Juniper Networks, Inc.

Jianhui Huang

Jean-Marc Frailong

Deepak Goel

John Keen

Jeffrey Glenn Libby

Sharada Yeluri

Srinivasan Jagannadhan

Ramesh Panwar

Venkatasubramanian Swaminathan

Anurag P Gupta

Rajesh Nair

Srilakshmi Adusumalli

Paul Coelho

David Skinner

A firewall device may include a forwarding component that includes a filter block. The filter block may obtain a first hardware-implemented filter, where a hardware implementation limits the first hardware-implemented filter to a maximum quantity of rules; determine whether a last rule associated with the accessed hardware-implemented filter includes a split-filter action, where the split-filter action identifies a second hardware-implemented filter; and link the second hardware-implemented filter to the first hardware-implemented filter to make the second hardware-implemented filter a logical continuation of the first hardware-implemented filter, in response to determining that the last rule includes the split-filter action. The filter block may further determine whether a particular rule of the first hardware-implemented filter includes a next-filter action, where the next filter action identifies a third hardware-implemented filter; and process the third hardware-implemented filter independently of the sequence of hardware attachment points.

Hardware implementation of complex firewalls using chaining technique

A data read/write system includes a system clock, a single port memory, a cache memory that is separate from the single port memory, and a controller coupled to an instruction pipeline. The controller receives, via the instruction pipeline, first data to write to an address of the single port memory, and further receives, via the instruction pipeline, a request to read second data from the single port memory. The controller stores the first data in the cache memory, and retrieves the second data from either the cache memory or the single port memory during one or more first clock cycles of the system clock. The controller copies the first data from the cache memory and stores the first data at the address in the single port memory during a second clock cycle of the system clock that is different than the one or more first clock cycles.

Use of cache to reduce memory bandwidth pressure with processing pipeline

A device may emulate target instructions by executing a first set of microinstructions, and may store a base address of a table that includes a microinstruction provided in a second set of microinstructions for emulating the target instructions. The device may also locate the microinstruction based on the stored base address, and emulate one of the target instructions by executing the microinstruction.

Emulation of multiple instruction sets

An example computing device includes a prefix lookup module, and a Bloom filter that includes a set of queues. The prefix lookup module is configured to receive policy configuration information, examine a state of a queue of the set of queues, and determine whether to bypass the first Bloom filter based on the policy configuration information and the state of the queue. In one example, the prefix lookup module may be configured to, using the policy configuration information, determine to bypass the Bloom filter when the queue is full. In another example, the prefix lookup module may be configured to, using the policy configuration information, determine not to bypass the Bloom filter and send a lookup request to the Bloom filter upon determining that the queue is no longer full.

Dynamic bypass mechanism to alleviate bloom filter bank contention

In one embodiment, an apparatus includes a loopback module configured to receive a first copy of a target vector during a clock cycle. The target vector can include a quantity of set bit values and can be defined based on a portion of data. The loopback module can be configured to define a loopback vector that has a quantity of set bit values that is less than a quantity of set bit values included in the first copy of the target vector. The apparatus also can include an index module configured to receive a second copy of the target vector during the clock cycle. The index module can be configured to define, during the clock cycle, an index vector based on the second copy of the target vector. The index vector can be configured to trigger an element associated with a switch fabric to process the data.

Methods and apparatus for indexing set bit values in a long vector associated with a switch fabric

In one embodiment, a method includes classifying a data packet received at a switch fabric, selecting an action descriptor in response to the classifying, and processing an action defined in the action descriptor. The classifying is based on a primary classification condition and first portion of the data packet. The action descriptor is associated with the primary classification condition. The processing includes determining whether a secondary classification condition is satisfied by a second portion of the data packet.

Methods and apparatus for packet classification based on multiple conditions

A method for emulating a nexthop instruction in microcode with the assistance of dedicated hardware to extract read and write addressing from the nexthop instruction instead of performing this operation in microcode. A method for emulating a nexthop instruction in microcode with the assistance of dedicated hardware to compare a nexthop read address to a special value and to indicate whether the nexthop read address matches the special value, instead of performing this operation in microcode. A method for determining a network address by performing a single extraction of bit fields of a tree instruction to allow multiple tree search processes to be performed.

Hardware support for instruction set emulation

In one embodiment, a method includes accessing a condition test vector, selecting a key from a plurality of keys, and determining whether the key selected and a condition value satisfy a condition relation. The accessing being based on an index value. The condition test vector including a first plurality of bit values defining the condition relation, a second plurality of bit values defining a key selector, and a third plurality of bit values defining the condition value. The selecting being based on the second plurality of bit values. Each key from the plurality of keys including a combination of bit values representing a portion of a data packet. A result is defined based on the determining.

Growing community of inventors

Fremont, CA, United States of America

Jianhui Huang