PROCESSING DATA PACKETS USING A POLICY BASED NETWORK PATH

• US 20140269728A1
• Filed: 03/14/2014
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Jalan, Rajkumar, Kamat, Gurudeep
• Granted Patent: US 9,992,107 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 45/306 Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/66 Layer 2 routing, e.g. in Ethernet based MAN's
• CPC Class Codes: H04L 45/72 Routing based on the source address

Abstract

Methods and systems are provided for processing data packets in a data network using a policy based network path. A policy enforcing point receives a data packet associated with a service session and routes it toward its destination along a network path which is determined according to data packet information and one or more packet processing criteria. The data packet information may include one or more of information associated with the packet, information associated with prior packets, and information obtained from a network computer. The network path may be selected from a database of network paths. The network path may include an order list of further policy enforcing points and corresponding network application appliances. The policy enforcing point may generate a new data packet based on the data packet and the policy based network path and send the new data packet to a next policy enforcing point.

Claims

1. A computer-implemented method for processing a data packet using a policy based network path, the method comprising:

receiving from a client, by a policy enforcing point, the data packet associated with a service session;

determining, by the policy enforcing point, data packet information associated with the data packet and the policy based network path based on the data packet information and one or more packet processing criteria; and

routing, based on the determination, by the policy enforcing point, the data packet along the policy based network path.

2. The computer-implemented method of claim 1, wherein the data packet information includes one or more of the following:

information associated with content of the data packet, information associated with one or more prior data packet of the session, and further information obtained from a network computer.

3. The computer-implemented method of claim 1, wherein the information associated with content of the data packet includes one or more of the following:

a Media Access Control (MAC) address, a network interface number, a source IP address, a destination IP address, a source TCP/UDP port, a destination TCP/UDP port, a TCP/UDP option, a Uniform Resource Locator (URL), cookie information, a transaction identity, a Domain Name System (DNS) identity, a session identity, a receiving time of the data packet, an error code, a document file name, and a command string.

4. The computer-implemented method of claim 1, wherein the policy based network path is selected from a database of policy based data network paths.

5. The computer-implemented method of claim 1, wherein the policy based network path includes an order list of further policy enforcing points and corresponding network application appliances, the data packet being routed by the policy enforcing point through the further policy enforcing points according to the order list.

6. The computer-implemented method of claim 1, wherein the policy enforcing point is operable to examine the policy based network path, select a next policy enforcing point, and forward the data packet to the next policy enforcing point.

7. The computer-implemented method of claim 1, further comprising generating a new data packet based on the data packet and the policy based network path and sending the new data packet to a next policy enforcing point, the new data packet including the data packet and the policy based network path.

8. The computer-implemented method of claim 1, wherein the policy enforcing point encapsulates the policy based network path into a protocol header of the new data packet.

9. The computer-implemented method of claim 1, further comprising establishing, by the policy enforcing point a tunneling communication session and generating a new data packet adapted for the tunneling communication session, the new data packet incorporating the data packet.

10. The computer-implemented method of claim 1, wherein the data packet is sent to a next policy enforcing point in a further communication session.

11. The computer-implemented method of claim 1, where the policy enforcing point is operable to send the policy based network path to a next policy enforcing point prior to sending the data packet to the next policy enforcing point.

12. A system for processing a data packet using a policy based network path, the system comprising:

a database operable to store one or more policy based network paths; and

a policy enforcing point operable to;

receive the data packet associated with a service session;

determine data packet information associated with the packet;

select the policy based network path from the one or more policy based network paths stored in the database based on the data packet information and one or more packet processing criteria; and

route, based on the determined data packet information, by the policy enforcing point, the data packet along the policy based network path.

13. The system of claim 12, wherein the data packet information includes one or more of the following:

information associated with content of the data packet, information associated with one or more prior data packets of the session, and further information obtained from a network computer.

14. The system of claim 12, wherein the information associated with content of the data packet includes one or more of the following:

a Media Access Control (MAC) address, a network interface number, a source IP address, a destination IP address, a source TCP/UDP port, a destination TCP/UDP port, a TCP/UDP option, a Uniform Resource Locator (URL), cookie information, a transaction identity, a Domain Name System (DNS) identity, a session identity, a receiving time of the data packet, an error code, a document file name, and a command string.

15. The system of claim 12, wherein the policy based network path includes an order list of further policy enforcing points and corresponding network application appliances, the data packet being routed by the policy enforcing point through the further policy enforcing points according to the order list.

16. The system of claim 12, wherein the policy enforcing point is operable to examine the policy based network path, select a next policy enforcing point, and forward the data packet to the next policy enforcing point.

17. The system of claim 12, wherein the policy enforcing point is further operable to generate a new data packet based on the data packet and the policy based network path and send the new data packet to a next policy enforcing point, the new data packet including the data packet and the policy based network path.

18. The system of claim 12, wherein the policy enforcing point encapsulates the policy based network path into a protocol header of the new data packet.

19. The system of claim 12, wherein the policy enforcing point is further operable to establish a tunneling communication session and generate a new data packet adopted for the tunneling communication session, the new data packet incorporating the data packet.

20. A non-transitory computer-readable medium comprising computer readable code, which when executed by one or more processors, implements a method for processing a data packet using a policy based network path, the method comprising:

receiving from a client, by a policy enforcing point, the data packet associated with a service session;

determining, by the policy enforcing point, data packet information associated with the packet and the policy based network path based on the data packet information and one or more packet processing criteria; and

routing, based on the determination, by the policy enforcing point, the data packet along the policy based network path.