Service processing switch

• US 7,376,125 B1
• Filed: 06/04/2002
• Issued: 05/20/2008
• Est. Priority Date: 06/04/2002
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Hussain, Zahid, Millet, Tim
• Primary Examiner(s): Phan, Man U.
• Application Number:
  US10/163,260
• Time in Patent Office: 2,177 Days
• Field of Search: 370223-238, 370338-390, 370397-399, 370401-468, 709224-239, 709243-244
• US Class Current: 370/352
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2491 Mapping quality of service [QoS] requirements between different networks
• CPC Class Codes: H04L 47/326 with random discard, e.g. random early discard [RED]
• CPC Class Codes: H04L 47/50 Queue scheduling
• CPC Class Codes: H04L 47/6215 Individual queue per QOS, rate or priority
• CPC Class Codes: H04L 47/623 Weighted service order
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 : for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers
• CPC Class Codes: H04L 69/24 : Negotiation of communication capabilities

Abstract

A system and method for providing IP services. A packet is received at a line interface/network module and forwarded to a virtual routing engine The virtual routing engine determines if the packet requires processing by a virtual services engine. If the packet requires processing by the virtual services engine, the packet is routed to the virtual services engine for processing.

Claims

1. A method comprising:

establishing a flow cache having a plurality of entries each identifying one of a plurality of virtual router (VR) flows through a VR-based network device and corresponding forwarding state information;

receiving a packet at an input port of a line interface module of the VR-based network device;

the line interface module forwarding the packet to a virtual routing engine (VRE);

the VRE determining one or more appropriate packet transformations for application to the packet by performing flow-based packet classification on the packet;

using a result of the flow-based packet classification to retrieve an entry of a plurality of entries of the flow cache;

on a flow cache hit, determining, based on the corresponding forwarding state information of the retrieved flow cache entry, whether to process the packet with a virtual service engine (VSE) of the VR-based network device;

on a packet flow cache miss, identifying the existence of a new VR flow and upon successful allocation of a new entry of the packet flow cache for the new VR flow, forwarding the packet to software on the processor for flow learning.

2. The method of claim 1, wherein the VSE comprises an Advanced Security Engine (ASE).

3. An article of manufacture comprising a computer-readable medium encoded with one or more computer programs, which when executed by one or more processors of a virtual router (VR)-based network device cause the one or more processors to perform a method comprising:

establishing a flow cache having a plurality of entries each identifying one of a plurality of VR flows through the VR-based network device and corresponding forwarding state information;

receiving a packet at an input port of a line interface module of the VR-based network device;

the line interface module forwarding the packet to a virtual routing engine (VRE);

the VRE determining one or more appropriate packet transformations for application to the packet by performing flow-based packet classification on the packet;

using a result of the flow-based packet classification to retrieve an entry of a plurality of entries of the flow cache;

on a flow cache hit, determining, based on the corresponding forwarding state information of the retrieved flow cache entry, whether to process the packet with a virtual service engine (VSE) of the VR-based network device;

on a packet flow cache miss, identifying the existence of a new VR flow and upon successful allocation of a new entry of the packet flow cache for the new VR flow, forwarding the packet to software on the processor for flow learning.

4. The article of manufacture of claim 3, wherein the VSE comprises an Advanced Security Engine (ASE).

5. A virtual router (VR)-based network device comprising:

a means for establishing a flow cache having a plurality of entries each identifying one of a plurality of virtual router (VR) flows through a VR-based network device and corresponding forwarding state information;

a means for receiving a packet at an input port of a line interface module of the VR-based network device and for forwarding the packet to a virtual routing engine (VRE);

a means associated with the VRE for determining one or more appropriate packet transformations for application to the packet by performing flow-based packet classification on the packet;

a means for using a result of the flow-based packet classification to retrieve an entry of a plurality of entries of the flow cache;

a means for, on a flow cache hit, determining, based on the corresponding forwarding state information of the retrieved flow cache entry, whether to process the packet with a virtual service engine (VSE) of the VR-based network device;

a means for, on a packet flow cache miss, identifying the existence of a new VR flow and upon successful allocation of a new entry of the packet flow cache for the new VR flow, forwarding the packet to software on the processor for flow learning.

6. The VR-based network device of claim 5, wherein the VSE comprises an Advanced Security Engine (ASE).