a switching table.

41. The computer-readable medium of claim 40, the switching table is further configured to support packet encapsulation.

42. The computer-readable medium of claim 41 the switching table further configured to support one entry per packet direction.

43. The computer-readable medium of claim 42, wherein the switching table is indexed corresponding to locations of a source address and a destination address.

44. The computer-readable medium of claim 43 further comprising instructions to:

authenticate the packet stream received from one or more ports when the packet stream requires authentication.

45. The computer-readable medium of claim 44, further comprises instructions to:

schedue the output of the packet stream to the one or more ports via a scalable egress path.

46. The computer-readable medium of claim 45, further comprise instructions to s:

determine whether the packet stream in the scalable egress path has to undergo encryption.

47. The computer-readable medium of claim 46 further comprising instructions to:

encrypt the packet stream when the packet stream in the scalable egress path has to undergo encryption.

48. The computer-readable medium of claim 47, wherein the encryption is encryption is as per 802.11i, IPSec, L2TP with IPSec, PPTP, or SSL Encryption algorithms Encryption algorithm.

49. The computer-readable medium of claim 48, wherein the authentication encryption is as per 802.11i, IPSec, L2TP with IPSec, PPTP, or SSL Authentication algorithms.

50. The computer-readable medium of claim 47, further comprises instructions to:

forward packets based an entry in an access control list.

51. The computer-readable medium of claim 50, further comprises instructions to:

drop packets based the entry on the access control list.

52. The computer-readable medium of claim 51, further comprises instructions to:

redirect packets based the entry on the access control list.

53. The computer-readable medium of claim 52, wherein the packet is redirected to a port.

54. The computer-readable medium of claim 51, further comprises instructions to:

modify packets based the entry on the access control list.

55. The computer-readable medium of claim 54, wherein the access control logic modifies 802.11p or DiffServ Code Point (DSCP) fields of the packet.

56. The computer-readable medium of claim 51, further comprises instructions to:

send the packet to a central processing unit (CPU) or Embedded Processing Engine (EPE) based the entry on the access control list.

57. The computer-readable medium of claim 51, further comprises instructions to:

update a counter based the entry on the access control list.

58. The computer-readable medium of claim 51, further comprises instructions to:

assign a queue identifer to the packet based the entry on the access control list.

59. An apparatus of processing data packets in a wired and/or wireless network comprising:

means for receiving a packet stream from one or more ports;

means for providing the packet stream to a scalable ingress path;

means for storing the packet stream;

means for outputting the packet stream to the one or more ports via a scalable egress path;

a switching table configured to support network address translation.

60. The apparatus of claim 59, the switching table is further configured to support packet encapsulation.

61. The apparatus of claim 60 the switching table further configured to support one entry per packet direction.

62. The apparatus of claim 61, wherein the switching table is indexed corresponding to locations of a source address and a destination address.

63. The apparatus of claim 62 further comprising:

means for authenticating the packet stream received from one or more ports when the packet stream requires authentication.

64. The apparatus of claim 63, further comprises:

means for scheduling the output of the packet stream to the one or more ports via a scalable egress path.

65. The apparatus of claim 64, further comprises:

means for determining whether the packet stream in the scalable egress path has to undergo encryption.

66. The apparatus of claim 65 further comprising:

means for encrypting the packet stream when the packet stream in the scalable egress path has to undergo encryption.

67. The apparatus of claim 66, wherein the encryption encryption is as per 802.11i, IPSec, L2TP with IPSec, PPTP, or SSL Encryption algorithms Encryption algorithm.

68. The apparatus of claim 67, wherein the authentication encryption is as per 802.11i, IPSec, L2TP with IPSec, PPTP, or SSL Authentication algorithm.

69. The apparatus of claim 66, wherein the egress path further comprises:

means for forwarding packets based an entry in an access control list.

70. The apparatus of claim 69, further comprising:

means for dropping packets based the entry on the access control list.

71. The apparatus of claim 70, further comprising:

means for redirecting packets based the entry on the access control list.

72. The apparatus of claim 71, wherein the packet is redirected to a port.

73. The apparatus of claim 72, further comprising:

means for modifying packets based the entry on the access control list.

74. The apparatus of claim 73, wherein the access control logic modifies 802.11p or DiffServ Code Point (DSCP) fields of the packet.

75. The apparatus of claim 72, further comprising:

means for sending the packet to a central processing unit (CPU) or Embedded Processing Engine (EPE) based the entry on the access control list.

76. The apparatus of claim 72, further comprising:

means for updating a counter based the entry on the access control list.

77. The apparatus of claim 72, further comprising:

assign a queue identifer to the packet based the entry on the access control list.