A method for implementing an IPSec engine in IXDP2851 which is an IXP2850 network processor development platform having a computer-readable storage medium, the method, implemented using a computer that reads instructions stored on the storage medium, comprising:
- receiving by a classifier/forwarding microblock, a plurality of packets, and classifying at least one packet into an inbound packet in which a destination address of an IP header of the inbound packet indicates the packet classifier/forwarding microblock, and classifying at least one packet into an outbound packet in which a destination address of an IP header of the outbound packet does not indicate the packet classifier/forwarding microblock, using received packet information, determining whether IPSec processing should be performed on the inbound packet and the outbound packet, and performing packet forwarding on a packet not requiring the IPSec processing;
- if it is determined that the packet is the inbound packet, determining whether IPSec processing should be performed on the inbound packet, and transmitting information regarding the inbound packet to an inbound IPSec processing microblock if the IPSec processing should be performed on the inbound packet;
- if it is determined that the packet is the outbound packet, determining whether IPSec processing should be performed on the outbound packet, and transmitting information regarding the outbound packet to an outbound IPSec processing microblock if the IPSec processing should be performed on the outbound;
- and
- if IPSec processing for the outbound packet is not required, performing packet forwarding on the outbound packet and adding an Ethemet header to the packet subjected to the packet forwarding,
- wherein the received packet not requiring the IPSec processing is stored in a first Dram and transmitted from the first DRAM without influencing the packet's processing speed and without having to identify whether the packet requires IPSec processing for the performed forwarding on the corresponding packet,
- wherein if it is determined that the packet is the inbound packet the operation further comprises:
- determining whether an IP header protocol of the inbound packet is ESP or AH;
- if the IP header protocol of the inbound packet is ESP or AH, searching a Security Association (SA) table stored in SRAM of the IXDP2851;
- determining whether IPSec processing should be performed on the inbound packet, according to the search result of the SA table;
- if it is determined that the IPSec processing should be performed on the inbound packet, transmitting information regarding the inbound packet to the inbound IPSec processing microblock;
- and
- if it is determined that the IPSec processing for the inbound packet is not required, discarding the inbound packet;
- wherein if it is determined that the IP header protocol of the inbound packet corresponds to neither ESP nor AH, the packet classifier/forwarding microblock performs packet forwarding on the inbound packet and adds an Ethemet header to the inbound packet subjected to the packet forwarding;
- wherein if it is determined that the packet is the outbound packet the operation further comprises;
- searching a policy table stored in the SRAM of the IXDP2851 through an IP header of the outbound packet;
- determining whether IPSec processing should be performed on the outbound packet, according to the search result of the policy table;
- and
- if it is determined that IPSec processing should be performed on the outbound packet, transmitting information regarding the outbound packet to the outbound IPSec processing microblock.