Selective offloading of packet flows with flow state management
A first packet of a packet flow is received at a classifying network device. The first packet is forwarded from the classifying network device to a firewall network device. An indication that the packet flow is to be offloaded is received at the classifying network device. Data is stored at the classifying network device indicating that the packet flow is to be offloaded. A non-control packet of the packet flow is received at the classifying network device. A determination is made that the non-control packet belongs to the packet flow by comparing data contained in the non-control packet to the stored data. The non-control packet of the packet flow is directed to a processing entity in response to the determining. A control packet of the packet flow is received at the classifying network device. The control packet of the packet flow is directed to the firewall network device.
1 . A method comprising:
obtaining a received packet of a packet flow at a network security device;
evaluating, by a classifying device associated with the network security device, whether the received packet is part of a first group of packets eligible for fast path offloading or part of a second group of packets not eligible for fast path offloading;
in response to an evaluation that the received packet is part of the first group of packets eligible for fast path offloading, determining whether the received packet matches a stored indicator identifying the received packet as part of a flow to be offloaded;
in response to a determination that the received packet matches the stored indicator identifying the received packet as part of a flow to be offloaded, sending the received packet to an offload network processor; and
if the received packet is not part of the first group of packets eligible for fast path offloading, processing the received packet by a firewall device associated with the network security device;
wherein evaluating, by a classifying device associated with the network security device, whether the received packet is part of a first group of packets eligible for fast path offloading or part of a second group of packets not eligible for fast path offloading includes:
identifying whether the received packet is a control packet or a non-control packet, and assigning non-control packets to the first group of packets eligible for fast path offloading and assigning control packets to the second group of packets not eligible for fast path offloading; and
identifying whether the received packet is fragmented, and assigning non-fragmented packets to the first group of packets eligible for fast path offloading and assigning fragmented packets to the second group of packets not eligible for fast path offloading.
2 . The method of claim 1 , wherein in response to a determination that the received packet does not match a stored indicator, further comprising:
classifying the packet flow and, if the received packet is part of a flow to be offloaded, storing an indicator identifying the packet flow.
3 . The method of claim 1 , wherein the method further comprises using the received packet to maintain a flow state of the packet flow at the network security device.
4 . The method of claim 3 , further comprising storing data maintaining the flow state of the packet flow at the network security device.
5 . The method of claim 1 , further comprising:
obtaining an indication that non-control packets of the packet flow are no longer to be offloaded; and
processing a second received packet from the packet flow by the firewall device associated with the network security device instead of the offload network processor.
6 . An apparatus comprising:
one or more memories;
one or more network interfaces configured to enable network communications; and
one or more processors, wherein the one or more processors are configured to perform operations, the operations comprising:
obtaining a received packet of a packet flow at a network security device;
evaluating, by a classifying device associated with the network security device, whether the received packet is part of a first group of packets eligible for fast path offloading or part of a second group of packets not eligible for fast path offloading;
in response to an evaluation that the received packet is part of the first group of packets eligible for fast path offloading, determining whether the received packet matches a stored indicator identifying the received packet as part of a flow to be offloaded;
in response to a determination that the received packet matches the stored indicator identifying the received packet as part of a flow to be offloaded, sending the received packet to an offload network processor; and
if the received packet is not part of the first group of packets eligible for fast path offloading, processing the received packet by a firewall device associated with the network security device,
wherein evaluating, by a classifying device associated with the network security device, whether the received packet is part of a first group of packets eligible for fast path offloading or part of a second group of packets not eligible for fast path offloading includes:
identifying whether the received packet is a control packet or a non-control packet, and assigning non-control packets to the first group of packets eligible for fast path offloading and assigning control packets to the second group of packets not eligible for fast path offloading; and
identifying whether the received packet is fragmented, and assigning non-fragmented packets to the first group of packets eligible for fast path offloading and assigning fragmented packets to the second group of packets not eligible for fast path offloading.
7 . The apparatus of claim 6 , wherein in response to a determination that the received packet does not match a stored indicator, the operations further include:
classifying the packet flow and, if the received packet is part of a flow to be offloaded, storing an indicator identifying the packet flow.
8 . The apparatus of claim 6 , wherein the operations further comprise using the received packet to maintain a flow state of the packet flow at the network security device.
9 . The apparatus of claim 8 , wherein the operations further comprise storing data maintaining the flow state of the packet flow at the network security device.
10 . The apparatus of claim 6 , wherein the operations further comprise:
obtaining an indication that non-control packets of the packet flow are no longer to be offloaded; and
processing a second received packet from the packet flow by the firewall device associated with the network security device instead of the offload network processor.
11 . One or more tangible non-transitory computer readable media containing instructions, wherein the instructions, when executed, cause one or more processors associated with a network security device to perform operations comprising:
obtaining a received packet of a packet flow at a network security device;
evaluating, by a classifying device associated with the network security device, whether the received packet is part of a first group of packets eligible for fast path offloading or part of a second group of packets not eligible for fast path offloading;
in response to an evaluation that the received packet is part of the first group of packets eligible for fast path offloading, determining whether the received packet matches a stored indicator identifying the received packet as part of a flow to be offloaded;
in response to a determination that the received packet matches the stored indicator identifying the received packet as part of a flow to be offloaded, sending the received packet to an offload network processor; and
if the received packet is not part of the first group of packets eligible for fast path offloading, processing the received packet by a firewall device associated with the network security device,
wherein evaluating, by a classifying device associated with the network security device, whether the received packet is part of a first group of packets eligible for fast path offloading or part of a second group of packets not eligible for fast path offloading includes;
identifying whether the received packet is a control packet or a non-control packet, and assigning non-control packets to the first group of packets eligible for fast path offloading and assigning control packets to the second group of packets not eligible for fast path offloading; and
identifying whether the received packet is fragmented, and assigning non-fragmented packets to the first group of packets eligible for fast path offloading and assigning fragmented packets to the second group of packets not eligible for fast path offloading.
12 . The one or more tangible non-transitory computer readable media containing instructions of claim 11 , wherein in response to a determination that the received packet does not match a stored indicator, the operations further comprise:
classifying the packet flow and, if the received packet is part of a flow to be offloaded, storing an indicator identifying the packet flow.
13 . The one or more tangible non-transitory computer readable media containing instructions of claim 11 , wherein the operations further comprise using the received packet to maintain a flow state of the packet flow at the network security device.
14 . The one or more tangible non-transitory computer readable media containing instructions of claim 13 , wherein the operations further comprise storing data maintaining the flow state of the packet flow at the network security device.
15 . The one or more tangible non-transitory computer readable media containing instructions of claim 11 , wherein the operations further comprise:
obtaining an indication that non-control packets of the packet flow are no longer to be offloaded; and
processing a second received packet from the packet flow by the firewall device associated with the network security device instead of the offload network processor.