Systems and methods for externalizing network functions via packet trunking

A network switch comprising:

• a processor;
• non-transitory computer readable media storing computer executable instructions, which when executed by the processor cause the processor to:
• receive a packet via a first network interface, wherein the packet is directed to a destination node other than the network switch;
• modify a field within the header of the packet to include an identifier for a virtualized network function executing on the packet processor;
• forward the received packet with the modified header to a packet processor comprising a general purpose computer processor, via a second network interface, over a direct physical link between the network switch and the packet processor, wherein:
• the network switch forwards the packet with a destination MAC address that is different from a MAC address of the packet processor,
• the packet processor executes a plurality of different virtualized network function modules, including at least two of a network address translation module, a policy enforcement module, an encryption module, an access control list filtering module, a firewalling module, and an intrusion detection module,
• the identifier corresponds to one of the plurality of virtualized network function modules, and
• the packet processor uses the identifier to route the packet within the packet processor to the corresponding virtualized network function module;
• receive from the packet processor the packet after it has been processed by the identified virtualized network function;
• and
• forward the processed packet over a third network interface towards the destination node.

A packet processor, comprising:

• a general purpose computer processor;
• non-transitory computer readable media storing computer executable instructions, which when executed by the processor cause the processor to:
• execute a plurality of different virtualized network function modules, including at least two of a network address translation module, a policy enforcement module, an encryption module, an access control list filtering module, a firewalling module, and an intrusion detection module;
• receive a packet from a network switch, over a direct physical link between the network switch and the packet processor, wherein:
• the received packet includes an identifier corresponding to one of the virtualized network function modules executing on the packet processor to be carried out on the packet, and
• a destination MAC address of the received packet is different from a MAC address of the packet processor;
• route the received packet within the packet processor to the network function module corresponding to the identifier;
• process the packet using the corresponding network function module;
• and
• send the processed packet back to the network switch over the direct physical link.