Service insertion forwarding

Patent metadata

Field	Value
Publication number	US-10469377-B2
Application number	US-201415532618-A
Country	US
Kind code	B2
Filing date	Dec 2, 2014
Priority date	Dec 2, 2014
Publication date	Nov 5, 2019
Grant date	Nov 5, 2019

Abstract

Systems and methods associated with service insertion forwarding are disclosed. One example method includes building a service insertion address table. The service insertion address table may associate service insertion tunnels with device addresses based on payload source addresses retrieved from packets received via the service insertion tunnels. The method also includes forwarding a packet received from a source device to a destination device. The packet may be received from the source device via a source service insertion tunnel. The packet may be forwarded to the destination device via a destination service insertion tunnel. The destination service insertion tunnel may be associated with the destination device in the service insertion address table.

First claim

What is claimed is:

1. A non-transitory computer-readable medium storing computer executable instructions that when executed by a computer system causes the computer system to:
determine a device address, which is a source address in a payload of a first packet received via a tunnel, wherein the payload is encapsulated with an encapsulation header of the first packet;
generate an entry in a table that maps an identifier of the tunnel to the device address;
perform a service insertion function on a second packet received by the computer system;
determine that a destination address of a payload of the second packet matches the device address by looking up the table;
select, for the second packet, the tunnel as a forwarding tunnel based on the match; and
select a second tunnel as a forwarding tunnel for a third packet received via the second tunnel in response to a destination address of a payload of the third packet not matching an address in the table and forward the third packet via the second tunnel.

2. The non-transitory computer-readable medium of claim 1 , where the service insertion function is one or more of: a security function, an encryption function, a software defined network control function, a proxy operation, a quality of service computation, a law enforcement function, and a logging function.

3. The non-transitory computer-readable medium of claim 1 , where the device address is one or more of: a media access control (MAC) address, and an Internet Protocol (IP) address.

4. The non-transitory computer-readable medium of claim 1 , wherein the entry in the table further indicates one or more of: an uplink device and a downlink device.

5. A computer system, comprising:
a set of processors; and
a storage device configured to store a table;
a non-transitory computer-readable medium coupled to the set of processors storing instructions thereon that, when executed by the processors, cause the processors to perform a method, the method comprising:
determining device address, which is a source address in a payload of a first packet received via a tunnel, wherein the payload is encapsulated with an encapsulation header of the first packet;
generating an entry in the table that maps an identifier of the tunnel to the device address;
performing a service insertion function on a second packet received by the computer system;
determining that a destination address of a payload of the second packet matches the device address by looking up the table;
selecting, for the second packet, the tunnel as a forwarding tunnel based on the match; and
selecting a second tunnel as a forwarding tunnel for a third packet received via the second tunnel in response to a destination address of a payload of the third packet not matching an address in the table and forward the third packet via the second tunnel.

6. The computer system of claim 5 , where the service insertion function is one or more of: a security function, an encryption function, a software defined network control function, a proxy operation, a quality of service computation, a law enforcement function, and a logging function.

7. The computer system of claim 5 , where the device address is one or more of: a media access control (MAC) address, and an Internet Protocol (IP) address.

8. The computer system of claim 5 , wherein the entry in the table further indicates one or more of: an uplink device and a downlink device.

9. A method, comprising:
determining a device address, which is a source address in a payload of a first packet received via a tunnel, wherein the payload is encapsulated with an encapsulation header of the first packet;
generating an entry in a table that maps an identifier of the tunnel to the device address;
performing a service insertion function on a second packet;
determining that a destination address of a payload of the second packet matches the device address by looking up the table;
selecting, for the second packet, the tunnel as a forwarding tunnel based on the match; and
selecting a second tunnel as a forwarding tunnel for a third packet received via the second tunnel in response to a destination address of a payload of the third packet not matching an address in the table and forward the third packet via the second tunnel.

10. The method of claim 9 , where the service insertion function is one or more of: a security function, an encryption function, a software defined network control function, a proxy operation, a quality of service computation, a law enforcement function, and a logging function.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Lavigne Bruce E
• Wakumoto Shaun

Classifications

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L45/74 Primary

  Address processing for routing · CPC title

• H04L61/2007

  Electricity · mapped topic

• H04L12/6418 Primary

  Hybrid transport · CPC title

• H04L61/6022

  Electricity · mapped topic