Network processing unit (npu) integrated layer 2 network device for layer 3 offloading

Patent metadata

Field	Value
Publication number	US-2018034734-A1
Application number	US-201615221987-A
Country	US
Kind code	A1
Filing date	Jul 28, 2016
Priority date	Jul 28, 2016
Publication date	Feb 1, 2018
Grant date	—

Abstract

Systems and methods for facilitating offloading of communication sessions from layer 3 network devices are provided. According to one embodiment, session information pertaining to a session capable of being offloaded is received from a layer 3 network device by a layer 2 network device that includes multiple network processing units (NPUs). The session is assigned to one of the NPUs. Subsequently, responsive to receiving, by the layer 2 network device, a packet associated with the session, the packet is processed by the assigned NPU and forwarded on behalf of the layer 3 network device to a destination specified by the processed packet.

First claim

What is claimed is:

1 . A layer 2 network device comprising:
a plurality of network processing units (NPUs); a non-transitory storage device having embodied therein one or more routines operable to facilitate forwarding of network traffic offloaded by a layer 3 network device coupled to the layer 2 network device; and a central processing unit (CPU) coupled to the non-transitory storage device and operable to execute the one or more routines, wherein the one or more routines include:
a session information processing module, which when executed by the CPU, receives session information offloaded by the layer 3 network device, assigns the session information to one of the plurality of NPUs and maintains information regarding sessions assigned to each of the plurality of NPUs;
a packet processing module, which when executed by the CPU, receives a packet from the layer 3 network device, identifies a session with which the packet is associated, determines an NPU of the plurality of NPUs by which the packet should be processed based on the identified session and causes the identified NPU to process the packet, including one or more of header parsing, pattern matching, bit-field manipulation, table look-ups, packet modification and data movement; and
a packet forwarding module, which when executed by the CPU, forwards the processed packet to a destination specified by the processed packet on behalf of the layer 3 network device.

2 . The layer 2 network device of claim 1 , wherein the layer 2 network device comprises a switch.

3 . The layer 2 network device of claim 1 , wherein the layer 3 network device comprises any or a combination of a physical firewall, a virtual firewall, a physical router, a virtual router, a physical gateway device, a virtual gateway device, a physical network controller and a virtual network controller.

4 . The layer 2 network device of claim 1 , wherein the session information processing module is configured to create, delete, update or maintain a session table.

5 . A method comprising:
receiving, by a layer 2 network device including a plurality of network processing units (NPUs), from a layer 3 network device, session information pertaining to a session capable of being offloaded; assigning, by the layer 2 network device, the session to a first NPU of the plurality of NPUs; responsive to receiving, by the layer 2 network device, a packet associated with the session:
causing the packet to be processed by the first NPU; and
forwarding the processed packet on behalf of the layer 3 network device to a destination specified by the processed packet.

6 . The method of claim 5 , wherein the layer 2 network device comprises a switch.

7 . The method of claim 5 , wherein the layer 3 network device comprises any or a combination of a physical firewall, a virtual firewall, a physical router, a virtual router, a physical gateway device, a virtual gateway device, a physical network controller, and a virtual network controller.

Assignees

• Fortinet Inc

Inventors

• Yin Jun

Classifications

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L47/2483

  involving identification of individual flows · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L47/125 Primary

  by balancing the load, e.g. traffic engineering · CPC title