Network address translation using a forwarding agent

• US 6,985,440 B1
• Filed: 09/29/2003
• Issued: 01/10/2006
• Est. Priority Date: 07/02/1999
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Albert, Mark, Tiwari, Pranav Kumar, O'Rourke, Chris, Menditto, Louis F., Howes, Richard A., Tsang, Tzu-Ming, LeBlanc, William M., Jordan, James A., Kersey, Edward A., McGuire, Jacob Mark
• Primary Examiner(s): Pham, Chi
• Assistant Examiner(s): ABELSON, RONALD B
• Application Number:
  US10/674,850
• Time in Patent Office: 834 Days
• Field of Search: 370466-467, 370/389, 370/392, 370/397, 370/401, 370/230, 370/235, 709/245
• US Class Current: 370/230
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers

Abstract

A system and method are disclosed for specifying network address translation for a set of packets. A first set of instructions is sent to a forwarding agent specifying criteria for designated packets that are designated to undergo network address translation. A matching packet is received from the forwarding agent that matches the specified criteria. A network address translation scheme is determined for the matching packet. A second set of instructions are sent specifying the network address translation scheme for packets associated with the matching packet.

Claims

1. An apparatus for specifying network address translations for a plurality of packets, comprising:

a forwarding agent operable to receive a first set of instructions from a service manager, the first set of instructions specifying criteria for selected packets that are designated to undergo a network address translation, wherein the first set of instructions also specifies that in order to accept the first set of instructions, the forwarding agent can support the network address translation, the forwarding agent being further operable to send a matching packet that matches the specified criteria, and wherein a network address translation scheme is determined for the matching packet, the forwarding agent receiving a second set of instructions specifying the network address translation scheme for one or more packets associated with the matching packet, the matching packet being an initial packet for a new flow and the one or more packets being associated with the new flow.

2. The apparatus of claim 1, wherein the forwarding agent is coupled to a fixed affinity database, the forwarding agent being operable to identify an affinity key in the fixed affinity database and to forward the one or more packets associated with the matching packet according to an action defined in the fixed affinity, and wherein the action defined is a translation operation.

3. The apparatus of claim 1, wherein determining the network address translation scheme for the matching packet includes load balancing connections among a set of hosts having individual Internet Protocol (IP) addresses and selecting one of the individual IP addresses as a destination IP address for the one or more packets associated with the matching packet.

4. The apparatus of claim 1, wherein the network address translation scheme includes translating a destination port number for the one or more packets associated with the matching packet.

5. The apparatus of claim 1, wherein the network address translation scheme includes translating a destination IP address for the one or more packets associated with the matching packet.

6. The apparatus of claim 1, wherein the network address translation scheme includes translating a source port number of the one or more packets associated with the matching packet.

7. The apparatus of claim 1, wherein the network address translation scheme includes translating a source IP address of the one or more packets associated with the matching packet.

8. The apparatus of claim 1, wherein the service manager is operable to receive selected packets related to a connection associated with the matching packet, and wherein the service manager is further operable to monitor the status of the connection.

9. The apparatus of claim 1, wherein the matching packet is a SYN packet for a new connection.

10. A system for specifying network address translations for a plurality of packets, comprising:

means for receiving a first set of instructions specifying criteria for selected packets that are designated to undergo a network address translation, the first set of instructions specifying that in order to accept the first set of instructions, the network address translation can be supported;

means for communicating a matching packet that matches the specified criteria, wherein a network address translation scheme is determined for the matching packet; and

means for receiving a second set of instructions specifying the network address translation scheme for one or more packets associated with the matching packet, wherein the matching packet is an initial packet for a new flow and the one or more packets are associated with the new flow.

11. The system of claim 10, further comprising:

means for receiving additional packets related to a connection associated with the matching packet; and

means for monitoring the status of the connection.

12. The system of claim 10, wherein the network address translation scheme includes translating a selected one of a source IP address of the one or more packets associated with the matching packet and a source port number of the one or more packets associated with the matching packet.

13. The system of claim 10, wherein the network address translation scheme includes translating a selected one of a destination IP address of the one or more packets associated with the matching packet and a destination port number of the one or more packets associated with the matching packet.

14. The system of claim 10, further comprising:

means for load balancing connections among a set of hosts having individual real IP addresses and selecting one of the individual real IP addresses as a destination IP address for the one or more packets associated with the matching packet.

15. An apparatus for specifying network address translations for a plurality of packets, comprising:

a service manager operable to communicate a first set of instructions to a forwarding agent, the first set of instructions specifying criteria for selected packets that are designated to undergo a network address translation, wherein the first set of instructions also specifies that in order to accept the first set of instructions, the forwarding agent can support the network address translation, the forwarding agent being further operable to send a matching packet that matches the specified criteria, and wherein a network address translation scheme is determined for the matching packet, the forwarding agent receiving a second set of instructions specifying the network address translation scheme for one or more packets associated with the matching packet, the matching packet being an initial packet for a new flow and the one or more packets being associated with the new flow.

16. The apparatus of claim 15, wherein the service manager includes:

a forwarding agent sending interface configured to communicate the first set of instructions to the forwarding agent, and wherein the service manager also includes a processor configured to determine the network address translation scheme for the matching packet.

17. The apparatus of claim 15, wherein determining the network address translation scheme for the matching packet includes load balancing connections among a set of hosts having individual Internet Protocol (IP) addresses and selecting one of the individual IP addresses as a destination IP address for the one or more packets associated with the matching packet.

18. The apparatus of claim 15, wherein the network address translation scheme includes translating a destination port number for the one or more packets associated with the matching packet.

19. The apparatus of claim 15, wherein the network address translation scheme includes translating a destination IP address for the one or more packets associated with the matching packet.

20. The apparatus of claim 15, wherein the network address translation scheme includes translating a source port number of the one or more packets associated with the matching packet.

21. The apparatus of claim 15, wherein the network address translation scheme includes translating a source IP address of the one or more packets associated with the matching packet.

22. The apparatus of claim 15, wherein the service manager is operable to receive selected packets related to a connection associated with the matching packet, and wherein the service manager is further operable to monitor the status of the connection.