Distributed network firewall and flow-based forwarding system

A method performed by a network appliance having a plurality of application processing units, includes: receiving a first packet at the network appliance; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a first application processing unit of the plurality of application processing units in the network appliance. A network appliance includes: a plurality of processing units that are communicatively connected to each other; wherein a first processing unit of the plurality of processing units is configured for: calculating a first value using a mathematical algorithm based on one or more information regarding a first packet; and using the calculated first value to identify a second processing unit of the plurality of processing units.

FIELD

This application relates generally to network security appliances, such as firewalls and security devices, and more specifically, to network security appliances having multiple application processor cards for monitoring networks.

BACKGROUND

Network appliances, such as high end distributed security gateway, have been used for protecting networks from various attacks, intrusions detection and prevention, providing high performance packet routing, and other application services. In some cases, such network appliance may include multiple processing units for performing different packet processing functions. Such processing units may be managed by a centralized CPU, which hosts a centralized database for storing all information for all of the multiple processing units.

Applicant of the subject application has determined that it may be desirable to have a network appliance that uses a distributed database, rather than a centralized database, for processing packets

SUMMARY

A method performed by a network appliance having a plurality of application processing units, includes: receiving a first packet at the network appliance; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a first application processing unit of the plurality of application processing units in the network appliance. By means of non-limiting examples, the network appliance may be a firewall, a network security gateway, or any of other security devices.

Optionally, the one or more information may comprise one or a combination of a source IP address, a destination IP address, a source port identifier, a destination port identifier, and protocol information.

Optionally, the network appliance may include a plurality of application processing cards, and the plurality of application processing units may be parts of the application processing cards.

Optionally, at least two of the application processing units may be configured to perform different respective packet processing functions.

Optionally, the method may further include retrieving data from the identified first application processing unit based at least in part on a set of information regarding the first packet, the set of information being a superset of the one or more information used to calculate the first value.

Optionally, the set of information for retrieving the data may comprise source IP address, destination IP address, source port, destination port, and protocol information, and wherein the one or more information for identifying the first application processing unit may comprise a subset of the set of information.

Optionally, the act of retrieving data from the identified first application processing unit may comprise retrieving data from a first local database associated with the first application processing unit.

Optionally, the method may further include receiving data from the identified first application processing unit, wherein the act of receiving the data may be performed by a second application processing unit of the plurality of application processing units in the network appliance that is different from the first application processing unit identified using the calculated first value.

Optionally, the application processing units may have respective local databases associated therewith, and the method may further include storing data regarding the first packet at one of the local databases that is associated with the identified first application processing unit.

Optionally, at least one of the local databases may not have a copy of the data.

Optionally, the method may further include: receiving a second packet at network appliance; calculating a second value based on one or more information regarding the second packet; and using the calculated second value to identify a second application processing unit of the plurality of application processing units.

Optionally, the method may further include: retrieving data stored in a local database that is associated with the identified application processing unit; and creating a packet processing session that represents a packet processing plan based at least in part on the retrieved data.

Optionally, the packet processing session may be created by one of the application processing units.

Optionally, the network appliance may also include a plurality of I/O cards, and the method may further comprise storing the packet processing session in a first local database for one of the I/O cards at which the first packet is received.

Optionally, the packet processing session may be stored in a second local database for another one of the I/O cards at which the first packet is egressed.

Optionally, the network appliance may be configured to perform packet processing in either a slow-path configuration or a fast-path configuration, and the act of calculating the first value and the act of using the calculated first value to identify the first application processing unit may be performed while processing the first packet in the slow-path configuration.

A network appliance includes: a plurality of processing units that are communicatively connected to each other; wherein a first processing unit of the plurality of processing units is configured for: calculating a first value using a mathematical algorithm based on one or more information regarding a first packet; and using the calculated first value to identify a second processing unit of the plurality of processing units.

Optionally, the one or more information may comprise one or a combination of a source IP address, a destination IP address, a source port identifier, a destination port identifier, and protocol information.

Optionally, the network appliance may further comprise a plurality of application processing cards, and the plurality of application processing units may be parts of the application processing cards.

Optionally, at least two of the application processing units may be configured to perform different respective packet processing functions.

Optionally, the first processing unit may be configured for retrieving data from the identified second application processing unit based at least in part on a set of information regarding the first packet, the set of information being a superset of the one or more information used to calculate the first value for identifying the second application processing unit.

Optionally, the set of information for retrieving the data may comprise source IP address, destination IP address, source port, destination port, and protocol information, and wherein the one or more information for identifying the second application processing unit may comprise a subset of the set of information.

Optionally, the first processing unit may be configured for retrieving data from the identified second application processing unit by retrieving data from a local database associated with the second application processing unit.

Optionally, the network appliance may further comprise respective local databases associated with the processing units, wherein one of the local databases that is associated with the identified second application processing unit is configured for storing data regarding the first packet.

Optionally, at least one of the local databases may not have a copy of the data.

Optionally, the first processing unit may be configured for: calculating a second value based on one or more information regarding a second packet; and using the calculated second value to identify a third application processing unit of the plurality of application processing units.

Optionally, the first processing unit may be configured for: retrieving data stored in a local database that is associated with the identified second application processing unit; and creating a packet processing session that represents a packet processing plan based at least in part on the retrieved data.

Optionally, the network appliance may further comprise a plurality of I/O cards, wherein the first packet is received at a first one of the I/O cards, and is egressed at a second one of the I/O cards, and wherein the packet processing session is stored in the first one of the I/O cards at which the first packet is received, and in the second one of the I/O cards at which the first packet is egressed.

Optionally, the network appliance may be configured to perform packet processing in either a slow-path configuration or a fast-path configuration, and the first processing unit may be configured to perform the act of calculating the first value and the act of using the calculated first value to identify the second processing unit while processing the first packet in the slow-path configuration.

Optionally, the first processing unit may comprise a first application processing unit, and the second processing unit may comprise a second application processing unit.

Optionally, the first processing unit may comprise a network processing unit in an I/O card, and the second processing unit may comprise an application processor unit in an application processor card.

Other and further aspects and features will be evident from reading the following detailed description of the embodiments.

DESCRIPTION OF THE EMBODIMENTS

FIG. 1illustrates a network appliance10in accordance with some embodiments. The network appliance10includes a plurality of I/O cards12a,12b, a plurality of application processor cards14a,14b, and a switch fabric16coupling the I/O cards12and the application processor cards14. Each I/O card12includes a plurality of network ports18configured to receive packets, transmit packets, or both receive and transmit packets. In some embodiments, each I/O card12may be a 100 G I/O card. Each I/O card12also includes one or more network processing unit20. The network processing units20are communicatively coupled to the network ports18via a switch. Alternatively, the switch is optional, and the I/O card12may not include the switch. In such cases, the network ports18connect directly to the network processing units20. Although each I/O card12is illustrated as having two network processing units20, it should be understood that an I/O card12may have only one network processing unit20, or more than two network processing units20. In some embodiments, a network processing unit20may be implemented using a processor, such as a network processor, a FPGA, an ASIC, a general purpose processor, etc. Also, in some embodiments, a network processing unit20may include hardware, software, or combination of both.

As shown in the figure, each application processor card14includes multiple application processing units30. Each application processing unit30is configured to perform one or more network processing function, such as firewall function, network security monitoring (such as intrusion detection), and/or network security prevention, including but not limited to intrusion prevention, anti-virus, URL blocking, QoS, etc. The application processor card14may be configured to perform one or more packet processing function(s), including but not limited to load balancing, etc. Although each application processor card14is illustrated as having three application processing units30, in other embodiments, an application processor card14may have fewer than three (e.g., one) application processing units30, or more than three application processing units30. In some embodiments, an application processing unit30may be implemented using a processor, such as a FPGA, an ASIC, a general purpose processor, etc. Also, in some embodiments, an application processing unit30may include hardware, software, or combination of both. Also, in some embodiments, different application processing units30may be configured to perform different tasks. In some embodiments, each application processor card14may comprise a multi-core CPU. Also, in some embodiments, different application processing units in the application processor card14may be implemented using different respective CPUs.

In some embodiments, all of the components of the network appliance10may be accommodated in a housing, or may be physically connected to each other in a frame or in a building, so that the network appliance10may be deployed as a single unit at a geographical location. In one implementation, the network appliance10may include a chassis with a plurality of slots for detachably coupling to a plurality of I/O cards12, and a plurality of slots for detachably coupling to a plurality of application processor cards14. In other embodiments, one or more components of the network appliance10may be communicatively coupled to a remaining part of the network appliance10through a network (e.g., the Internet). In such cases, the components of the network appliance10may be deployed in different geographical locations.

The network appliance10is configured to process packets in at least two configurations—i.e., a slow-path configuration, and a fast-path configuration.FIG. 2illustrates a processing of packets by the network appliance10in the slow-path configuration. First, a packet is received at one of the ports18at one of the I/O cards (I/O card12a), and the packet is passed to a circuit (which may be a switch or a conductor), as represented by arrow200a. The packet is then passed to a network processing unit20in the I/O card12a, as represented by arrow200b. The network processing unit20looks up its local database to see if a session was previously set up for the packet. In some embodiments, a hashing may be performed using one or more information regarding the packet, and the hash value may be used to look up a corresponding session. If there is no previous session, the network processing unit20then passes the packet downstream for processing in the slow-path configuration.

As shown in the figure, the packet is passed by the network processing unit20to the switch fabric16, as represented by arrow200c, which then passes the packet to one of the application processor cards14(application processor card14a), as represented by arrow200d. The packet is passed to a circuit (which may be a switch or a conductor) in the application processor card14a, which then passes the packet to one of the application processing units30in the application processor card14a, as represented by arrow200e. In some embodiments, the I/O card12athat received the packet may calculate a hash value using one or more information regarding the packet, and use the hash value to identify the application processing unit30to transmit the packet. In one implementation, the one or more information regarding the packet may be a 5-tuples that include source IP address, destination IP address, source port, destination port, and protocol information. In other embodiments, the one or more information regarding the packet may be a subset of the above information, or may have other types of information.

After the application processing unit30receives the packet, the application processing unit30may perform session lookup to see if a session can be found for the packet. If there is no session found, then the application processing unit30then processes the packet (e.g., performs policy lookup, anti-virus check, and/or any of other network security checks, etc.), and creates a session202. In some embodiments, the creation of the session may be performed based on policy, ALG, NAT, etc.

After the session202is created, the application processing unit30then passes the packet to the switch fabric16, as represented by arrow200f. The switch fabric16then passes the packet to another I/O card12b, as represented by arrow200g. The I/O card12bthan passes the packet to a network port18at the I/O card12for egress out of the network port18at the I/O card12b, as represented by arrow200h.

In some embodiments, the created session202may represent a packet processing plan. For example, in some embodiments, the session202may have a data structure configured to represent different parameters for processing packets that belong to the same session. Information in the session202may be determined by one or more application processor cards14(e.g., by one or more application processing units30in a same application processor card14, or by application processing units30in different application processor cards14).

In the illustrated embodiments, the created session202may be transmitted by the application processor card14ato the I/O card12aat which the packet was received, so that the session202may be stored at a local database for the I/O card12a(e.g., the local database associated with the corresponding network processing unit20). The created session202may also be transmitted (e.g., via the switch fabric16) by the application processor card14ato the I/O card12bat which the packet is egressed, wherein the packet may be stored at a local database for the I/O card12b(e.g., the local database associated with the corresponding network processing unit20in the I/O card12b). Session is stored at both the I/O card12aand the I/O card12b, so that when packet comes in from either direction (e.g., received at the I/O card12bfor egress at the I/O card12a, or received at the I/O card12afor egress at the I/O card12b), the session information will be available either way at the I/O card12aor at the I/O card12b. As shown in the figure, the created session202may also be transmitted by the application processor card14ato another application processor card14b(e.g., through the switch fabric16) for storage at a local database for the other application processor card14b. For example, the application processing card14amay identify the application processing card14bbased on hash information (e.g., 5 tuples) used in the I/O card. In some embodiments, the created session202may be associated with a value, which may be determined using information regarding the packet, wherein the value may be later used as an index to lookup the session202. For example, in some embodiments, 5-tuples (e.g., source IP address, destination IP address, source port, destination port, protocol information) obtained from the packet may be used to determine a value, such as a hash value, and the created session202may then be stored in association with the hash value.

After the session202has been created, the next time the network appliance10receives a packet that belong to the same session, the packet may be processed in the fast-path.FIG. 3illustrates a processing of packets by the network appliance10in the fast-path configuration. First, a packet is received at one of the ports18at one of the I/O cards12(I/O card12a), and the packet is passed to a circuit (which may be a switch or a conductor), as represented by arrow200a. The packet is then passed to a network processing unit20in the I/O card12a, as represented by arrow200b. The network processing unit20looks up the local database for the I/O card12ato see if a session was previously set up for the packet. If there is no previous session, the network processing unit20then passes the packet downstream for processing in the slow-path configuration, as discussed with reference toFIG. 2. In the illustrated example shown inFIG. 3, there is a previous session202created. Thus, instead of passing the packet to an application processor card14via the switch fabric16, in this case, the packet is processed by one or more network processing unit(s)20at the I/O card12aaccording to the packet processing plan prescribed by the session202previously stored at the local database for the I/O card12a. The packet is then passed to the switch fabric16(as represented by arrow200c), which then passes the packet to another I/O card12b, as represented by arrow200i. The packet is then egressed out of a port18at the I/O card12b, as represented by arrow200j. As shown in the figure, in the fast-path configuration, the packet does not need to go through processing by the application processor cards14to establish a new session, and thus, the processing speed for the fast-path configuration is faster than the processing speed for the slow-path configuration.

In some cases, a packet may be received from a port18at the I/O card12b, and be transmitted out at a port18at the I/O card12ain the opposite direction in the fast-path configuration from that shown inFIG. 3. In such cases, because the session202is also stored in a local database for the I/O card12b, a network processing unit20at the I/O card12bmay look up the local database for the I/O card12bto see that a session was previously set up for the packet. Accordingly, the packet is then processed by one or more network processing unit(s)20at the I/O card12baccording to the packet processing plan prescribed by the session202previously stored at the local database for the I/O card12b. The packet is then passed to the switch fabric16, which then passes the packet to the I/O card12afor egress out of a port at the I/O card12a. In other embodiments, the session may be processed by the I/O card12a. In such cases, the network port18at the I/O card12bwill forward packets to the I/O card12afor processing.

In some cases, the session202at the I/O card12amay be missing when the I/O card12areceives a new packet. In such cases, the packet will be passed to one of the application processing units30(e.g., based on a hash value determined from one or more information regarding (e.g., in) the new packet) at the application processor card14athrough the switch fabric16. The application processing unit30may determine that there is a session because it is stored in a local database associated with the application processing unit30. In such cases, the packet will still be processed according to a fast-path configuration. In particular, the packet will be processed according to the previously created session202, and be passed from the application processor card14ato the I/O card12bthrough the switch fabric16for egressing the packet, without creating a new session. The application processor card14amay also send back a copy of the session202to the I/O card12afor storage at a local database associated with the I/O card12a, so that the network processing unit20in the I/O card12amay have access to the session202in the future that was previously missing.

Also, in some cases, the session202may prescribe packets to be processed by one or more application processing units30. In such cases, packets may be passed to one or more application processing units30for fast-path processing. For example, in some embodiments, the I/O card12areceiving the packet may perform session lookup. The I/O card12amay find the session for the packet, wherein the session202may prescribe the packet to be processed by certain application processing unit30. The packet is then forwarded to the application processor card14that includes the application processing unit30according to the session202along with a session ID. When the application processing unit30receives the packet and the session ID, the application processing unit30verifies the session by the session ID. If the session is found, the application processing unit30then processes the packet according to the session. After the packet is processed, the application processing unit30then passes the packet to an I/O card12for egressing the packet.

As illustrated in the above example, creating the session202is advantageous because the session202contains all information of what is to be done for a particular packet. As the packet is being processed in the slow-path configuration, the network appliance10collects information of what needs to be done for the packet. The network appliance10sets up the session202(containing information on what needs to be done on packet). This way, future packets do not need to go through the slow-path processing, and network appliance10can look up session to process future packets in the fast-path configuration.

As discussed, during the slow-path packet processing configuration, a session202is created. In the process, different network parameters may be determined. There may be different types of RTO representing different network parameters. By means of non-limiting example, different RTO types may represent flow session, VPN SA, application layer gateway (ALG) Gate, Cone network address translation (NAT) mapping, session limit, AD counter, syn attack counter, Gate with wildcard, IP action entry, etc., respectively.

In some embodiments, RTOs may be stored at different local databases for the different application processing units30in a distributed manner. In such configuration, each application processing unit30has a local database which may be a subset of a hypothetical global database. In the distributed database configuration, because there is no central management for managing all information, a special technique is needed to identify a local database that is associated with a certain application processing unit30in order to store, retrieve, and operate on information stored therein.FIG. 4illustrates a method400of processing a packet to identify an application processing unit30in a distributed database configuration. First, a packet is received by the network appliance10(Item402). Next, a hash value is calculated using a mathematical algorithm (e.g., hashing algorithm) based on one or more information regarding the packet (item404). In some embodiments, the calculating of the hash value may be performed by one of the application processing units30, or by one of the network processing units20, or by both. By means of non-limiting examples, the one or more information regarding the packet may be one or a combination of a source IP address, a destination IP address, a source port, a destination port, and protocol information. After the hash value is obtained, the hash value may then be used to identify the application processing unit30(Item406). For example, in some embodiments, the hash value itself may be the identification of the application processing unit30. In other embodiments, the hash value may be used as an index to look up a corresponding identification of an application processing unit30. In the illustrated embodiments, the hash value is used to store and/or lookup information stored in a distributed database system associated with the network appliance10(e.g., to identify the application processing unit30that stores a certain information). Thus, the hash value is different from the session-lookup hash value.

In some embodiments, after the application processing unit30has been identified in the distributed database system, the identified application processing unit30(e.g., its corresponding local database) may then be used to store information regarding the packet. In other embodiments, information already stored in the corresponding local database of the application processing unit30may be retrieved after the application processing unit30has been identified. In further embodiments, information stored in the corresponding local database of the application processing unit30may be operated on (e.g., updated, deleted, etc.) after the application processing unit30has been identified.

It should be noted that because each application processing unit30has a corresponding local database associated therewith, the act of identifying the application processing unit30may be accomplished by determining the identification of the application processing unit30, or the identification of the local database associated with the application processing unit30(which may be the same or different). In some embodiments, the local database associated with the corresponding application processing unit30may be considered to be a part of the application processing unit30.

In the distributed database configuration, every RTO is stored only in one local RTO database for a corresponding one application processing unit30, which may be uniquely identified using a hash value, like that shown inFIG. 5. In other embodiments, every RTO may be stored in a number of local RTO databases (e.g., for redundancy purpose), but the number is fewer than the total number of RTO databases for the entire network appliance10so that the system may still be considered a distributed database system, but not a fully synchronized database system.

In the distributed database system shown inFIG. 5, one application processing unit30(“APP-P-3” in the example) may retrieve information from a local database of another application processing unit30(“APP-P-2” in the example) by first identifying the database from which the information is to be retrieved. Such may be accomplished by calculating a hash value using a hashing algorithm based on a key, like that discussed with reference to the method ofFIG. 4. For example, the hashing algorithm may use a subset of values in the key, or all of the values in the key to calculate the hash value. The hash value may then be used to identify the database from which the information is to be retrieved. In some embodiments, the hash value itself is the identification of the database. In other embodiments, the hash value may be an index that can be used to look up an identification of the database (such as, through a lookup table). Because each application processing unit30has a corresponding local database associated therewith, identification of the database may be accomplished by identifying the application processing unit30, or vice versa. In such cases, the hash value may represent both the identification of the database and the identification of the corresponding application processing unit30. Thus, in this specification, the identification of the database and the identification of the application processing unit30may be the same, and a reference to an identification of an application processing unit may refer to an identification of the database that corresponds with the application processing unit, and vice versa.

After the database from which the information is to be retrieved has been identified, the key may then be used to retrieve the information from the database. In some embodiments, a part of a key may be used to calculate the hash value for identifying the database/application processing unit30, and then the full key is used (e.g., the fully key may be used directly as an index, or may be hashed to obtain a hash value, which is then used as an index) to look up the desired information from the database.

In some embodiments, the key described above for use in the distributed database operation for the network appliance10may be constructed using a 5-tuples that includes (1) a source IP address, (2) a destination IP address, (3) a source port, (4) a destination port, and (5) protocol information. Any information in this 5-tuples may have a fixed value, a range of values, or a “wildcard” identifier. In some embodiments, a key has at least one fixed value in the 5-tuples. In some embodiments, if all 5-tuples are fixed, then the 5-tuples are used as the key. Such key may be used to look up information regarding session, VPN SA, etc. In other embodiments, if a subset of the values in the 5-tuples is fixed, then only the fixed values (or a subset of the fixed values) in the 5-tuples may be used as the key. For example, if the destination IP address is fixed, then the destination IP address may be used as the key. Such key may be used to look up information regarding corn NAT, ALG gate, destination IP-based session limit, etc. In another example, if the source IP address is fixed, then the source IP address is used as the key. Such key may be used to look up information regarding Cone NAT, ALG gate, source IP-based session limit, etc. In other embodiments, in a rare situation, a key may contain no fixed value (e.g., each of the 5-typles is either a range of value or a wild card value). In such cases, the information may be fully populated to all local RTO databases (like that in a fully synchronized database configuration).

As illustrated in the above embodiments, the distributed database configuration of the network appliance10is advantageous because its capacity may linearly scale up along with the number of application processing units30. Also, the database operations overhead remains constant while the number of application processing units30may increase. Furthermore, such distributed database would require less resource for maintenance and synchronization compared to a centralized database configuration (in which all information is stored in one centralized database like that shown inFIG. 6) and a fully synchronized database configuration (in which each RTO database has a copy of a same information so that the information can be locally retrieved at each application processing unit30like that shown inFIG. 7). This is because in the network appliance10, RTO information are stored and managed locally by the respective application processing unit30. Thus, unlike the centralized database in which a centralized CPU keeps track of all information in all application processing units to have a view of the whole system, and distributes work accordingly, in the network appliance10, there is no need for any centralized management. Also, the distributed database configuration of the network appliance10is advantageous because even if a network processing unit30is down, the network appliance10may still be functional because other network processing units30may continue to perform packet processing based on the distributed database configuration described previously. This is in contrast to the centralized database configuration in which if the centralized CPU is down, then the entire system becomes non-functional.

In the distributed database configuration, because there is no centralized CPU that manages everything, and because network information are stored respectively at different local databases for the respective application processing units30, the network appliance10is configured to lookup network information (e.g., network parameters) from the different local databases. For example, in some embodiments, when a packet is received by the network appliance10, the 5-tuples obtained from the packet is hashed to obtain a hash value. The hash value is used to identify the local database that contains the desired network information. A query is then sent (e.g., by an application processing unit30or a network processing unit20) to an application processing unit30that hosts the identified (based on the hash value) local database to get the desired network information. By means of non-limiting examples, the network information may be a counter, a mapping, session counter, session limit, etc. For example, for session setup, the query may ask for a counter for a current session. If the counter for the current session returned by the database is less than a prescribed maximum value, then the application processing unit30may set up a session for the packet. Also, in some embodiments, the session counter may be updated in the local database.

FIG. 8illustrates an example of a RTO database operation in a distributed database configuration that involves ALG Gate (e.g., FTP) insert. Initially, no Gate is setup for a particular packet. As part of the slow-path processing, it may be determined that a Gate needs to be created. In some embodiments, a Gate may be created by one of the application processing units30(“APP-P-3” in the example). Also, in some embodiments, the I/O card may use the 5-tuple key (e.g., the key itself, or a hash value of it) to identify the application processing unit30. In the illustrated example, the created Gate may be associated with a 5-tuple key derived from a packet for which the Gate is created. The 5-tuple key may have the format: [dst-ip, *, dst-port, src-port, protocol], wherein “dst-ip” represents destination IP address, “dst-port” represents destination port, “src-port” represents source port, and “*” represents a wildcard. The 5-tuple key represents an unique Gate ID for the created Gate. Next, a portion of the 5-tuple key (“dst-ip”) is used to calculate a hash value for identifying a local RTO database at one of the application processing units30for storing the created Gate. In some embodiments, the calculating of the hash value may be performed by APP-P-3. In the example, the calculated hash value may represent an identification of another application processing unit30(“APP-P-2” in the example). In such cases, the Gate together with its globally unique Gate ID are then sent from APP-P-3 to APP-P-2 for storage at the local database for APP-P-2.

In some embodiments, when a new packet comes in, the network appliance10may retrieve the Gate information in the database hosted by APP-P-2 for the new packet. For example, in some embodiments, when a new packet is received by the network appliance10, the network appliance10may not find a session for the packet. The network appliance10may then determine whether there is a Gate created for the packet. If there is a Gate, then the network appliance10may create a session. The application processing unit30(e.g., APP-P-3) may use the “dst-ip” part of the key (determined from processing the newly received packet) to calculate a hash value. The hash value is then used to identify the database at which the Gate information is stored. In this example, the identified database is the local database associated with the application processing unit30“APP-P-2”. The application processing unit “APP-P-3” may then send a retrieval message along with the 5-tuple key to APP-P-2. When APP-P-2 receives the query and the 5-tuple key from APP-P-3, APP-P-2 looks up its RTO database using the 5-tuple key to see if there is a match. If so, the APP-P-2 may then send back the Gate information back to APP-P-3, and APP-P-3 may then create a session for the packet.

Also, in some embodiments, the Gate information stored at the local database associated with one of the application processing units30may be operated on (e.g., it may be updated, deleted, etc.). For example, in some embodiments, the application processing unit30(e.g., APP-P-3) may use the “dst-ip” part of the key to calculate a hash value. The hash value is then used to identify the database at which the Gate information is stored. In this example, the identified database is the local database associated with the application processing unit30“APP-P-2”. The application processing unit “APP-P-3” may then send an operational message (e.g., an update or delete message) to APP-P-2 with the Gate ID (which is the full key). When APP-P-2 receives the Gate ID from APP-P-3, APP-P-2 looks up its RTO database to see if there is a match. If so, the APP-P-2 may then perform the requested operation, may then send back an acknowledgement message back to APP-P-3 after the operation is completed.

It should be noted that RTO information is not limited to the Gate information described in the previous example, and that there may be other types of RTO information. For example, RTO information may include information regarding a flow session, in which case, the 5-tuples may be used as the key (e.g., in a hashing operation) for identifying the database/corresponding application processing unit30that has the flow session information.

In another example, RTO information may include information regarding VPN SA, in which case, the 5-tuples may be used as the key (e.g., in a hashing operation) for identifying the database/corresponding application processing unit30that has the VPN SA information. In other embodiments, the source IP address and/or the destination IP address may be used as the hash key to locate the application processing unit to perform the RTO lookup.

In another example, RTO information may include information regarding full Gate, in which case, the 5-tuples may be used as the key (e.g., in a hashing operation) for identifying the database/corresponding application processing unit30that has the full Gate information.

In another example, RTO information may include information regarding session limit that is either source IP based or destination IP based. In such case, the source IP address or the destination IP address in the 5-tuples may be used (e.g., in a hashing operation) for identifying the database/corresponding application processing unit30that has the session limit information.

In another example, RTO information may include information regarding AD counter. In such case, the source IP address or the destination IP address in the 5-tuples may be used (e.g., in a hashing operation) for identifying the database/corresponding application processing unit30that has the AD counter information.

In still another example, RTO information may include information regarding syn attack (such as syn attack counter). In such case, the source IP address or the destination IP address in the 5-tuples may be used (e.g., in a hashing operation) for identifying the database/corresponding application processing unit30that has the syn attack information.

In another example, RTO information may include information regarding Cone NAT (e.g., mapping information). In such cases, there may be two RTO entries, one for forward mapping, and another one for reverse mapping. The original source IP address may be used as the key (e.g., in a first hashing operation) for identifying the database/corresponding application processing unit30that has the forward mapping information, and the “NATed” source IP address may be used as the key (e.g., in a second hashing operation) for identifying the database/corresponding application processing unit30that has the reverse mapping information.

In some embodiments, except for session RTOs and SA RTOs, all of the RTOs with the same destination IP address or source IP address may be stored in the same local RTO database. Also, in some embodiments, for a given packet with a fixed destination IP address and source IP address, two RTO database queries may be issued by an application processing unit30to retrieve all of the relevant RTOs for the packet. For example, one query may be issued to an application processing unit (e.g., APP-P-1) that is identified by hashing the destination IP address in the key, and another query may be issued to another application processing unit30(e.g., APP-P-2) that is identified by hashing the source IP address in the key.

As discussed and illustrated above, one or more network processing units20and one or more application processing units30in the network appliance10are configured to communicate with each other through the switch fabric16. In some embodiments, the switch fabric16of the network appliance10may include a logical bus for interconnecting all of the network processing units20and the application processing units30. In some embodiments, the network appliance10may utilize a protocol (e.g., an Inter Processor Communication Protocol (IPCP), which is a transport layer protocol that provides a mechanism to deliver messages between two points) for supporting this interconnection (FIG. 9). The protocol may support one or a combination of P2P communication, P2MP communication, broadcast, synchronized communication, asynchronized communication, reliable communication, unreliable communication.

Computer System Architecture

As discussed above, the network appliance10includes a plurality of application processing units30in one or more application processor cards14. In other embodiments, an application processing unit30or an application processor card14may be implemented using a computer system.FIG. 10is a block diagram that illustrates an embodiment of a computer system1200upon which embodiments described herein may be implemented. For example, in some embodiments, the computer system1200may be used to implement one or more functions of an application processor card14, or one or more functions of an application processing unit30, described herein. Computer system1200includes a bus1202or other communication mechanism for communicating information, and a processor1204coupled with the bus1202for processing information. The processor1204may be used to perform various functions described herein. For example, in some embodiments, the processor1204may receive input from a user for configuring a network component (e.g., the component380).

The computer system1200also includes a main memory1206, such as a random access memory (RAM) or other dynamic storage device, coupled to the bus1202for storing information and instructions to be executed by the processor1204. The main memory1206also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by the processor1204. The computer system1200further includes a read only memory (ROM)1208or other static storage device coupled to the bus1202for storing static information and instructions for the processor1204. A data storage device1210, such as a magnetic disk or optical disk, is provided and coupled to the bus1202for storing information and instructions.

The computer system1200may be coupled via the bus1202to a display1212, such as a cathode ray tube (CRT) or a LCD monitor, for displaying information to a user. An input device1214, including alphanumeric and other keys, is coupled to the bus1202for communicating information and command selections to processor1204. Another type of user input device is cursor control1216, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor1204and for controlling cursor movement on display1212. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.

The computer system1200may be used for performing various functions in accordance with the embodiments described herein. According to one embodiment, such use is provided by computer system1200in response to processor1204executing one or more sequences of one or more instructions contained in the main memory1206. Such instructions may be read into the main memory1206from another computer-readable medium, such as storage device1210. Execution of the sequences of instructions contained in the main memory1206causes the processor1204to perform the process steps described herein. One or more processors in a multi-processing arrangement may also be employed to execute the sequences of instructions contained in the main memory1206. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to implement features of the embodiments described herein. Thus, embodiments described herein are not limited to any specific combination of hardware circuitry and software.

The term “computer-readable medium” as used herein refers to any medium that participates in providing instructions to the processor1204for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as the storage device1210. A non-volatile medium may be considered to be an example of a non-transitory medium. Volatile media includes dynamic memory, such as the main memory1206. A volatile medium may be considered to be another example of a non-transitory medium. Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise the bus1202. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

Various forms of computer-readable media may be involved in carrying one or more sequences of one or more instructions to the processor1204for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to the computer system1200can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector coupled to the bus1202can receive the data carried in the infrared signal and place the data on the bus1202. The bus1202carries the data to the main memory1206, from which the processor1204retrieves and executes the instructions. The instructions received by the main memory1206may optionally be stored on the storage device1210either before or after execution by the processor1204.

The computer system1200also includes a communication interface1218coupled to the bus1202. The communication interface1218provides a two-way data communication coupling to a network link1220that is connected to a local network1222. For example, the communication interface1218may be an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, the communication interface1218may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, the communication interface1218sends and receives electrical, electromagnetic or optical signals that carry data streams representing various types of information.

The network link1220typically provides data communication through one or more networks to other devices. For example, the network link1220may provide a connection through local network1222to a host computer1224or to equipment1226such as a radiation beam source or a switch operatively coupled to a radiation beam source. The data streams transported over the network link1220can comprise electrical, electromagnetic or optical signals. The signals through the various networks and the signals on the network link1220and through the communication interface1218, which carry data to and from the computer system1200, are exemplary forms of carrier waves transporting the information. The computer system1200can send messages and receive data, including program code, through the network(s), the network link1220, and the communication interface1218.

It should be noted that when a “packet” is described in this application, it should be understood that it may refer to the original packet that is transmitted from a node, or a copy of it.

It should be noted that the terms “first”, “second”, etc., are used to refer to different things, and do not necessarily refer to the order of things.