Network address translation within network device having multiple service units

Patent metadata

Field	Value
Publication number	US-10129207-B1
Application number	US-201514803328-A
Country	US
Kind code	B1
Filing date	Jul 20, 2015
Priority date	Jul 20, 2015
Publication date	Nov 13, 2018
Grant date	Nov 13, 2018

Abstract

A network device having multiple service units receives an outbound packet of a communication session, where the service units can perform network address translation (NAT) on the outbound packet. The outbound packet includes a private source network address and source port. The network device applies a service unit selection function to a header of the outbound packet to produce a first result, and selects, based on the first result, a service unit to perform NAT for packets of the communication session. The network device determines a port for network address translation that produces a second result equal to the first result when the service unit selection function is applied to the portion of the header when the portion includes a selected public network address and determined port. The service unit can thereby perform session-aware services on packets of the communication session without redirecting the packets between the service units.

First claim

The invention claimed is:

1. A method comprising:
receiving, with a network device having a plurality of service units, outbound packets of a communication session for a subscriber, wherein each outbound packet includes a private source network address and source port, and wherein each of the plurality of service units is configured to perform network address translation (NAT) in parallel on packets of different communication sessions;
applying a service unit selection function to at least a portion of a header of the outbound packet to produce a result;
selecting, from the plurality of service units performing NAT in parallel and based on the result, a first one of the service units to perform NAT for the packets of the communication session;
selecting, with the network device, a public network address for network address translation of the outbound packet for the communication session;
determining, with the network device, a port for network address translation that, when the service unit selection function is applied to the portion of the header after the private source network address and source port of the inbound packet are replaced with the selected public network address and the determined port, causes the network device to direct subsequently received inbound packets having the selected public network address and the determined port to the same first one of the service units;
generating a translated packet from the packet, wherein the translated packet includes the selected public network address and the determined port in place of the private source address and source port; and
forwarding the translated packet from the network device to a public network.

2. The method of claim 1 , wherein applying a service unit selection function to at least a portion of a header of the outbound packet to produce a first result comprises applying a hash function to the portion of the header of the inbound packet and computing the result as a remainder of the hash function modulo the number of the plurality of service units of the network device.

3. The method of claim 2 , wherein applying a hash function comprises applying a hash function to a 5-tuple of the header of the outbound packet, wherein the 5-tuple specifies a combination of the private source network address, source port, a public destination network address, destination port and protocol specified in the header of the outbound packet.

4. The method of claim 3 , wherein determining a port for network address translation comprises:
computing the modulo of the 5-tuple of the inbound packet and the number of service units to determine a first remainder;
computing the modulo of a 4-tuple of the translated packet with the number of service units to determine a second remainder, wherein the 4-tuple specifies a combination of the public source network address, public destination network address, destination port and protocol specified in the header of the translated packet;
computing a composite remainder by calculating the exclusive OR (XOR) of the first and second remainder; and
selecting the port for network address translation from a group of ports having port values that produce the composite remainder when applied with the modulo operation of the number of service units.

5. The method of claim 4 ,
wherein selecting the port comprises traversing a port look-up table based on the composite remainder to select the port for network address translation from the group of ports having port values that produce the composite remainder when applied with the modulo operation of the number of service units, and
wherein the port look-up table comprises a set of entries, each of the entries is associated with a respective one of a plurality of groups of ports.

6. The method of claim 5 , further comprising:
in response to determining the port, updating the port look-up table to mark the port as assigned; and
in response to determining that all the ports in the group of ports that produce the composite reminder are assigned, randomly allocating a port from the port lookup-table.

7. The method of claim 5 , wherein each entry of the set of entries comprises a bit vector having a plurality of bits, each of the bits corresponding to a different respective port in the respective one of the plurality of groups of ports and indicating whether the respective port is currently assigned to a subscriber session for network address translation.

8. The method of claim 1 , further comprising:
receiving, with the network device, an inbound packet for the communication session and destined for the subscriber, wherein the inbound packet includes the public source network address as a destination network address and includes a port as a destination port;
performing, with the first one of the service units, reverse network address translation on the inbound packet to replace the public source network address and port with a private network address and port associated with the subscriber; and
forwarding the inbound packet modified to have the private network address and port to the subscriber.

9. The method of claim 8 , further comprising performing, with the first one of the service units, one or more session-aware services on the communication session based on inbound packets and outbound packets associated with the communication session, wherein the session-aware services are performed by the first one of the service units without redirecting any of the inbound packets or the outbound packets between the service units for application of the session-aware services.

10. A network device comprising:
a network interface to receive an outbound packet of a communication session for a subscriber, wherein the outbound packet includes a private source network address and source port;
a plurality of service units configured to perform network address translation (NAT) in parallel on packets from different communication sessions;
a service unit selector configured to apply a service unit selection function to at least a portion of a header of the outbound packet to produce a result, and select, from the plurality of service units performing NAT in parallel and based on the result, a first one of the service units to perform NAT for the packets of the communication session; and
a NAT controller configured to select a public network address for network address translation of the outbound packet for the communication session, wherein the controller determines a port for network address translation that, when the service unit selection function is applied to the portion of the header after the private source network address and source port of the inbound packet are replaced with the selected public network address and the determined port, causes the network device to direct subsequently received inbound packets having the selected public network address and the determined port to the same first one of the service units.

11. The network device of claim 10 , further comprising a forwarding component to output a translated packet that includes the selected public network address and the determined port in place of the private source address and a source port of the outbound packet.

12. The network device of claim 10 , wherein the service unit selection function comprises a hash function that the service unit selector applies to the portion of the header of the inbound packet, and wherein the service unit selector computes the result as a remainder of a hash function modulo the number of the plurality of service units installed in the network device.

13. The network device of claim 12 , wherein the service selector unit applies the hash

Assignees

• Juniper Networks Inc

Inventors

• Wan Wei
• Yuan Zengqiang
• Wang Qiong

Classifications

• H04L69/22 Primary

  Parsing or analysis of headers · CPC title

• H04L61/256 Primary

  NAT traversal · CPC title

• H04L45/74

  Address processing for routing · CPC title

• H04L61/503

  using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter · CPC title

• H04L61/5014

  using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] · CPC title