Juniper Networks, Inc.

Venkatasubramanian Swaminathan

Deepak Goel

John Keen

Jianhui Huang

Jean-Marc Frailong

Srinivasan Jagannadhan

Srilakshmi Adusumalli

David Skinner

A firewall device may include a forwarding component that includes a filter block. The filter block may obtain a first hardware-implemented filter, where a hardware implementation limits the first hardware-implemented filter to a maximum quantity of rules; determine whether a last rule associated with the accessed hardware-implemented filter includes a split-filter action, where the split-filter action identifies a second hardware-implemented filter; and link the second hardware-implemented filter to the first hardware-implemented filter to make the second hardware-implemented filter a logical continuation of the first hardware-implemented filter, in response to determining that the last rule includes the split-filter action. The filter block may further determine whether a particular rule of the first hardware-implemented filter includes a next-filter action, where the next filter action identifies a third hardware-implemented filter; and process the third hardware-implemented filter independently of the sequence of hardware attachment points.

Hardware implementation of complex firewalls using chaining technique

An example network device includes a network interface configured to receive a packet of a packet flow, wherein the packet flow is one of a plurality of packet flows processed by the network device, a flow cache configured to receive a lookup key associated with the packet flow, and a Bloom filter configured to process the lookup key. The flow cache is further configured to store information about a portion of the plurality of packet flows processed by the network device, and determine whether to store information about the packet flow by at least applying a selection criterion to processing of the lookup key by the Bloom filter. The flow cache is configured to determine whether the lookup key is stored in the flow cache, and, when the lookup key is stored in the flow cache, retrieve a stored result associated with the lookup key and output the stored result.

Flow cache mechanism for performing packet flow lookups in a network device

An example computing device includes a prefix lookup module, and a Bloom filter that includes a set of queues. The prefix lookup module is configured to receive policy configuration information, examine a state of a queue of the set of queues, and determine whether to bypass the first Bloom filter based on the policy configuration information and the state of the queue. In one example, the prefix lookup module may be configured to, using the policy configuration information, determine to bypass the Bloom filter when the queue is full. In another example, the prefix lookup module may be configured to, using the policy configuration information, determine not to bypass the Bloom filter and send a lookup request to the Bloom filter upon determining that the queue is no longer full.

Dynamic bypass mechanism to alleviate bloom filter bank contention

Growing community of inventors

San Jose, CA, United States of America

Venkatasubramanian Swaminathan