Streamlined packet forwarding using dynamic filters for routing and security in a shared forwarding plane

A network router comprising:

• a plurality of interfaces configured to send and receive packets;
• a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network;
• a forwarding plane configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding plane comprising a switch fabric to forward the packets to the interfaces based on the selected next hops;
• and
• a security plane configured to apply security services to the packets,
• wherein the forwarding plane includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the security plane for application of the security services, and
• wherein the security plane processes the packets and outputs commands to the forwarding plane to dynamically configure the flow control module,
• wherein the forwarding plane stores and applies a common set of filters that are managed by the security plane and the routing plane, and
• wherein the common set of filters comprises:
• (i) filters that configure the forwarding plane to direct matching packets to the security plane for deep packet inspection,
• (ii) filters that configure the forwarding plane to bypass the security plane for matching received packets for immediate forwarding in accordance with the routing information,
• (iii) filters that configure the forwarding plane to apply routing policies to received packets in the forwarding plane, and
• (iv) filters that configure the forwarding plane to apply security policies to received packets in the forwarding plane.

A network router comprising:

• a plurality of interfaces configured to send and receive packets;
• a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network;
• a forwarding plane configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding plane comprising a switch fabric to forward the packets to the interfaces based on the selected next hops;
• and
• a security plane configured to apply security services to the packets,
• wherein the forwarding plane includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the security plane for application of the security services, and
• wherein the security plane processes the packets and outputs commands to the forwarding plane to dynamically configure the flow control module,
• wherein the forwarding plane comprises a flow filter table and a packet filter table to store the filters,
• wherein the flow table stores within the forwarding plane dynamic filters installed within the forwarding plane in response to commands from the security plane, and
• wherein the packet filter table stores static filters that include at least one of filters based on Internet Protocol (IP) subnets and virtual private network (VPN) configuration data.

A method comprising:

• receiving packets at a plurality of interfaces of a network router, wherein the plurality of interfaces are configured to send and receive packets;
• maintaining routing information specifying routes through a network by executing a routing protocol on a control unit of a routing engine of the router;
• selecting next hops for the packets within the network with a forwarding plane configured by the routing engine;
• forwarding the packets to the interfaces in accordance with the routing information;
• applying security services to the packets with a security plane of the network router;
• directing, by a flow control module of the forwarding plane, one or more of the received packets to the security plane for application of the security services;
• by the security plane, processing the packets received from the forwarding plane;
• and
• based on the processing of the packets received from the forwarding plane, outputting commands by the security plane to the forwarding plane directing the forwarding plane to dynamically install at least one filter within the forwarding plane to dynamically configure the flow control module for processing packets subsequently received from the network.

A method comprising:

• receiving packets at a plurality of interfaces of a network router, wherein the plurality of interfaces are configured to send and receive packets;
• maintaining routing information specifying routes through a network by executing a routing protocol on a control unit of a routing engine of the router;
• selecting next hops for the packets within the network with a forwarding plane configured by the routing engine;
• forwarding the packets to the interfaces in accordance with the routing information;
• applying security services to the packets with a security plane of the network router;
• directing, with a flow control module of the forwarding plane, one or more of the received packets to the security plane for application of the security services;
• processing the packets with the security plane;
• outputting commands with the security plane to the forwarding plane to dynamically configure the flow control module;
• processing a first set of the packets at the security plane;
• outputting commands by the security plane directing the forwarding plane to dynamically install a least one filter within the forwarding plane based on the processing;
• storing a common set of filters within the forwarding plane that are managed by the security plane and the routing plane, wherein the common set of filters specify routing policies specified by the routing engine and security policies specified by the security plane, and wherein the forwarding plane comprises a set of forwarding integrated circuits that applies actions to received packets in accordance with the routing policies and the security policies,
• wherein the common set of filters comprises:
• (i) filters that configure the forwarding plane to direct matching packets to the security plane for deep packet inspection,
• (ii) filters that configure the forwarding plane to bypass the security plane for matching received packets for immediate forwarding in accordance with the routing information,
• (iii) filters that configure the forwarding plane to apply routing policies to received packets in the forwarding plane, and
• (iv) filters that configure the forwarding plane to apply security policies to received packets in the forwarding plane.

A network router comprising:

• a plurality of interfaces configured to send and receive packets;
• a routing component comprising:
• (i) a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network, and
• (ii) a forwarding plane configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding plane comprising a switch fabric to forward the packets to the interfaces based on the selected next hops;
• and
• a security plane configured to apply security services to the packets, wherein the security plane is integrated within the network router to share the forwarding plane of the routing component, wherein the security plane outputs commands to dynamically configure the forwarding plane, and wherein the forwarding plane stores and applies a common set of filters that are managed by the security plane and the routing component.

A network router comprising:

• a plurality of interfaces configured to send and receive packets;
• a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network;
• a forwarding plane configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding plane comprising a switch fabric to forward the packets to the interfaces based on the selected next hops;
• and
• a security plane configured to apply security services to the packets,
• wherein the forwarding plane includes a flow control module that, upon receiving packets from the network, directs one or more of the packets to the security plane for application of the security services,
• wherein the security plane processes the packets received from the forwarding plane to generate one or more commands, and
• wherein the security plane outputs the one or more commands to the forwarding plane directing the forwarding plane to dynamically install at least one filter within the forwarding plane to dynamically configure the flow control module for processing packets subsequently received from the network.

A method comprising:

• receiving packets at a plurality of interfaces of a network router, wherein the plurality of interfaces are configured to send and receive packets;
• maintaining routing information specifying routes through a network by executing a routing protocol on a control unit of a routing engine of the router;
• selecting next hops for the packets within the network with a forwarding plane configured by the routing engine;
• forwarding the packets to the interfaces in accordance with the routing information;
• applying security services to the packets with a security plane of the network router;
• directing, by a flow control module of the forwarding plane, one or more of the received packets to the security plane for application of the security services;
• by the security plane, processing the packets received from the forwarding plane to generate one or more commands;
• and
• outputting the one or more commands by the security plane to the forwarding plane directing the forwarding plane to dynamically install at least one filter within the forwarding plane to dynamically configure the flow control module for processing packets subsequently received from the network.