Network processing unit (NPU) integrated layer 2 network device for layer 3 offloading

Patent metadata

Field	Value
Publication number	US-10148576-B2
Application number	US-201615221987-A
Country	US
Kind code	B2
Filing date	Jul 28, 2016
Priority date	Jul 28, 2016
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

Systems and methods for facilitating offloading of communication sessions from layer 3 network devices are provided. According to one embodiment, session information pertaining to a session capable of being offloaded is received from a layer 3 network device by a layer 2 network device that includes multiple network processing units (NPUs). The session is assigned to one of the NPUs. Subsequently, responsive to receiving, by the layer 2 network device, a packet associated with the session, the packet is processed by the assigned NPU and forwarded on behalf of the layer 3 network device to a destination specified by the processed packet.

First claim

What is claimed is:

1. A layer 2 network device comprising:
a plurality of network processing units (NPUs);
a non-transitory storage device having embodied therein one or more routines operable to facilitate forwarding of network traffic offloaded by a layer 3 network device coupled to the layer 2 network device; and
a central processing unit (CPU) coupled to the non-transitory storage device and operable to execute the one or more routines, wherein the one or more routines include:
a session information processing module, which when executed by the CPU, receives session information associated with a session offloaded by the layer 3 network device, assigns the session information to one of the plurality of NPUs and maintains information regarding sessions assigned to each of the plurality of NPUs;
a packet processing module, which when executed by the CPU, receives a packet, identifies the packet as being associated with the session, determines the associated NPU of the plurality of NPUs by which the packet should be processed based on the session and causes the associated NPU to process the packet, including one or more of header parsing, pattern matching, bit-field manipulation, table look-ups, packet modification and data movement; and
a packet forwarding module, which when executed by the CPU, forwards the processed packet to a destination specified by the processed packet on behalf of the layer 3 network device.

2. The layer 2 network device of claim 1 , wherein the layer 2 network device comprises a switch.

3. The layer 2 network device of claim 1 , wherein the layer 3 network device comprises any or a combination of a physical firewall, a virtual firewall, a physical router, a virtual router, a physical gateway device, a virtual gateway device, a physical network controller and a virtual network controller.

4. The layer 2 network device of claim 1 , wherein the session information processing module is configured to create, delete, update or maintain a session table.

5. A method comprising:
receiving, by a layer 2 network device including a plurality of network processing units (NPUs), from a layer 3 network device, session information pertaining to a session capable of being offloaded;
assigning, by the layer 2 network device, the session to a first NPU of the plurality of NPUs;
responsive to receiving, by the layer 2 network device, a packet associated with the session:
causing the packet to be processed by the first NPU; and
forwarding the processed packet on behalf of the layer 3 network device to a destination specified by the processed packet.

6. The method of claim 5 , wherein the layer 2 network device comprises a switch.

7. The method of claim 5 , wherein the layer 3 network device comprises any or a combination of a physical firewall, a virtual firewall, a physical router, a virtual router, a physical gateway device, a virtual gateway device, a physical network controller, and a virtual network controller.

8. A method comprising:
offloading, by a layer 2 network device including a plurality of network processing units (NPUs), a plurality of sessions from a layer 3 network device by:
receiving, by the layer 2 network device, session information pertaining to each of the plurality of sessions from the layer 3 network device;
assigning, by the layer 2 network device, each of the plurality of sessions to respective NPUs of the plurality of NPUs;
responsive to receiving, by the layer 2 network device, a packet:
determining whether the packet is associated with a session of the plurality of sessions by comparing the packet against the session information;
when said determining is negative, forwarding the packet to the layer 3 network device for processing; and
when said determining is affirmative:
processing the packet by an NPU of the plurality of NPUs to which the session has been assigned; and
forwarding the processed packet on behalf of the layer 3 network device to a destination specified by the processed packet.

9. The method of claim 8 , wherein said receiving, by the layer 2 network device, session information pertaining to each of the plurality of sessions from the layer 3 network device comprises receiving, by a session maintenance daemon running on the layer 2 network device, the session information.

10. The method of claim 8 , wherein said assigning, by the layer 2 network device, each of the plurality of sessions to respective NPUs of the plurality of NPUs includes maintaining a mapping between each of the plurality of sessions and the respective NPUs via a session table.

11. The method of claim 8 , wherein said assigning, by the layer 2 network device, each of the plurality of sessions to respective NPUs of the plurality of NPUs includes performing load balancing among the plurality of NPUs.

12. The method of claim 8 , wherein the session information comprises for each session of the plurality of sessions information regarding one or more of the protocol associated with the session, a source Internet Protocol (IP) address, a destination IP address, a source Media Access Control (MAC) address, a destination MAC address, a source port, a destination port, connection state information, a unique session identifier, an action to be taken on packets associated with the session and a session expiration time.

13. The method of claim 8 , wherein said processing the packet by an NPU of the plurality of NPUs to which the session has been assigned includes performing one or more of header parsing, pattern matching, bit-field manipulation, table look-ups, packet modification and data movement.

Assignees

• Fortinet Inc

Inventors

• Yin Jun

Classifications

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L47/2483

  involving identification of individual flows · CPC title

• H04L47/125 Primary

  by balancing the load, e.g. traffic engineering · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title