Service processing switch
First Claim
1. A method for delivering network-based Internet Protocol (IP) services to a plurality of customers of a service provider, the method comprising:
- monitoring a load associated with a plurality of virtual routing processing resources of an IP service generator of a virtual router (VR) based switch, each of the plurality of virtual routing processing resources representing an application-tailored engine configured to perform packet classification and deep packet inspection;
load balancing received packets, by a flow manager of a line interface/network module of the IP service generator, among the plurality of virtual routing processing resources by directing received packets to a selected virtual routing processing resource of the plurality of virtual routing processing resources, the received packets representing service requests from the plurality of customers;
maintaining by the plurality of virtual routing processing resources a packet flow cache by setting up packet flow entries associated with each established packet flow, each packet flow entry of the packet flow cache containing information indicative of one or more packet processing actions or packet field manipulations to perform on packets associated with the established packet flow;
determining, by the selected virtual routing processing resource, whether a received packet is associated with an established packet flow within the packet flow cache by performing deep packet classification;
when an affirmative determination is made, directing, by the selected virtual routing processing resource, the received packet to a virtual services processing resource of a plurality of virtual services processing resources of the IP service generator, each of the plurality of virtual services processing resources representing an application-tailored engine configured to provide network-based IP services including one or more of virtual private network (VPN) processing, firewall processing, Uniform Resource Locator (URL) filtering and anti-virus processing; and
if the received packet is not dropped or otherwise blocked as a result of the network-based IP services performed by the virtual services processing resource, the virtual services processing resource returning the received packet to the selected virtual routing processing resource for forwarding.
0 Assignments
0 Petitions
Accused Products
Abstract
Methods and systems for providing IP services in an integrated fashion are provided. According to one embodiment, a load associated with multiple virtual routing processing resources of an IP service generator of a virtual router (VR) based switch is monitored. Packets are load balanced among the virtual routing processing resources. A packet flow cache is maintained with packet flow entries containing information indicative of packet processing actions for established packet flows. Deep packet classification is performed to determine whether a packet is associated with an established packet flow. If so, the packet is directed to one of multiple virtual services processing resources representing application-tailored engines configured to provide network-based IP services including one or more of virtual private network (VPN) processing, firewall processing, Uniform Resource Locator (URL) filtering and anti-virus processing. If the packet is allowed, it is returned to the source virtual routing processing resource for forwarding.
151 Citations
16 Claims
-
1. A method for delivering network-based Internet Protocol (IP) services to a plurality of customers of a service provider, the method comprising:
-
monitoring a load associated with a plurality of virtual routing processing resources of an IP service generator of a virtual router (VR) based switch, each of the plurality of virtual routing processing resources representing an application-tailored engine configured to perform packet classification and deep packet inspection; load balancing received packets, by a flow manager of a line interface/network module of the IP service generator, among the plurality of virtual routing processing resources by directing received packets to a selected virtual routing processing resource of the plurality of virtual routing processing resources, the received packets representing service requests from the plurality of customers; maintaining by the plurality of virtual routing processing resources a packet flow cache by setting up packet flow entries associated with each established packet flow, each packet flow entry of the packet flow cache containing information indicative of one or more packet processing actions or packet field manipulations to perform on packets associated with the established packet flow; determining, by the selected virtual routing processing resource, whether a received packet is associated with an established packet flow within the packet flow cache by performing deep packet classification; when an affirmative determination is made, directing, by the selected virtual routing processing resource, the received packet to a virtual services processing resource of a plurality of virtual services processing resources of the IP service generator, each of the plurality of virtual services processing resources representing an application-tailored engine configured to provide network-based IP services including one or more of virtual private network (VPN) processing, firewall processing, Uniform Resource Locator (URL) filtering and anti-virus processing; and if the received packet is not dropped or otherwise blocked as a result of the network-based IP services performed by the virtual services processing resource, the virtual services processing resource returning the received packet to the selected virtual routing processing resource for forwarding. - View Dependent Claims (2, 3, 4, 5, 16)
-
-
6. A system for providing network-based Internet Protocol (IP) services to a plurality of customers of a service provider, comprising:
-
a plurality of virtual routing processing resources configured to perform packet classification and deep packet inspection and further configured to maintain a packet flow cache by setting up packet flow entries associated with each established packet flow, each packet flow entry of the packet flow cache containing information indicative of one or more packet processing actions or packet field manipulations to perform on packets associated with the established packet flow; a plurality of virtual services processing resources configured to provide network-based IP services including one or more of virtual private network (VPN) processing, a line interface/network module coupled in communication with the plurality of virtual routing processing resources, the line interface/network module including a flow manager configured to load balance received packets among the plurality of virtual routing processing resources by directing received packets to a selected virtual routing processing resource of the plurality of virtual routing processing resources, the received packets representing service requests from the plurality of customers; wherein the selected virtual routing processing resource determines whether a received packet is associated with an established packet flow within the packet flow cache by performing deep packet classification; wherein responsive to an affirmative determination the selected virtual routing processing resource directs the received packet to a virtual services processing resource of the plurality of virtual services processing resources; and wherein if the received packet is not dropped or otherwise blocked as a result of the network-based IP services performed by the virtual services processing resource, the virtual services processing resource returns the received packet to the selected virtual routing processing resource for forwarding. - View Dependent Claims (7, 8, 9, 10, 11, 12, 13, 14, 15)
-
Specification