Patent ID: 7305492

Claim:
A network device comprising: a set of compute elements internal to the network device and adapted to perform a set of network services on packet data; a hardware switching fabric internal to the network device and coupling the compute elements to communicate the packet data between the compute elements, wherein said set of network services performed by the compute elements includes firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking, wherein, the set of compute elements are arranged in a processing pipeline to provide said set of network services; and a flow control element to receive a data packet, to identify the data packet as being associated with a subscriber of a data center, to identify a subset of the network services that are associated with the identified subscriber, and to attach a route tag to the data packet, wherein the flow control element stores a forwarding table that defines a plurality of different routes through the compute elements of the network device, the routes defining different sets of one or more of the network services and specifying an order for applying the network services, wherein, in response to receiving the data packet, the flow control element selects one of the routes based on the subset of network services identified as associated with the subscriber, and attaches the route tag to the packet to identify the selected route, wherein the route tag causes the data packet to be forwarded within the network device to a first one of the compute elements in the processing pipeline and causes output from one of the compute elements in the processing pipeline to be forwarded to a next compute element in the processing pipeline along a route through the compute elements for performing the subset of the services associated with the identified subscriber.