# US 8,542,595 B2 · Service processing switch

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,542,595 B2
- Document ID: US8542595B2
- Status: Granted
- Kind: B2
- Application number: 13/295,077
- Filed: 2011-11-13
- Published: 2012-03-08
- Granted: 2013-09-24
- Earliest claimed: 2002-06-04
- Assignees: Fortinet, Inc.
- Applicants: Zahid Hussain; Tim Millet
- Inventors: Zahid Hussain; Tim Millet
- Web page: https://patentgrep.com/patent/US8542595B2

## CPC

- H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ]
- H04L 45/00: Routing or path finding of packets in data switching networks (routing or path finding in wireless networks H04W40/00)
- H04L 45/20: {Hop count for routing purposes, e.g. TTL}
- H04L 45/586: of virtual routers
- H04L 45/60: Router architectures
- H04L 47/125: by balancing the load, e.g. traffic engineering
- H04L 47/2408: for supporting different services, e.g. a differentiated services [DiffServ] type of service
- H04L 47/2491: Mapping quality of service [QoS] requirements between different networks
- H04L 47/326: {with random discard, e.g. random early discard [RED]}
- H04L 47/50: Queue scheduling
- H04L 47/6215: {Individual queue per QOS, rate or priority}
- H04L 47/623: {Weighted service order}
- H04L 49/70: {Virtual switches}
- H04L 61/2503: Translation of Internet protocol [IP] addresses
- H04L 63/02: {for separating internal from external traffic, e.g. firewalls}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0272: {Virtual private networks}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/164: {at the network layer}
- H04L 69/22: Parsing or analysis of headers
- H04L 69/24: Negotiation of communication capabilities
- H04L 2101/604: Address structures or formats
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods and systems for providing IP services in an integrated fashion are provided. According to one embodiment, a load associated with multiple virtual routing processing resources of an IP service generator of a virtual router (VR) based switch is monitored. Packets are load balanced among the virtual routing processing resources. A packet flow cache is maintained with packet flow entries containing information indicative of packet processing actions for established packet flows. Deep packet classification is performed to determine whether a packet is associated with an established packet flow. If so, the packet is directed to one of multiple virtual services processing resources representing application-tailored engines configured to provide network-based IP services including one or more of virtual private network (VPN) processing, firewall processing, Uniform Resource Locator (URL) filtering and anti-virus processing. If the packet is allowed, it is returned to the source virtual routing processing resource for forwarding.

## Claims

### Claim 1

A method for delivering network-based Internet Protocol (IP) services to a plurality of customers of a service provider, the method comprising:
monitoring a load associated with a plurality of virtual routing processing resources of an IP service generator of a virtual router (VR) based switch, each of the plurality of virtual routing processing resources representing an application-tailored engine configured to perform packet classification and deep packet inspection;
load balancing received packets, by a flow manager of a line interface/network module of the IP service generator, among the plurality of virtual routing processing resources by directing received packets to a selected virtual routing processing resource of the plurality of virtual routing processing resources, the received packets representing service requests from the plurality of customers;
maintaining by the plurality of virtual routing processing resources a packet flow cache by setting up packet flow entries associated with each established packet flow, each packet flow entry of the packet flow cache containing information indicative of one or more packet processing actions or packet field manipulations to perform on packets associated with the established packet flow;
determining, by the selected virtual routing processing resource, whether a received packet is associated with an established packet flow within the packet flow cache by performing deep packet classification;
when an affirmative determination is made, directing, by the selected virtual routing processing resource, the received packet to a virtual services processing resource of a plurality of virtual services processing resources of the IP service generator, each of the plurality of virtual services processing resources representing an application-tailored engine configured to provide network-based IP services including one or more of virtual private network (VPN) processing, firewall processing, Uniform Resource Locator (URL) filtering and anti-virus processing; and
if the received packet is not dropped or otherwise blocked as a result of the network-based IP services performed by the virtual services processing resource, the virtual services processing resource returning the received packet to the selected virtual routing processing resource for forwarding.

### Claim 2 (depends on 1)

The method of claim 1, wherein said load balancing is based on a virtual local area network (VLAN) with which the received packet is associated.

### Claim 3 (depends on 1)

The method of claim 1, wherein said directing received packets to a selected virtual routing processing resource comprises steering the received packets across a switch fabric within the IP service generator.

### Claim 4 (depends on 1)

The method of claim 1, wherein the VR-based switch comprises a chassis-based switch and wherein the IP service generator is implemented within a blade of a plurality of blades of the chassis-based switch.

### Claim 5 (depends on 4)

The method of claim 4, wherein each of the plurality of virtual routing processing resources comprises a virtual routing engine (VRE) including at least one central processing unit and random access memory.

### Claim 6

A system for providing network-based Internet Protocol (IP) services to a plurality of customers of a service provider, comprising:
a plurality of virtual routing processing resources configured to perform packet classification and deep packet inspection and further configured to maintain a packet flow cache by setting up packet flow entries associated with each established packet flow, each packet flow entry of the packet flow cache containing information indicative of one or more packet processing actions or packet field manipulations to perform on packets associated with the established packet flow;
a plurality of virtual services processing resources configured to provide network-based IP services including one or more of virtual private network (VPN) processing,
a line interface/network module coupled in communication with the plurality of virtual routing processing resources, the line interface/network module including a flow manager configured to load balance received packets among the plurality of virtual routing processing resources by directing received packets to a selected virtual routing processing resource of the plurality of virtual routing processing resources, the received packets representing service requests from the plurality of customers;
wherein the selected virtual routing processing resource determines whether a received packet is associated with an established packet flow within the packet flow cache by performing deep packet classification;
wherein responsive to an affirmative determination the selected virtual routing processing resource directs the received packet to a virtual services processing resource of the plurality of virtual services processing resources; and
wherein if the received packet is not dropped or otherwise blocked as a result of the network-based IP services performed by the virtual services processing resource, the virtual services processing resource returns the received packet to the selected virtual routing processing resource for forwarding.

### Claim 7 (depends on 6)

The system of claim 6, wherein the flow manager performs load balancing based on a virtual local area network (VLAN) with which the received packet is associated.

### Claim 8 (depends on 6)

The system of claim 6, further comprising a switch fabric and wherein the selected virtual routing processing resource directs the received packet to the virtual services processing resource by steering the received packets across the switch fabric.

### Claim 9 (depends on 6)

The system of claim 6, wherein the system is a chassis-based switch and wherein the plurality of virtual routing processing resources, the plurality of virtual service processing resources and the line interface/network module are implemented within a blade of a plurality of blades of the chassis-based switch.

### Claim 10 (depends on 6)

The system of claim 6, wherein each of the plurality of virtual routing processing resources comprises a virtual routing engine (VRE) including at least one central processing unit and random access memory.

### Claim 11 (depends on 10)

The system of claim 10, wherein the line interface/network module includes an ingress forwarding manager which maintains a steering table mapping virtual local area networks (VLANs) to one or more VREs of the plurality of VREs.

### Claim 12 (depends on 6)

The system of claim 6, wherein each of the plurality of virtual services processing resources comprises a virtual services engine (VSE) including at least one central processing unit and random access memory.

### Claim 13 (depends on 12)

The system of claim 12, wherein at least one of the plurality of VSEs comprises an advanced security engine (ASE).

### Claim 14 (depends on 13)

The system of claim 13, wherein the ASE comprises a plurality of encryption accelerators, a key accelerator and a security manager configured to load balance and manage security sessions across the one or more encryption accelerators.

### Claim 15 (depends on 6)

The system of claim 6, wherein the line interface/network module includes an egress forwarding manager which applies priority queuing to egress packets based on DiffServ marking and transmits the egress packets out of the line interface/network module.

### Claim 16 (depends on 4)

The method of claim 4, wherein each of the plurality of virtual service processing resources comprises a virtual services engine (VSE) including at least one central processing unit and random access memory.