IP Library › Granted Patent US 12706879
Granted Patent B2
US 12706879 · App. 18/824,720 · Granted Aug 11, 2026

Performance optimizations and traffic flow control for packet processing in a firewall

Inventor: Liwu Liu (Cupertino, CA)
Assignee: FORTINET, INC.
H04L63/0236H04L63/20
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12706879
App. No.
18/824,720
Granted
Aug 11, 2026
Kind
B2
Abstract

Packet traffic flow control includes receiving a packet, by a first virtual machine network security appliance (VMNSA), and determining whether the packet is to be processed by a first path or a second path; in response to determining that the packet is to be processed by the first path, processing the packet by a first traffic flow controller (TFC) of the VMNSA, forwarding the packet by the first TFC to a first transmitter, and sending the packet by the first transmitter; and in response to determining that the packet is to be processed by the second path, processing the packet by the first TFC, forwarding the packet by the first TFC to a second TFC of the VMNSA, processing the packet by the second TFC, forwarding the packet by the second TFC to a second transmitter, and sending the packet by the second transmitter.

Claims (30)

1 . A method comprising:

receiving a packet, by a virtual machine network security appliance in a computing system, and determining whether the packet is to be processed by a first path or a second path;

in response to determining that the packet is to be processed by the first path, processing the packet by a first traffic flow controller of the virtual machine network security appliance, forwarding the packet by the first traffic flow controller to a first transmitter, and sending the packet by the first transmitter; and

in response to determining that the packet is to be processed by the second path, processing the packet by the first traffic flow controller, forwarding the packet by the first traffic flow controller to a second traffic flow controller of the virtual machine network security appliance, processing the packet by the second traffic flow controller, forwarding the packet by the second traffic flow controller to a second transmitter, and sending the packet by the second transmitter.

2 . The method of claim 1 , wherein in response to determining that the packet is to be processed by the first path, sending the packet by the first traffic flow controller to an intrusion prevention service (IPS) processor, and performing IPS processing on the packet by the IPS processor and sending the packet to the second transmitter.

3 . The method of claim 1 , wherein in response to determining that the packet is to be processed by the second path, sending the packet by the second traffic flow controller to an intrusion prevention service (IPS) processor, and performing IPS processing on the packet by the IPS processor and sending the packet to the second transmitter.

4 . The method of claim 2 or 3 , wherein the IPS processing comprises unified threat management processing on the packet.

5 . The method of claim 1 , wherein processing of the packet by the first path is faster than processing of the packet by the second path.

6 . The method of claim 1 , wherein the packet is a control packet.

7 . The method of claim 1 , wherein the packet is a data packet.

8 . The method of claim 1 , comprising receiving the packet by a receiver of the virtual machine network security appliance from a hardware receive queue.

9 . The method of claim 1 , wherein sending the packet comprises forwarding the packet to a hardware transmit queue.

10 . The method of claim 1 , wherein the first traffic flow controller and the second traffic flow controller are executed by different virtual central processing units of the computing system.

11 . The method of claim 1 , wherein the first traffic flow controller performs firewall processing on the packet.

12 . The method of claim 1 , wherein the second traffic flow controller directs firewall policies of a firewall of the virtual machine network security appliance to generate a verdict determining dropping of the packet when the packet is a control packet.

13 . A non-transitory, machine-readable medium storing instructions, which when executed by one or more processing resources, cause the one or more processing resources to:

receive a packet, by a virtual machine network security appliance in a computing system, and determine whether the packet is to be processed by a first path or a second path;

in response to determining that the packet is to be processed by the first path, process the packet by a first traffic flow controller of the virtual machine network security appliance, forward the packet by the first traffic flow controller to a first transmitter, and send the packet by the first transmitter; and

in response to determining that the packet is to be processed by the second path, process the packet by the first traffic flow controller, forward the packet by the first traffic flow controller to a second traffic flow controller of the virtual machine network security appliance, process the packet by the second traffic flow controller, forward the packet by the second traffic flow controller to a second transmitter, and send the packet by the second transmitter.

14 . The non-transitory, machine-readable medium of claim 13 , wherein in response to determining that the packet is to be processed by the first path, instructions, when executed, further cause the one or more processing resources to send the packet by the first traffic flow controller to an intrusion prevention service (IPS) processor, and performing IPS processing on the packet by the IPS processor and send the packet to the second transmitter.

15 . The non-transitory, machine-readable medium of claim 13 , wherein in response to determining that the packet is to be processed by the second path, the instructions, when executed, further cause the one or more processing resources to sending the packet by the second traffic flow controller to an intrusion prevention service (IPS) processor, and performing IPS processing on the packet by the IPS processor and sending the packet to the second transmitter.

16 . The non-transitory, machine-readable medium of claim 13 , wherein the first traffic flow controller and the second traffic flow controller are executed by different virtual central processing units.

17 . An apparatus comprising:

processing circuitry; and

instructions that when executed by the processing circuitry cause the apparatus to:

receive a packet, by a virtual machine network security appliance in a computing system, and determine whether the packet is to be processed by a first path or a second path;

in response to determining that the packet is to be processed by the first path, process the packet by a first traffic flow controller of the virtual machine network security appliance, forward the packet by the first traffic flow controller to a first transmitter, and send the packet by the first transmitter; and

in response to determining that the packet is to be processed by the second path, process the packet by the first traffic flow controller, forward the packet by the first traffic flow controller to a second traffic flow controller of the virtual machine network security appliance, process the packet by the second traffic flow controller, forward the packet by the second traffic flow controller to a second transmitter, and send the packet by the second transmitter.

18 . The apparatus of claim 17 , wherein processing of the packet by the first path is faster than processing of the packet by the second path.

19 . The apparatus of claim 17 , wherein the first traffic flow controller performs firewall processing on the packet.