Service processing switch
View Patent ↗A system and method for providing IP services. A packet is received at a line interface/network module and forwarded to a virtual routing engine The virtual routing engine determines if the packet requires processing by a virtual services engine. If the packet requires processing by the virtual services engine, the packet is routed to the virtual services engine for processing.
1. A method comprising:
establishing a flow cache having a plurality of entries each identifying one of a plurality of virtual router (VR) flows through a VR-based network device and corresponding forwarding state information;
receiving a packet at an input port of a line interface module of the VR-based network device;
the line interface module forwarding the packet to a virtual routing engine (VRE);
the VRE determining one or more appropriate packet transformations for application to the packet by performing flow-based packet classification on the packet;
using a result of the flow-based packet classification to retrieve an entry of a plurality of entries of the flow cache;
on a flow cache hit, determining, based on the corresponding forwarding state information of the retrieved flow cache entry, whether to process the packet with a virtual service engine (VSE) of the VR-based network device;
on a packet flow cache miss, identifying the existence of a new VR flow and upon successful allocation of a new entry of the packet flow cache for the new VR flow, forwarding the packet to software on the processor for flow learning.
2. The method of claim 1 , wherein the VSE comprises an Advanced Security Engine (ASE).
3. An article of manufacture comprising a computer-readable medium encoded with one or more computer programs, which when executed by one or more processors of a virtual router (VR)-based network device cause the one or more processors to perform a method comprising:
establishing a flow cache having a plurality of entries each identifying one of a plurality of VR flows through the VR-based network device and corresponding forwarding state information;
receiving a packet at an input port of a line interface module of the VR-based network device;
the line interface module forwarding the packet to a virtual routing engine (VRE);
the VRE determining one or more appropriate packet transformations for application to the packet by performing flow-based packet classification on the packet;
using a result of the flow-based packet classification to retrieve an entry of a plurality of entries of the flow cache;
on a flow cache hit, determining, based on the corresponding forwarding state information of the retrieved flow cache entry, whether to process the packet with a virtual service engine (VSE) of the VR-based network device;
on a packet flow cache miss, identifying the existence of a new VR flow and upon successful allocation of a new entry of the packet flow cache for the new VR flow, forwarding the packet to software on the processor for flow learning.
4. The article of manufacture of claim 3 , wherein the VSE comprises an Advanced Security Engine (ASE).
5. A virtual router (VR)-based network device comprising:
a means for establishing a flow cache having a plurality of entries each identifying one of a plurality of virtual router (VR) flows through a VR-based network device and corresponding forwarding state information;
a means for receiving a packet at an input port of a line interface module of the VR-based network device and for forwarding the packet to a virtual routing engine (VRE);
a means associated with the VRE for determining one or more appropriate packet transformations for application to the packet by performing flow-based packet classification on the packet;
a means for using a result of the flow-based packet classification to retrieve an entry of a plurality of entries of the flow cache;
a means for, on a flow cache hit, determining, based on the corresponding forwarding state information of the retrieved flow cache entry, whether to process the packet with a virtual service engine (VSE) of the VR-based network device;
a means for, on a packet flow cache miss, identifying the existence of a new VR flow and upon successful allocation of a new entry of the packet flow cache for the new VR flow, forwarding the packet to software on the processor for flow learning.
6. The VR-based network device of claim 5 , wherein the VSE comprises an Advanced Security Engine (ASE).