Network traffic steering among CPU cores using forwarding path elements

1. A network device comprising:

a control unit comprising processing circuitry in communication with a memory, wherein the processing circuitry is configured to execute one or more processes; and

a forwarding unit comprising an interface card, a packet processor, and a forwarding unit memory,

wherein the one or more processes of the control unit are configured to configure the forwarding unit memory of the forwarding unit with one or more forwarding path elements,

wherein the one or more forwarding path elements map a packet flow to a central processing unit (CPU) core of a plurality of CPU cores for processing,

wherein the forwarding unit is configured to receive, via the interface card, a packet of the packet flow,

wherein the forwarding unit further comprises respective output queues for the plurality of CPU cores, and

wherein the packet processor of the forwarding unit is configured to execute the one or more forwarding path elements in the forwarding unit memory to steer the packet to the CPU core by adding the packet to the output queue for the CPU core.

2. The network device of claim 1 , wherein the one or more forwarding path elements comprise a first nexthop element, and wherein the one or more processes are further configured to:

select a service unit of a plurality of service units with which to process the packet flow, where the service unit comprises the CPU core; and

generate the first nexthop element to map the packet flow to the selected service unit, and

wherein, to steer the packet to the CPU core, the packet processor of the forwarding unit is further configured to execute the first nexthop element to map the packet flow to the selected service unit.

3. The network device of claim 2 , wherein the one or more forwarding path elements comprise a second nexthop element, wherein the selected service unit comprises the plurality of CPU cores, wherein the one or more processes are further configured to:

select, from the plurality of CPU cores of the selected service unit, the CPU core; and

generate the second nexthop element to map the packet flow to the CPU core of plurality of CPU cores of the selected service unit, and

wherein, to steer the packet to the CPU core, the packet processor of the forwarding unit is further configured to execute the second nexthop element to map the packet flow to the CPU core.

4. The network device of claim 2 ,

wherein the one or more forwarding path elements comprise a second nexthop element,

wherein the selected service unit comprises the plurality of CPU cores, and

wherein, to steer the packet to the CPU core, the packet processor of the forwarding unit is further configured to execute the second nexthop element to select the CPU core from the plurality of CPU cores of the selected service unit.

5. The network device of claim 4 , wherein, to select the CPU core from the plurality of CPU cores of the selected service unit, the packet processor of the forwarding unit is configured to execute the second nexthop element to apply a hash function to one or more elements of a packet header of the packet to generate a hash index that maps to the CPU core from the plurality of CPU cores of the selected service unit.

6. The network device of claim 2 , wherein the selected service unit is a first service unit, wherein the one or more processes are further configured to:

select a second service unit as a replacement of the first service unit; and

in response to detecting a failure of the first service unit, reconfigure the first nexthop element to map the packet flow to the second service unit.

7. The network device of claim 1 , wherein the one or more processes are further configured to:

identify, based on a packet header of the packet, a service associated with the packet, and

generate, based on the service, the one or more forwarding path elements.

8. The network device of claim 7 , wherein the one or more processes are further configured to:

associate each service of a plurality of services with one or more CPU cores of the plurality of CPU cores; and

generate, based on the one or more CPU cores of the plurality of CPU cores associated with each service of the plurality of services, the one or more forwarding path elements.

9. The network device of claim 7 , wherein the one or more processes are further configured to:

associate each service of a plurality of services with one or more CPU cores of the plurality of CPU cores; and

generate, based on the one or more CPU cores of the plurality of CPU cores associated with each service of the plurality of services, the one or more forwarding path elements in order to balance a processing load across the plurality of CPU cores.

10. The network device of claim 1 , wherein the packet flow corresponds to an Internet Protocol Security (IPsec) session.

11. A method comprising:

executing, by processing circuitry of a control unit, one or more processes, wherein the processing circuitry is in communication with a memory;

configuring, by the one or more processes of the control unit, a forwarding unit memory of a forwarding unit with one or more forwarding path elements,

wherein the forwarding unit comprises an interface card, a packet processor, and the forwarding unit memory,

wherein the one or more forwarding path elements map a packet flow to a central processing unit (CPU) core of a plurality of CPU cores for processing, and

wherein the forwarding unit further comprises respective output queues for the plurality of CPU cores;

receiving, by the forwarding unit via the interface card, a packet of the packet flow; and

executing, by the packet processor, the one or more forwarding path elements in the forwarding unit memory to steer the packet to the CPU core by adding the packet to the output queue for the CPU core.

12. The method of claim 11 , wherein the one or more forwarding path elements comprise a first nexthop element, and wherein the method further comprises:

selecting, by the one or more processes, a service unit of a plurality of service units with which to process the packet flow, where the service unit comprises the CPU core; and

generating, by the one or more processes, the first nexthop element to map the packet flow to the selected service unit,

wherein executing the one or more forwarding path elements in the forwarding unit memory to steer the packet to the CPU core further comprises executing the first nexthop element to map the packet flow to the selected service unit.

13. The method of claim 12 , wherein the one or more forwarding path elements comprise a second nexthop element, wherein the selected service unit comprises the plurality of CPU cores, and wherein the method further comprises:

selecting, by the one or more processes from the plurality of CPU cores of the selected service unit, the CPU core;

generating, by the one or more processes the second nexthop element to map the packet flow to the CPU core of plurality of CPU cores of the selected service unit, and

wherein steering the packet to the CPU core further comprises executing, by the packet processor, the second nexthop element to map the packet flow to the CPU core.

14. The method of claim 12 ,

wherein the one or more forwarding path elements comprise a second nexthop element,

wherein the selected service unit comprises the plurality of CPU cores, and

wherein steering the packet to the CPU core further comprises executing, by the packet processor, the second nexthop element to select the CPU core from the plurality of CPU cores of the selected service unit.

15. The method of claim 14 , wherein selecting the CPU core from the plurality of CPU cores of the selected service unit comprises executing, by the packet processor, the second nexthop element to apply a hash function to one or more elements of a packet header of the packet to generate a hash index that maps to the CPU core from the plurality of CPU cores of the selected service unit.

16. The method of claim 12 , wherein the selected service unit is a first service unit, wherein the method further comprises:

selecting, by the one or more processes, a second service unit as a replacement of the first service unit; and

in response to detecting a failure of the first service unit, reconfiguring, by the one or more processes, the first nexthop element to map the packet flow to the second service unit.

17. The method of claim 11 , wherein the method further comprises:

identifying, by the one or more processes based on a packet header of the packet, a service associated with the packet; and

generating, by the one or more processes based on the service, the one or more forwarding path elements.

18. The method of claim 17 , wherein the method further comprises:

associating, by the one or more processes, each service of a plurality of services with one or more CPU cores of the plurality of CPU cores; and

generating, by the one or more processes based on the one or more CPU cores of the plurality of CPU cores associated with each service of the plurality of services, the one or more forwarding path elements.

19. A non-transitory computer-readable medium comprising instructions for causing one or more programmable processors of a network device to:

execute one or more processes of a control plane;

configure a forwarding unit memory of a forwarding unit with one or more forwarding path elements, wherein the forwarding unit comprises an interface card, a packet processor, and the forwarding unit memory, wherein the forwarding path elements map a packet flow to a central processing unit (CPU) core of a plurality of CPU cores, and wherein the forwarding unit further comprises respective output queues for the plurality of CPU cores;

receive a packet of the packet flow; and

execute the one or more forwarding path elements in the forwarding unit memory to steer the packet to the CPU core for processing by the CPU core by adding the packet to the output queue for the CPU core.

20. A network device comprising:

a control unit comprising processing circuitry in communication with a memory, wherein the processing circuitry is configured to execute one or more processes; and

a forwarding unit comprising an interface card, a packet processor, and a forwarding unit memory,

wherein the one or more processes of the control unit are configured to configure the forwarding unit memory of the forwarding unit with one or more forwarding path elements,

wherein the one or more forwarding path elements map a packet flow to a central processing unit (CPU) core of a plurality of CPU cores for processing,

wherein the packet flow corresponds to an Internet Protocol Security (IPsec) session,

wherein the forwarding unit is configured to receive, via the interface card, a packet of the packet flow, and

wherein the packet processor of the forwarding unit is configured to execute the one or more forwarding path elements in the forwarding unit memory to steer the packet to the CPU core.