Service processing switch

• US 7,720,053 B2
• Filed: 05/19/2008
• Issued: 05/18/2010
• Est. Priority Date: 06/04/2002
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Hussain, Zahid, Millet, Tim
• Primary Examiner(s): PHAN, MAN U
• Application Number:
  US12/123,443
• Publication Number:
  US 20080259936A1
• Time in Patent Office: 729 Days
• Field of Search: 370230-255, 370312-352, 370389-397, 709217-246, 714 4- 21
• US Class Current: 370/386
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2491 Mapping quality of service [QoS] requirements between different networks
• CPC Class Codes: H04L 47/326 with random discard, e.g. random early discard [RED]
• CPC Class Codes: H04L 47/50 Queue scheduling
• CPC Class Codes: H04L 47/6215 Individual queue per QOS, rate or priority
• CPC Class Codes: H04L 47/623 Weighted service order
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 : for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers
• CPC Class Codes: H04L 69/24 : Negotiation of communication capabilities

Abstract

A system and method for providing IP services. A packet is received at a line interface/network module and forwarded to a virtual routing engine The virtual routing engine determines if the packet requires processing by a virtual services engine. If the packet requires processing by the virtual services engine, the packet is routed to the virtual services engine for processing.

Claims

1. A system for providing Internet Protocol (IP) services, comprising:

a switch fabric;

a line interface/network module coupled to the switch fabric;

a plurality of virtual routing engines (VREs) coupled to the switch fabric; and

a virtual services engine (VSE) coupled to the switch fabric;

wherein the line interface/network module includes an ingress forwarding manager which maintains a steering table mapping virtual local area networks (VLANs) to one or more VREs of the plurality of VREs, receives packets and steers ingress packets across the switch fabric to a selected VRE of the plurality of VREs and transmits egress packets according to their relative priority;

wherein the selected VRE determines if a packet associated with a packet flow requires processing by the VSE by performing flow-based packet classification on the packet and evaluating forwarding state information associated with previously stored flow learning results based on a previously received packet of the packet flow; and

if the packet is determined to require processing by the VSE, then steering the packet across the switch fabric to the VSE for processing.

2. The system of claim 1, wherein the VSE comprises an advanced security engine (ASE).

3. The system of claim 2, wherein the ASE comprises a plurality of encryption accelerators, a key accelerator and a security manager configured to load balance and manage security sessions across the one or more encryption accelerators.

4. The system of claim 1, wherein the line interface/network module includes an egress forwarding manager which applies priority queuing to the egress packets based on DiffServ marking and transmits the egress packets out of the line interface/network module.

5. A system for providing Internet Protocol (IP) services, comprising:

a switch fabric;

a line interface/network module coupled to the switch fabric;

a plurality of virtual routing engines (VREs) coupled to the switch fabric; and

a virtual services engine (VSE) coupled to the switch fabric;

wherein the line interface/network module receives packets and steers ingress packets across the switch fabric to a selected VRE of the plurality of VREs and transmits egress packets according to their relative priority via an egress forwarding manager of the line interface/network module which applies priority queuing to the egress packets based on DiffServ marking and transmits the egress packets out of the line interface/network module;

wherein the selected VRE determines if a packet associated with a packet flow requires processing by the VSE by performing flow-based packet classification on the packet and evaluating forwarding state information associated with previously stored flow learning results based on a previously received packet of the packet flow; and

if the packet is determined to require processing by the VSE, then steering the packet across the switch fabric to the VSE for processing.

6. The system of claim 5, wherein the VSE comprises an advanced security engine (ASE).

7. The system of claim 6, wherein the ASE comprises a plurality of encryption accelerators, a key accelerator and a security manager configured to load balance and manage security sessions across the one or more encryption accelerators.

8. The system of claim 5, wherein the line interface/network module includes an ingress forwarding manager which maintains a steering table mapping virtual local area networks (VLANs) to one or more VREs of the plurality of VREs.

9. A method operable within an Internet Protocol (IP) Service Generator (IPSG) system including a switch fabric, a line interface/network module coupled to the switch fabric, a plurality of virtual routing engines (VREs) coupled to the switch fabric, and a virtual services engine (VSE) coupled to the switch fabric, the method comprising:

maintaining, by an ingress forwarding manager of the line interface/network module, a steering table mapping virtual local area networks (VLANs) to one or more VREs of the plurality of VREs;

steering received ingress packets, by the ingress forwarding manager, across the switch fabric to a selected VRE of the plurality of VREs;

determining, by the selected VRE, if a packet received from the ingress forwarding manager and associated with a packet flow requires processing by the VSE by performing flow-based packet classification on the packet and evaluating forwarding state information associated with previously stored flow learning results based on a previously received packet of the packet flow;

if the packet is determined to require processing by the VSE, then steering the packet, by the selected VRE, across the switch fabric to the VSE for processing; and

transmitting received egress packets, by the line interface/network module, according to their relative priority.

10. The method of claim 9, wherein the VSE comprises an advanced security engine (ASE).

11. The method of claim 10, wherein the ASE comprises a plurality of encryption accelerators, a key accelerator and a security manager, wherein the method further comprises load balancing and managing security sessions across the one or more encryption accelerators, by the security manager.

12. The method of claim 9, wherein the line interface/network module includes an egress forwarding manager and the method further comprises applying priority queuing, by the egress forwarding manager, to the egress packets based on DiffServ marking and transmitting, by the egress forwarding manager, the egress packets out of the line interface/network module.

13. A method operable within an Internet Protocol (IP) Service Generator (IPSG) system including a switch fabric, a line interface/network module coupled to the switch fabric, a plurality of virtual routing engines (VREs) coupled to the switch fabric, and a virtual services engine (VSE) coupled to the switch fabric, the method comprising:

steering received ingress packets, by the line interface/network module, across the switch fabric to a selected VRE of the plurality of VREs;

determining, by the selected VRE, if a packet received from the line interface/network module and associated with a packet flow requires processing by the VSE by performing flow-based packet classification on the packet and evaluating forwarding state information associated with previously stored flow learning results based on a previously received packet of the packet flow;

if the packet is determined to require processing by the VSE, then steering the packet, by the selected VRE, across the switch fabric to the VSE for processing; and

transmitting received egress packets, by an egress forwarding manager of the line interface/network module, out of the line interface/network module according to their relative priority by applying priority queuing to the received egress packets based on DiffServ marking.

14. The method of claim 13, wherein the VSE comprises an advanced security engine (ASE).

15. The method of claim 14, wherein the ASE comprises a plurality of encryption accelerators, a key accelerator and a security manager, wherein the method further comprises load balancing and managing security sessions across the one or more encryption accelerators, by the security manager.

16. The method of claim 13, wherein the line interface/network module includes an ingress forwarding manager and the method further comprises maintaining, by the ingress forwarding manager, a steering table mapping virtual local area networks (VLANs) to one or more VREs of the plurality of VREs.