Processing data packets using a policy based network path

• US 9,992,107 B2
• Filed: 03/14/2014
• Issued: 06/05/2018
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Jalan, Rajkumar, Kamat, Gurudeep
• Primary Examiner(s): Ly, Anh-Vu
• Assistant Examiner(s): Ortiz, Hector Reyes
• Application Number:
  US14/214,142
• Publication Number:
  US 20140269728A1
• Time in Patent Office: 1,544 Days
• Field of Search: None
• CPC Class Codes: H04L 45/306 Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/66 Layer 2 routing, e.g. in Ethernet based MAN's
• CPC Class Codes: H04L 45/72 Routing based on the source address

Abstract

Methods and systems are provided for processing data packets in a data network using a policy based network path. A policy enforcing point receives a data packet associated with a service session and routes it toward its destination along a network path which is determined according to data packet information and one or more packet processing criteria. The data packet information may include one or more of information associated with the packet, information associated with prior packets, and information obtained from a network computer. The network path may be selected from a database of network paths. The network path may include an order list of further policy enforcing points and corresponding network application appliances. The policy enforcing point may generate a new data packet based on the data packet and the policy based network path and send the new data packet to a next policy enforcing point.

Claims

1. A computer-implemented method for processing a data packet using a policy based network path, the method comprising:

receiving from a client, by a first policy enforcing point of a plurality of policy enforcing points, a data packet associated with a service session, each of the plurality of policy enforcing points being in communication with at least one network appliance of a plurality of network appliances, wherein each of the plurality of policy enforcing points is configured to send the data packet to the at least one network appliance of the plurality of network appliances, wherein each of the plurality of network appliances receives, from one of the plurality of policy enforcing points, the data packet processed by the one of the plurality of policy enforcing points, performs one or more operations on the data packet, and sends, upon the performing of the one or more operations, the data packet to the one of the plurality of policy enforcing points, the one or more operations including at least a network inspection, a load balancing, and a network control operation;

determining, by the first policy enforcing point, data packet information associated with the data packet;

determining, by the first policy enforcing point, the policy based network path for the data packet based on the determined data packet information and one or more packet processing criteria;

applying, by the first policy enforcing point, the one or more packet processing criteria to the data packet information to determine one or more further segments of a remaining portion of the policy based network path, the one or more further segments comprising at least one further policy enforcing point of the plurality of policy enforcing points; and

routing, based on the determination of the remaining portion of the policy based network path, by the first policy enforcing point, the data packet along the policy based network path via the at least one further policy enforcing point, wherein each of the plurality of policy enforcing points is configured to determine at least one segment of the policy based network path by applying the one or more packet processing criteria to the data packet information associated with the packet.

2. The computer-implemented method of claim 1, wherein the data packet information includes one or more of the following:

information associated with content of the data packet, information associated with one or more prior data packet of the session, and further information obtained from a network computer.

3. The computer-implemented method of claim 1, wherein the information associated with the data packet includes one or more of the following:

a Media Access Control (MAC) address, a network interface number, a source IP address, a destination IP address, a source TCP/UDP port, a destination TCP/UDP port, a TCP/UDP option, a Uniform Resource Locator (URL), cookie information, a Domain Name System (DNS) identity, a service session identity, a receiving time of the data packet, an error code, a document file name, and a command string.

4. The computer-implemented method of claim 1, wherein the policy based network path is selected from a database of policy based data network paths.

5. The computer-implemented method of claim 1, wherein the policy based network path includes an order list of further policy enforcing points and corresponding network application appliances, the data packet being routed to a network application appliance associated with a next policy enforcing point in the order list.

6. The computer-implemented method of claim 1, wherein the first policy enforcing point is operable to examine the policy based network path, select a next policy enforcing point, and forward the data packet to at least one network application appliance associated with the next policy enforcing point.

7. The computer-implemented method of claim 1, further comprising generating a new data packet based on the data packet and the policy based network path and sending the new data packet to a next policy enforcing point, the new data packet including the data packet and the policy based network path.

8. The computer-implemented method of claim 1, wherein the first policy enforcing point encapsulates the policy based network path into a protocol header of the new data packet.

9. The computer-implemented method of claim 1, further comprising establishing, by the first policy enforcing point a tunneling communication session and generating a new data packet adapted for the tunneling communication session, the new data packet incorporating the data packet.

10. The computer-implemented method of claim 1, wherein the first policy enforcing point is a client side policy enforcing point or a server side policy enforcing point.

11. The computer-implemented method of claim 1, where the first policy enforcing point is operable to send the policy based network path to a next policy enforcing point prior to sending the data packet to the next policy enforcing point.

12. A system for processing a data packet using a policy based network path, the system comprising:

a database operable to store one or more policy based network paths, the one or more policy based network paths comprising one or more segments including a plurality of policy enforcing points, wherein each of the plurality of policy enforcing points is in communication with at least one network appliance of a plurality of network appliances, wherein each of the plurality of policy enforcing points is configured to send the data packet to the at least one network appliance of the plurality of network appliances, wherein each of the plurality of network appliances receives, from one of the plurality of policy enforcing points, the data packet processed by the one of the plurality of policy enforcing points, performs one or more operations on the data packet, and sends, upon the performing of the one or more operations, the data packet to the one of the plurality of policy enforcing points, the one or more operations including at least a network inspection, a load balancing, and a network control operation; and

a first policy enforcing point of the plurality of policy enforcing points operable to;

receive the data packet associated with a service session;

determine data packet information associated with the data packet;

determine the policy based network path from the one or more policy based network paths stored in the database for the data packet based on the data packet information and one or more packet processing criteria;

apply the one or more packet processing criteria to the data packet information to determine one or more further segments of a remaining portion of the policy based network path, the one or more further segments comprising at least one further policy enforcing point of the plurality of policy enforcing points; and

route, based on the determination of the remaining portion of the policy based network path, the data packet along the policy based network path via the at least one further policy enforcing point, wherein each of the plurality of policy enforcing points is configured to determine at least one segment of the policy based network path by applying the one or more packet processing criteria to the data packet information associated with the packet.

13. The system of claim 12, wherein the data packet information includes one or more of the following:

information associated with content of the data packet, information associated with one or more prior data packets of the session, and further information obtained from a network computer.

14. The system of claim 12, wherein the information associated with content of the data packet includes one or more of the following:

a Media Access Control (MAC) address, a network interface number, a source IP address, a destination IP address, a source TCP/UDP port, a destination TCP/UDP port, a TCP/UDP option, a Uniform Resource Locator (URL), cookie information, a Domain Name System (DNS) identity, a service session identity, a receiving time of the data packet, an error code, a document file name, and a command string.

15. The system of claim 12, wherein the policy based network path includes an order list of further policy enforcing points and corresponding network application appliances, the data packet being routed to a network application appliance associated with a next policy enforcing point in order list.

16. The system of claim 12, wherein the first policy enforcing point is operable to examine the policy based network path, select a next policy enforcing point, and forward the data packet to the next policy enforcing point.

17. The system of claim 12, wherein the first policy enforcing point is further operable to generate a new data packet based on the data packet and the policy based network path and send the new data packet to a next policy enforcing point, the new data packet including the data packet and the policy based network path.

18. The system of claim 12, wherein the first policy enforcing point encapsulates the policy based network path into a protocol header of the new data packet.

19. The system of claim 12, wherein the first policy enforcing point is further operable to establish a tunneling communication session and generate a new data packet adopted for the tunneling communication session, the new data packet incorporating the data packet.

20. A non-transitory computer-readable medium comprising computer readable code, which when executed by one or more processors, implements a method for processing a data packet using a policy based network path, the method comprising:

receiving from a client, by a first policy enforcing point of a plurality of policy enforcing points, a data packet associated with a service session, each of the plurality of policy enforcing points being in communication with at least one network appliance of a plurality of network appliances, wherein each of the plurality of policy enforcing points is configured to send the data packet to the at least one network appliance of the plurality of network appliances, wherein each of the plurality of network appliances receives, from one of the plurality of policy enforcing points, the data packet processed by the one of the plurality of policy enforcing points, performs one or more operations on the data packet, and sends, upon the performing of the one or more operations, the data packet to the one of the plurality of policy enforcing points, the one or more operations including at least a network inspection, a load balancing, and a network control operation;

determining, by the first policy enforcing point, data packet information associated with the packet and the policy based network path based on the data packet information and one or more packet processing criteria;

applying, by the first policy enforcing point, the one or more packet processing criteria to the data packet information to determine one or more further segments of a remaining portion of the policy based network path, the one or more further segments comprising at least one further policy enforcing point of the plurality of policy enforcing points; and

routing, based on the determination of the remaining portion of the policy based network path, by the first policy enforcing point, the data packet along the policy based network path via the at least one further policy enforcing point, wherein each of the plurality of policy enforcing points is configured to determine at least one segment of the policy based network path by applying the one or more packet processing criteria to the data packet information associated with the packet.